From 0dcb6ecea5141685e61f2b9a7e41e656c04c51ce Mon Sep 17 00:00:00 2001 From: Diego Millan Date: Thu, 6 Dec 2018 16:55:03 -0500 Subject: [PATCH 001/348] Making the regex that gets the index courses more secure --- openedx/core/djangoapps/content/course_overviews/models.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openedx/core/djangoapps/content/course_overviews/models.py b/openedx/core/djangoapps/content/course_overviews/models.py index 624015010e..adedd4b663 100644 --- a/openedx/core/djangoapps/content/course_overviews/models.py +++ b/openedx/core/djangoapps/content/course_overviews/models.py @@ -584,7 +584,7 @@ class CourseOverview(TimeStampedModel): # In rare cases, courses belonging to the same org may be accidentally assigned # an org code with a different casing (e.g., Harvardx as opposed to HarvardX). # Case-insensitive matching allows us to deal with this kind of dirty data. - course_overviews = course_overviews.filter(org__iregex=r'(' + '|'.join(orgs) + ')') + course_overviews = course_overviews.filter(org__iregex=r'(^' + '$|^'.join(orgs) + '$)') if filter_: course_overviews = course_overviews.filter(**filter_) From 767d626a5e66bf7dc5b3bb3a6ec055b7fb492e49 Mon Sep 17 00:00:00 2001 From: Josue Balandrano Coronel Date: Fri, 2 Aug 2019 16:15:22 +0000 Subject: [PATCH 002/348] [BB-1491] Fix the progress graph y-axis - window resize formatting problem in Ironwood --- lms/templates/courseware/progress_graph.js | 1 + 1 file changed, 1 insertion(+) diff --git a/lms/templates/courseware/progress_graph.js b/lms/templates/courseware/progress_graph.js index 8c1bb8c9d9..b2248441dc 100644 --- a/lms/templates/courseware/progress_graph.js +++ b/lms/templates/courseware/progress_graph.js @@ -273,6 +273,7 @@ $(function () { }; var $grade_detail_graph = $("#${graph_div_id | n, js_escaped_string}"); + $grade_detail_graph.width($grade_detail_graph.parent().width()); if ($grade_detail_graph.length > 0) { var plot = $.plot($grade_detail_graph, series, options); From 136bdf8c0fde91a5e8b3a50ee5dd1f3ea7a7c195 Mon Sep 17 00:00:00 2001 From: Ayub khan Date: Tue, 27 Aug 2019 15:50:05 +0500 Subject: [PATCH 003/348] BOM-357 Fix failing test --- .../contentstore/views/tests/test_transcripts.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/cms/djangoapps/contentstore/views/tests/test_transcripts.py b/cms/djangoapps/contentstore/views/tests/test_transcripts.py index f2f5ce4862..3557c7a21a 100644 --- a/cms/djangoapps/contentstore/views/tests/test_transcripts.py +++ b/cms/djangoapps/contentstore/views/tests/test_transcripts.py @@ -160,7 +160,7 @@ class TestUploadTranscripts(BaseTranscripts): super(TestUploadTranscripts, self).setUp() self.contents = { 'good': SRT_TRANSCRIPT_CONTENT, - 'bad': 'Some BAD data', + 'bad': b'Some BAD data', } # Create temporary transcript files self.good_srt_file = self.create_transcript_file(content=self.contents['good'], suffix='.srt') @@ -186,13 +186,14 @@ class TestUploadTranscripts(BaseTranscripts): Setup a transcript file with suffix and content. """ transcript_file = tempfile.NamedTemporaryFile(suffix=suffix) - wrapped_content = textwrap.dedent(content) + wrapped_content = textwrap.dedent(content.decode('utf-8')) if include_bom: wrapped_content = wrapped_content.encode('utf-8-sig') # Verify that ufeff(BOM) character is in content. self.assertIn(BOM_UTF8, wrapped_content) - - transcript_file.write(wrapped_content) + transcript_file.write(wrapped_content) + else: + transcript_file.write(wrapped_content.encode('utf-8')) transcript_file.seek(0) return transcript_file From f80cbf3ed468169683d0aeba613878a3cd86dfa2 Mon Sep 17 00:00:00 2001 From: Ayub khan Date: Tue, 27 Aug 2019 16:45:46 +0500 Subject: [PATCH 004/348] BOM-294 fixed failing test; --- lms/djangoapps/verify_student/ssencrypt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/djangoapps/verify_student/ssencrypt.py b/lms/djangoapps/verify_student/ssencrypt.py index 73e6ff50e7..f6fce78bc2 100644 --- a/lms/djangoapps/verify_student/ssencrypt.py +++ b/lms/djangoapps/verify_student/ssencrypt.py @@ -97,7 +97,7 @@ def random_aes_key(): def pad(data): """ Pad the given `data` such that it fits into the proper AES block size """ - if six.PY3: + if six.PY3 and not isinstance(data, (bytes, bytearray)): data = six.b(data) padder = PKCS7(AES.block_size).padder() From 70b4004be88bbafc1d2d29c2dcbe1f9f661e5ac5 Mon Sep 17 00:00:00 2001 From: Ayub khan Date: Wed, 28 Aug 2019 15:07:29 +0500 Subject: [PATCH 005/348] BOM-335 py3 unittest fix --- lms/djangoapps/verify_student/tests/test_views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/djangoapps/verify_student/tests/test_views.py b/lms/djangoapps/verify_student/tests/test_views.py index 67e8a85f17..b607d3f174 100644 --- a/lms/djangoapps/verify_student/tests/test_views.py +++ b/lms/djangoapps/verify_student/tests/test_views.py @@ -1529,7 +1529,7 @@ class TestSubmitPhotosForVerification(TestCase): } params[invalid_param] = "" response = self._submit_photos(expected_status_code=400, **params) - self.assertEqual(response.content, "Image data is not valid.") + self.assertEqual(response.content.decode('utf-8'), "Image data is not valid.") def test_invalid_name(self): response = self._submit_photos( From f7d528eee4fa46dd027a5e7fe087701465e97f37 Mon Sep 17 00:00:00 2001 From: Ayub khan Date: Wed, 28 Aug 2019 15:09:48 +0500 Subject: [PATCH 006/348] BOM-289 py3 unittest fix --- lms/djangoapps/verify_student/tests/test_views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/djangoapps/verify_student/tests/test_views.py b/lms/djangoapps/verify_student/tests/test_views.py index 67e8a85f17..e21814472c 100644 --- a/lms/djangoapps/verify_student/tests/test_views.py +++ b/lms/djangoapps/verify_student/tests/test_views.py @@ -1538,7 +1538,7 @@ class TestSubmitPhotosForVerification(TestCase): full_name="", expected_status_code=400 ) - self.assertEqual(response.content, "Name