A course creator whose Studio Home reports allow_to_create_new_org: false is shown, in the authoring MFE, an organization dropdown restricted to their allowed orgs, so the UI prevents creating a course under a brand-new organization. The server does not enforce the same rule: a direct POST /course/ from that session with an organization short name that does not exist yet is accepted (HTTP 200) and both the organization and the course are created. The flag gates the UI only.
Where: POST /course/, cms/djangoapps/contentstore/views/course.py, create_new_course
Fix: enforce allow_to_create_new_org server-side in create_new_course (reject an unknown organization with 403 when the creator may not create organizations), matching what the MFE already does.
A course creator whose Studio Home reports allow_to_create_new_org: false is shown, in the authoring MFE, an organization dropdown restricted to their allowed orgs, so the UI prevents creating a course under a brand-new organization. The server does not enforce the same rule: a direct
POST /course/from that session with an organization short name that does not exist yet is accepted (HTTP 200) and both the organization and the course are created. The flag gates the UI only.Where:
POST /course/,cms/djangoapps/contentstore/views/course.py,create_new_courseFix: enforce
allow_to_create_new_orgserver-side in create_new_course (reject an unknown organization with 403 when the creator may not create organizations), matching what the MFE already does.