From 771a7d06ca2f2e01479ea982a7a6906ed65ee057 Mon Sep 17 00:00:00 2001 From: Muhammad Rehan Date: Mon, 23 Nov 2015 17:49:33 +0500 Subject: [PATCH 1/9] Implement 'from_string_or_404' util and its example usage. --- cms/djangoapps/contentstore/views/course.py | 6 ++-- common/djangoapps/util/course_key_utils.py | 30 +++++++++++++++++ .../util/tests/test_course_key_utils.py | 32 +++++++++++++++++++ 3 files changed, 64 insertions(+), 4 deletions(-) create mode 100644 common/djangoapps/util/course_key_utils.py create mode 100644 common/djangoapps/util/tests/test_course_key_utils.py diff --git a/cms/djangoapps/contentstore/views/course.py b/cms/djangoapps/contentstore/views/course.py index 9670ee3cf5..00cf07215f 100644 --- a/cms/djangoapps/contentstore/views/course.py +++ b/cms/djangoapps/contentstore/views/course.py @@ -90,6 +90,7 @@ from util.organizations_helpers import ( organizations_enabled, ) from util.string_utils import _has_non_ascii_characters +from util.course_key_utils import from_string_or_404 from xmodule.contentstore.content import StaticContent from xmodule.course_module import CourseFields from xmodule.course_module import DEFAULT_START_DATE @@ -868,10 +869,7 @@ def course_info_handler(request, course_key_string): GET html: return html for editing the course info handouts and updates. """ - try: - course_key = CourseKey.from_string(course_key_string) - except InvalidKeyError: - raise Http404 + course_key = from_string_or_404(course_key_string) with modulestore().bulk_operations(course_key): course_module = get_course_and_check_access(course_key, request.user) diff --git a/common/djangoapps/util/course_key_utils.py b/common/djangoapps/util/course_key_utils.py new file mode 100644 index 0000000000..ab58a6558d --- /dev/null +++ b/common/djangoapps/util/course_key_utils.py @@ -0,0 +1,30 @@ +""" +Convenience methods for working with course objects +""" +from django.http import Http404 +from opaque_keys import InvalidKeyError +from opaque_keys.edx.keys import CourseKey + + +def from_string_or_404(course_key_string): + """ + Gets CourseKey from the string passed as parameter. + + Parses course key from string(containing course key) or raises 404 if the string's format is invalid. + + Arguments: + course_key_string(str): It is string containing the course key + + Returns: + CourseKey: A key that uniquely identifies a course + + Raises: + HTTP404: A 404 not found exception will be thrown if course_key_string's format is invalid + + """ + try: + course_key = CourseKey.from_string(course_key_string) + except InvalidKeyError: + raise Http404 + + return course_key diff --git a/common/djangoapps/util/tests/test_course_key_utils.py b/common/djangoapps/util/tests/test_course_key_utils.py new file mode 100644 index 0000000000..efc88a09ee --- /dev/null +++ b/common/djangoapps/util/tests/test_course_key_utils.py @@ -0,0 +1,32 @@ +""" +Tests for util.course_key_utils +""" +from nose.tools import assert_equals, assert_raises # pylint: disable=no-name-in-module +from util.course_key_utils import from_string_or_404 +from opaque_keys.edx.keys import CourseKey +from django.http import Http404 + + +def test_from_string_or_404(): + + #testing with split style course keys + assert_raises( + Http404, + from_string_or_404, + "/some.invalid.key/course-v1:TTT+CS01+2015_T0" + ) + assert_equals( + CourseKey.from_string("course-v1:TTT+CS01+2015_T0"), + from_string_or_404("course-v1:TTT+CS01+2015_T0") + ) + + #testing with mongo style course keys + assert_raises( + Http404, + from_string_or_404, + "/some.invalid.key/TTT/CS01/2015_T0" + ) + assert_equals( + CourseKey.from_string("TTT/CS01/2015_T0"), + from_string_or_404("TTT/CS01/2015_T0") + ) From ea347c7a9bcbadb89dfb6f83d4dc1f90f867b34c Mon Sep 17 00:00:00 2001 From: Daniel Friedman Date: Wed, 23 Mar 2016 11:11:08 -0400 Subject: [PATCH 2/9] Make CMS activation_complete template safe by default --- cms/templates/activation_complete.html | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/cms/templates/activation_complete.html b/cms/templates/activation_complete.html index 135f15764d..768f17f054 100644 --- a/cms/templates/activation_complete.html +++ b/cms/templates/activation_complete.html @@ -1,10 +1,18 @@ -<%! from django.utils.translation import ugettext as _ %> +<%! +from openedx.core.djangolib.markup import Text +from django.utils.translation import ugettext as _ +%> +<%page expression_filter="h"/> <%inherit file="base.html" /> <%block name="content">
-

