From 0dcb6ecea5141685e61f2b9a7e41e656c04c51ce Mon Sep 17 00:00:00 2001 From: Diego Millan Date: Thu, 6 Dec 2018 16:55:03 -0500 Subject: [PATCH] Making the regex that gets the index courses more secure --- openedx/core/djangoapps/content/course_overviews/models.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openedx/core/djangoapps/content/course_overviews/models.py b/openedx/core/djangoapps/content/course_overviews/models.py index 624015010e..adedd4b663 100644 --- a/openedx/core/djangoapps/content/course_overviews/models.py +++ b/openedx/core/djangoapps/content/course_overviews/models.py @@ -584,7 +584,7 @@ class CourseOverview(TimeStampedModel): # In rare cases, courses belonging to the same org may be accidentally assigned # an org code with a different casing (e.g., Harvardx as opposed to HarvardX). # Case-insensitive matching allows us to deal with this kind of dirty data. - course_overviews = course_overviews.filter(org__iregex=r'(' + '|'.join(orgs) + ')') + course_overviews = course_overviews.filter(org__iregex=r'(^' + '$|^'.join(orgs) + '$)') if filter_: course_overviews = course_overviews.filter(**filter_)