must be at least 1 character long.") + self.assertEqual(response.content.decode('utf-8'), "Name must be at least 1 character long.") def test_missing_required_param(self): # Missing face image parameter From eef343d212d923749030aaff51929e8b1813701d Mon Sep 17 00:00:00 2001 From: Ayub khan Date: Wed, 28 Aug 2019 15:49:58 +0500 Subject: [PATCH 007/348] BOM-264 py3 unit test fix --- lms/djangoapps/verify_student/image.py | 3 ++- lms/djangoapps/verify_student/tests/test_views.py | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/lms/djangoapps/verify_student/image.py b/lms/djangoapps/verify_student/image.py index d672f8a69c..77773d2023 100644 --- a/lms/djangoapps/verify_student/image.py +++ b/lms/djangoapps/verify_student/image.py @@ -3,6 +3,7 @@ Image encoding helpers for the verification app. """ from __future__ import absolute_import +import base64 import logging log = logging.getLogger(__name__) @@ -30,7 +31,7 @@ def decode_image_data(data): """ try: - return (data.split(",")[1]).decode("base64") + return base64.b64decode(data.split(",")[1]) except (IndexError, UnicodeEncodeError): log.exception("Could not decode image data") raise InvalidImageData diff --git a/lms/djangoapps/verify_student/tests/test_views.py b/lms/djangoapps/verify_student/tests/test_views.py index 67e8a85f17..be4d538949 100644 --- a/lms/djangoapps/verify_student/tests/test_views.py +++ b/lms/djangoapps/verify_student/tests/test_views.py @@ -1553,7 +1553,7 @@ class TestSubmitPhotosForVerification(TestCase): # Since the user doesn't have an initial verification attempt, this should fail response = self._submit_photos(expected_status_code=400, face_image=self.IMAGE_DATA) self.assertEqual( - response.content, + response.content.decode('utf-8'), "Photo ID image is required if the user does not have an initial verification attempt." ) From 1a4eb7d2e8f078dbc5fcb9854644a3d18f99bc2e Mon Sep 17 00:00:00 2001 From: Awais Jibran Date: Thu, 22 Aug 2019 16:37:44 +0500 Subject: [PATCH 008/348] Pervent reverse tabnabbing in edx platform --- cms/static/js/base.js | 5 ++++- cms/templates/container.html | 2 +- cms/templates/course-create-rerun.html | 2 +- cms/templates/course_outline.html | 10 +++++----- cms/templates/export.html | 4 ++-- cms/templates/group_configurations.html | 6 +++--- cms/templates/import.html | 4 ++-- cms/templates/index.html | 2 +- ...dd-xblock-component-support-legend.underscore | 2 +- .../js/course-highlights-enable.underscore | 2 +- .../js/highlights-enable-editor.underscore | 2 +- cms/templates/js/license-selector.underscore | 2 +- cms/templates/library.html | 2 +- cms/templates/textbooks.html | 2 +- .../ux/reference/fragments/course-settings.html | 6 +++--- cms/templates/widgets/header.html | 4 ++-- common/lib/xmodule/xmodule/lti_module.py | 2 +- .../tests/views/test_instructor_dashboard.py | 4 ++-- .../instructor/views/instructor_dashboard.py | 4 ++-- lms/static/js/instructor_dashboard/util.js | 2 +- .../components/StudentAccountDeletion.jsx | 8 ++++---- .../components/StudentAccountDeletionModal.jsx | 2 +- .../js/student_account/views/RegisterView.js | 2 +- lms/templates/api_admin/catalogs/edit.html | 2 +- lms/templates/api_admin/catalogs/list.html | 2 +- .../certificates/_accomplishment-banner.html | 6 ++++-- lms/templates/certificates/_badges-modal.html | 4 ++-- lms/templates/courseware/progress.html | 4 ++-- .../credit_eligibility_email.html | 2 +- lms/templates/dashboard.html | 2 +- .../_dashboard_certificate_information.html | 4 ++-- .../dashboard/_dashboard_course_listing.html | 6 ++++-- .../dashboard/_dashboard_credit_info.html | 4 ++-- .../fields/field_order_history.underscore | 2 +- lms/templates/header/header.html | 4 ++-- lms/templates/header/navbar-authenticated.html | 2 +- .../cohort-group-header.underscore | 4 ++-- .../instructor_analytics.html | 2 +- lms/templates/login.html | 2 +- lms/templates/lti.html | 2 +- .../bootstrap/navbar-authenticated.html | 3 ++- .../navigation/navbar-authenticated.html | 1 + lms/templates/navigation/navigation.html | 4 ++-- lms/templates/register-shib.html | 2 +- lms/templates/register.html | 2 +- lms/templates/signup_modal.html | 4 ++-- .../student_account/account_settings.underscore | 2 +- .../student_account/form_field.underscore | 8 ++++---- lms/templates/wiki/delete.html | 2 +- lms/templates/wiki/includes/cheatsheet.html | 6 +++--- openedx/core/djangoapps/api_admin/widgets.py | 4 +++- openedx/core/djangoapps/user_api/api.py | 16 ++++++++++++---- .../core/djangoapps/user_api/tests/test_views.py | 14 +++++++------- .../user_authn/views/tests/test_views.py | 2 +- openedx/core/lib/license/templates/license.html | 2 +- openedx/features/enterprise_support/utils.py | 2 +- .../templates/social_icons.underscore | 2 +- .../learner-achievements-fragment.html | 2 +- themes/edx.org/lms/templates/dashboard.html | 2 +- .../templates/header/navbar-authenticated.html | 6 ++---- .../lms/templates/register-shib.html | 2 +- 61 files changed, 120 insertions(+), 103 deletions(-) diff --git a/cms/static/js/base.js b/cms/static/js/base.js index 0f7fa7f1da..7ef8b9f47c 100644 --- a/cms/static/js/base.js +++ b/cms/static/js/base.js @@ -97,7 +97,10 @@ define([ // general link management - new window/tab $('a[rel="external"]:not([title])') .attr('title', gettext('This link will open in a new browser window/tab')); - $('a[rel="external"]').attr('target', '_blank'); + $('a[rel="external"]').attr({ + rel: 'noopener external', + target: '_blank' + }); // general link management - lean modal window $('a[rel="modal"]').attr('title', gettext('This link will open in a modal window')).leanModal({ diff --git a/cms/templates/container.html b/cms/templates/container.html index ecaa9110e2..6de87b2b28 100644 --- a/cms/templates/container.html +++ b/cms/templates/container.html @@ -144,7 +144,7 @@ from openedx.core.djangolib.markup import HTML, Text