${_("{studio_name} Account Activation").format(studio_name=settings.STUDIO_SHORT_NAME)}

+

+ ${_("{studio_name} Account Activation").format( + studio_name=Text(settings.STUDIO_SHORT_NAME) + )} +

@@ -17,14 +25,20 @@

${_("Your account activation is complete!")}

-

${_("Thank you for activating your account. You may now sign in and start using {studio_name} to author courses.").format(studio_name=settings.STUDIO_NAME)}

+

+ ${_("Thank you for activating your account. You may now sign in and start using {studio_name} to author courses.").format( + studio_name=Text(settings.STUDIO_NAME) + )} +

From 11bb281019dc5adf11ac084046fce2a8910af826 Mon Sep 17 00:00:00 2001 From: Peter Fogg Date: Wed, 23 Mar 2016 11:19:01 -0400 Subject: [PATCH 3/9] Remove old teams example templates. --- lms/templates/ux/reference/teams-base.html | 382 ------------------- lms/templates/ux/reference/teams-create.html | 205 ---------- 2 files changed, 587 deletions(-) delete mode 100644 lms/templates/ux/reference/teams-base.html delete mode 100644 lms/templates/ux/reference/teams-create.html diff --git a/lms/templates/ux/reference/teams-base.html b/lms/templates/ux/reference/teams-base.html deleted file mode 100644 index abe0e611f1..0000000000 --- a/lms/templates/ux/reference/teams-base.html +++ /dev/null @@ -1,382 +0,0 @@ -<%! from django.utils.translation import ugettext as _ %> -<%! from django.template.defaultfilters import escapejs %> -<%! from edxnotes.helpers import is_feature_enabled as is_edxnotes_enabled %> -<%inherit file="/main.html" /> -<%namespace name='static' file='/static_content.html'/> - -<%block name="bodyclass">in-course view-teams -<%block name="title"> -Teams | Course name - - - -<%block name="header_extras"> - - - - - -<%block name="headextra"> -<%static:css group='style-course-vendor'/> -<%static:css group='style-course'/> -<%block name="nav_skip">${"#content" if section_title else "#content"} - - -<%block name="js_extra"> - - - - - -
-
-
- -
-
- -

Solar Power

-

Teams working on projects related to Week 3 - 10 group activities

-
- -
-
-
- - - -
-
-
-
-
-
-
-
-

We couldn't find the team "blah".

-
-
-
-
- -
- - -
-
- 1-10 of 24 topics | - - - - -
- -
-
-
-
- Topic -

Renewable Energy

-

Explore how changes in renewable energy production will change our day-to-day lives

-
-
-
-
-

34 Teams

-
-
- View Teams in the Renewable Energy Topic -
-
-
- -
-
-
- Topic -

Solar Power Cells

-

Discuss the current technology trajectory of solar power cells

-
-
-
-
-

34 Teams

-
-
- View Teams in the Solar Power Cells Topic -
-
-
- -
-
-
- Topic -

Wind Energy

-

Explore how we can harness wind energy, either through large turbine farms, mid-ocean wind farms, and other types of wind energy that would be cut off from this listing because it is so long

-
-
-
-
-

34 Teams

-
-
- View Teams in the Wind Energy Topic -
-
-
- -
-
-
- Topic -

Renewable Energy

-

Explore how changes in renewable energy production will change our day-to-day lives

-
-
-
-
-

34 Teams

-
-
- View Teams in the Renewable Energy Topic -
-
-
- -
-
-
- Topic -

Solar Power Cells

-

Discuss the current technology trajectory of solar power cells

-
-
-
-
-

34 Teams

-
-
- View Teams in the Solar Power Cells Topic -
-
-
- -
-
-
- Topic -

Wind Energy

-

Explore how we can harness wind energy, either through large turbine farms, mid-ocean wind farms, and other types of wind energy that would be cut off from this listing because it is so long

