Refactor get_object_or_404 calls for Engagement and Engagement_Presets

[Maffooch]

Optimize the get_object_or_404 calls to filter Engagement and Engagement_Presets by their respective relationships, improving data retrieval efficiency. This change enhances the integrity of the data being accessed in the views.

[mtesauro]

Approved

[dryrunsecurity]

🟡 Please give this pull request extra attention during review.

This pull request introduces a view that can allow IDOR: the updated answer_questionnaire view in dojo/survey/views.py only ensures the survey belongs to the engagement but still allows access to the engagement via user-provided IDs when allow_anonymous_survey_repsonse is enabled, letting unauthenticated users guess engagement and survey IDs to read/modify surveys — unlike other views protected by @user_is_authorized.

🟡 Potential IDOR Vulnerability in dojo/survey/views.py (e4da6820)

Vulnerability

Potential IDOR Vulnerability

Description

The 'answer_questionnaire' view in 'dojo/survey/views.py' retrieves both an Engagement and an Answered_Survey using user-supplied integer IDs (eid and sid) without proper, non-bypassable authorization. While the patch adds a check to ensure the survey belongs to the specified engagement ('survey = get_object_or_404(Answered_Survey.objects.filter(engagement=engagement), id=sid)'), the 'engagement' itself is only authorized if 'allow_anonymous_survey_repsonse' is disabled. If this setting is enabled, any user (including unauthenticated ones) can access and modify any survey by guessing its auto-incrementing ID and the associated engagement ID. In contrast, other views in the same file are protected by the '@user_is_authorized' decorator, which enforces strict permission checks on the engagement before the view logic is executed.

django-DefectDojo/dojo/survey/views.py

Lines 100 to 103 in f1f3b93

	survey = get_object_or_404(Answered_Survey.objects.filter(engagement=engagement), id=sid)
	system_settings = System_Settings.objects.all()[0]
	if not system_settings.allow_anonymous_survey_repsonse:

---

All finding details can be found in the DryRun Security Dashboard.