${_("Confirm that you have properly configured content in each of your experiment groups.")}

- ${_("Learn more about component containers")} + ${_("Learn more about component containers")}
% elif is_unit_page:
diff --git a/cms/templates/course-create-rerun.html b/cms/templates/course-create-rerun.html index c8114a56a9..b8cdd06e88 100644 --- a/cms/templates/course-create-rerun.html +++ b/cms/templates/course-create-rerun.html @@ -148,7 +148,7 @@ from openedx.core.djangolib.js_utils import js_escaped_string
- ${_("Learn more about Course Re-runs")} + ${_("Learn more about Course Re-runs")}
diff --git a/cms/templates/course_outline.html b/cms/templates/course_outline.html index 5507ed75fa..44962ae6a6 100644 --- a/cms/templates/course_outline.html +++ b/cms/templates/course_outline.html @@ -164,7 +164,7 @@ from django.core.urlresolvers import reverse
% endif <%static:studiofrontend entry="courseOutlineHealthCheck"> - <% + <% course_key = context_course.id %> { @@ -188,7 +188,7 @@ from django.core.urlresolvers import reverse "settings": ${reverse('settings_handler', kwargs={'course_key_string': unicode(course_key)})| n, dump_js_escaped_json} } } - +
@@ -218,14 +218,14 @@ from django.core.urlresolvers import reverse