-
-
-
-
-

34 Teams

-
-
- View Teams in the Wind Energy Topic -
-
-
-
- - -
- -
-
-
-

Wind Energy

-

Explore how we can harness wind energy, either through large turbine farms, mid-ocean wind farms, and other types of wind energy that would be cut off from this listing because it is so long

-
-
- View Wind Energy Team -
-
-
-
-
- 12 / 15 Members -
    -
  • AlexeiK
    • -
  • Assam-S
    • -
  • SadieDearest
    • -
-
-

Last activity: 10 minutes ago

-
-
-
- -
-
-
-

Team Solar

-

Team description that may need to be capped at 140 chars or so.

-
-
- View Team Solar Team -
-
-
-
-
- 12 / 15 Members -
    -
  • AlexeiK
    • -
  • Assam-S
    • -
  • SadieDearest
    • -
-
-

Project 1

-

North America

-

English

-

Last activity: 10 minutes ago

-
-
-
- -
-
-
-

Team Solar

-

Team description that may need to be capped at 140 chars or so.

-
-
- View Team Solar Team -
-
-
-
-
- 15 / 15 Members -
    -
  • AlexeiK
    • -
  • Assam-S
    • -
  • SadieDearest
    • -
-
-

Project 1

-

North America

-

English

-

Last activity: 10 minutes ago

-
-
-
-
- -
- -
- -
-
-
diff --git a/lms/templates/ux/reference/teams-create.html b/lms/templates/ux/reference/teams-create.html deleted file mode 100644 index 3b256ed4f7..0000000000 --- a/lms/templates/ux/reference/teams-create.html +++ /dev/null @@ -1,205 +0,0 @@ -<%! from django.utils.translation import ugettext as _ %> -<%! from django.template.defaultfilters import escapejs %> -<%! from edxnotes.helpers import is_feature_enabled as is_edxnotes_enabled %> -<%inherit file="/main.html" /> -<%namespace name='static' file='/static_content.html'/> - -<%block name="bodyclass">in-course view-teams -<%block name="title"> -Create New Team | [Course name] - - -<%block name="header_extras"> - - - - - -<%block name="headextra"> -<%static:css group='style-course-vendor'/> -<%static:css group='style-course'/> -<%block name="nav_skip">${"#content" if section_title else "#content"} - - -<%block name="js_extra"> - - - - - -
-
-
- -
-
- -

Create a New Team

-

If you cannot find an existing team to join or would like to team up with a group of friends, create a new team.

-
-
-
-
-
-

Oops!

-
-

We couldn't create your team because something needs to be fixed below.

-
-
-
-
-
- -
-
- Required Information - -
- - - The name that will identify your team -
- -
- - - A short description of the team to help other students understand the goals or directives the team is pursuing -
-
- -
- Optional Characteristics -

Help other students find and join your team by specifying characteristics. The more limitations you add, the fewer students may be interested in joining, so choose carefully.

-
- - - The primary language of the team -
-
- - - The primary country of the team -
-
- -
- - -
-
-
- -
-
-
From 48e2299e47dfedc578e9349d9d7b85cde1fac62c Mon Sep 17 00:00:00 2001 From: Daniel Friedman Date: Wed, 23 Mar 2016 11:21:50 -0400 Subject: [PATCH 4/9] Make CMS activation_invalid template safe by default --- cms/templates/activation_invalid.html | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/cms/templates/activation_invalid.html b/cms/templates/activation_invalid.html index fd9e5a9e5f..bdb135ee3b 100644 --- a/cms/templates/activation_invalid.html +++ b/cms/templates/activation_invalid.html @@ -1,10 +1,18 @@ -<%! from django.utils.translation import ugettext as _ %> +<%! +from openedx.core.djangolib.markup import HTML, Text +from django.utils.translation import ugettext as _ +%> +<%page expression_filter="h"/> <%inherit file="base.html" /> <%block name="content">
-

${_("{studio_name} Account Activation").format(studio_name=settings.STUDIO_SHORT_NAME)}