${_("Reorganizing your course")}

${_("Drag sections, subsections, and units to new locations in the outline.")}

- ${_("Learn more about the course outline")} + ${_("Learn more about the course outline")}

${_("Setting release dates and grading policies")}

${_("Select the Configure icon for a section or subsection to set its release date. When you configure a subsection, you can also set the grading policy and due date.")}

- ${_("Learn more about grading policy settings")} + ${_("Learn more about grading policy settings")}
@@ -234,7 +234,7 @@ from django.core.urlresolvers import reverse

${Text(_("To make a section, subsection, or unit unavailable to learners, select the Configure icon for that level, then select the appropriate {em_start}Hide{em_end} option. Grades for hidden sections, subsections, and units are not included in grade calculations.")).format(em_start=HTML(""), em_end=HTML(""))}

${Text(_("To hide the content of a subsection from learners after the subsection due date has passed, select the Configure icon for a subsection, then select {em_start}Hide content after due date{em_end}. Grades for the subsection remain included in grade calculations.")).format(em_start=HTML(""), em_end=HTML(""))}

- ${_("Learn more about content visibility settings")} + ${_("Learn more about content visibility settings")}
diff --git a/cms/templates/export.html b/cms/templates/export.html index d0f546d633..bbc74c2046 100644 --- a/cms/templates/export.html +++ b/cms/templates/export.html @@ -235,7 +235,7 @@ else:

${_("Use an archive program to extract the data from the .tar.gz file. Extracted data includes the library.xml file, as well as subfolders that contain library content.")}

- ${_("Learn more about exporting a library")} + ${_("Learn more about exporting a library")}
%else: @@ -269,7 +269,7 @@ else:

${_("Use an archive program to extract the data from the .tar.gz file. Extracted data includes the course.xml file, as well as subfolders that contain course content.")}

- ${_("Learn more about exporting a course")} + ${_("Learn more about exporting a course")}
%endif diff --git a/cms/templates/group_configurations.html b/cms/templates/group_configurations.html index 37bf796795..0e9708954c 100644 --- a/cms/templates/group_configurations.html +++ b/cms/templates/group_configurations.html @@ -86,7 +86,7 @@ from openedx.core.djangolib.markup import HTML, Text

${_("Enrollment track groups allow you to offer different course content to learners in each enrollment track. Learners enrolled in each enrollment track in your course are automatically included in the corresponding enrollment track group.")}

${_("On unit pages in the course outline, you can restrict access to components to learners based on their enrollment track.")}

${_("You cannot edit enrollment track groups, but you can expand each group to view details of the course content that is designated for learners in the group.")}

-

${_("Learn More")}

+

${_("Learn More")}

% endif @@ -96,7 +96,7 @@ from openedx.core.djangolib.markup import HTML, Text

${_("If you have cohorts enabled in your course, you can use content groups to create cohort-specific courseware. In other words, you can customize the content that particular cohorts see in your course.")}

${_("Each content group that you create can be associated with one or more cohorts. In addition to making course content available to all learners, you can restrict access to some content to learners in specific content groups. Only learners in the cohorts that are associated with the specified content groups see the additional content.")}

${Text(_("Click {em_start}New content group{em_end} to add a new content group. To edit the name of a content group, hover over its box and click {em_start}Edit{em_end}. You can delete a content group only if it is not in use by a unit. To delete a content group, hover over its box and click the delete icon.")).format(em_start=HTML(""), em_end=HTML(""))}

-

${_("Learn More")}

+

${_("Learn More")}

% if should_show_experiment_groups: @@ -105,7 +105,7 @@ from openedx.core.djangolib.markup import HTML, Text

${_("Experiment Group Configurations")}

${_("Use experiment group configurations if you are conducting content experiments, also known as A/B testing, in your course. Experiment group configurations define how many groups of learners are in a content experiment. When you create a content experiment for a course, you select the group configuration to use.")}

${Text(_("Click {em_start}New Group Configuration{em_end} to add a new configuration. To edit a configuration, hover over its box and click {em_start}Edit{em_end}. You can delete a group configuration only if it is not in use in an experiment. To delete a configuration, hover over its box and click the delete icon.")).format(em_start=HTML(""), em_end=HTML(""))}

-

${_("Learn More")}

+

${_("Learn More")}

% endif diff --git a/cms/templates/import.html b/cms/templates/import.html index 38678c0562..d37aa30f88 100644 --- a/cms/templates/import.html +++ b/cms/templates/import.html @@ -213,7 +213,7 @@ else:

${_("If you change and import a library that is referenced by randomized content blocks in one or more courses, those courses do not automatically use the updated content. You must manually refresh the randomized content blocks to bring them up to date with the latest library content.")}

- ${_("Learn more about importing a library")} + ${_("Learn more about importing a library")}
%else: @@ -245,7 +245,7 @@ else:

${_("If you perform an import while your course is running, and you change the URL names (or url_name nodes) of any Problem components, the student data associated with those Problem components may be lost. This data includes students' problem scores.")}

- ${_("Learn more about importing a course")} + ${_("Learn more about importing a course")}
%endif diff --git a/cms/templates/index.html b/cms/templates/index.html index ff2b595167..39b193ead7 100644 --- a/cms/templates/index.html +++ b/cms/templates/index.html @@ -519,7 +519,7 @@ from openedx.core.djangolib.js_utils import (
  1. - ${_("Getting Started with {studio_name}").format(studio_name=settings.STUDIO_NAME)} + ${_("Getting Started with {studio_name}").format(studio_name=settings.STUDIO_NAME)}
diff --git a/cms/templates/js/add-xblock-component-support-legend.underscore b/cms/templates/js/add-xblock-component-support-legend.underscore index e3338da691..483e786581 100644 --- a/cms/templates/js/add-xblock-component-support-legend.underscore +++ b/cms/templates/js/add-xblock-component-support-legend.underscore @@ -1,7 +1,7 @@ <% if (support_legend.show_legend) { %> + href="https://edx.readthedocs.io/projects/edx-partner-course-staff/en/latest/exercises_tools/create_exercises_and_tools.html#levels-of-support-for-tools" rel="noopener" target="_blank"> <%- support_legend.documentation_label %> diff --git a/cms/templates/js/course-highlights-enable.underscore b/cms/templates/js/course-highlights-enable.underscore index 885b64bc5f..2b3ea55d5c 100644 --- a/cms/templates/js/course-highlights-enable.underscore +++ b/cms/templates/js/course-highlights-enable.underscore @@ -8,5 +8,5 @@ <% } else { %> <% } %> -Learn more +Learn more diff --git a/cms/templates/js/highlights-enable-editor.underscore b/cms/templates/js/highlights-enable-editor.underscore index de8ee87989..9541113072 100644 --- a/cms/templates/js/highlights-enable-editor.underscore +++ b/cms/templates/js/highlights-enable-editor.underscore @@ -15,7 +15,7 @@ ), { linkStart: edx.HtmlUtils.interpolateHtml( - edx.HtmlUtils.HTML(''), + edx.HtmlUtils.HTML(''), {highlightsDocUrl: xblockInfo.attributes.highlights_doc_url} ), linkEnd: edx.HtmlUtils.HTML('') diff --git a/cms/templates/js/license-selector.underscore b/cms/templates/js/license-selector.underscore index 2245f7deb0..6bf3c97806 100644 --- a/cms/templates/js/license-selector.underscore +++ b/cms/templates/js/license-selector.underscore @@ -3,7 +3,7 @@ <%- gettext("License Type") %>
    - <% var link_start_tpl = ''; %> + <% var link_start_tpl = ''; %> <% _.each(licenseInfo, function(license, licenseType) { %>

  • - + Learn more about Creative Commons diff --git a/cms/templates/widgets/header.html b/cms/templates/widgets/header.html index 1b69f2411e..da845383fd 100644 --- a/cms/templates/widgets/header.html +++ b/cms/templates/widgets/header.html @@ -220,7 +220,7 @@

    ${_("Account Navigation")}