+

+ ${_("{studio_name} Account Activation").format( + studio_name=Text(settings.STUDIO_SHORT_NAME) + )} +

@@ -18,10 +26,14 @@

${_("Your account activation is invalid")}

${_("We're sorry. Something went wrong with your activation. Check to make sure the URL you went to was correct, as e-mail programs will sometimes split it into two lines.")}

-

${_("If you still have issues, contact {platform_name} Support. In the meantime, you can also return to {link_start}the {studio_name} homepage.{link_end}").format( - platform_name=settings.PLATFORM_NAME, studio_name=settings.STUDIO_NAME, - link_start='', link_end="" - )}

+

+ ${_("If you still have issues, contact {platform_name} Support. In the meantime, you can also return to {link_start}the {studio_name} homepage.{link_end}").format( + platform_name=Text(settings.PLATFORM_NAME), + studio_name=Text(settings.STUDIO_NAME), + link_start=HTML(''), + link_end=HTML('') + )} +

From 4d6c787930b36735acbca7d5e4e516dbd3d6e5e3 Mon Sep 17 00:00:00 2001 From: Michael Katz Date: Wed, 23 Mar 2016 11:34:21 -0400 Subject: [PATCH 5/9] add filter --- lms/templates/student_profile/third_party_auth.html | 1 + 1 file changed, 1 insertion(+) diff --git a/lms/templates/student_profile/third_party_auth.html b/lms/templates/student_profile/third_party_auth.html index 9eea38ddda..3b2a5c6c4d 100644 --- a/lms/templates/student_profile/third_party_auth.html +++ b/lms/templates/student_profile/third_party_auth.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%! from django.utils.translation import ugettext as _ from third_party_auth import pipeline From 6661063b5a7d1ee10b8cb1efff4be0edc419d336 Mon Sep 17 00:00:00 2001 From: Peter Fogg Date: Wed, 23 Mar 2016 11:38:45 -0400 Subject: [PATCH 6/9] Minor fixes to the safe template linter. --- scripts/safe_template_linter.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/safe_template_linter.py b/scripts/safe_template_linter.py index 7a015f0b75..5c8d43493b 100755 --- a/scripts/safe_template_linter.py +++ b/scripts/safe_template_linter.py @@ -517,7 +517,7 @@ class MakoTemplateLinter(object): | # script tag start | # script tag end <%static:require_module.*?>| # require js script tag start - # require js script tag end""", re.VERBOSE + re.IGNORECASE) + # require js script tag end""", re.VERBOSE | re.IGNORECASE) media_type_re = re.compile(r"""type=['"].*?['"]""", re.IGNORECASE) contexts = [{'index': 0, 'type': 'html'}] @@ -773,7 +773,7 @@ class UnderscoreTemplateLinter(object): end_index: The index of the end of the expression. expression: The text of the expression. """ - unescaped_expression_regex = re.compile("<%=.*?%>") + unescaped_expression_regex = re.compile("<%=.*?%>", re.MULTILINE) expressions = [] for match in unescaped_expression_regex.finditer(underscore_template): From 6f0d1157f1878e3a0a88fb36fbaab1600bc35518 Mon Sep 17 00:00:00 2001 From: Jesse Zoldak Date: Wed, 23 Mar 2016 12:05:08 -0400 Subject: [PATCH 7/9] Add h filter page directive to cms mako templates without variables The files to change were found with: `ack --literal --type=html --match '${' --files-without-matches cms/templates` --- cms/templates/dev/dev_mode.html | 1 + cms/templates/ux/reference/index.html | 1 + cms/templates/ux/reference/modal_access-component.html | 1 + cms/templates/ux/reference/modal_bulkpublish-section.html | 1 + cms/templates/ux/reference/modal_bulkpublish-subsection.html | 1 + cms/templates/ux/reference/modal_bulkpublish-unit.html | 1 + cms/templates/ux/reference/outline_add-section.html | 1 + cms/templates/ux/reference/outline_add-subsection.html | 1 + cms/templates/ux/reference/outline_add-unit.html | 1 + cms/templates/ux/reference/outline_section_header-collapsed.html | 1 + cms/templates/ux/reference/outline_section_header-expanded.html | 1 + cms/templates/ux/reference/outline_status_grading.html | 1 + cms/templates/ux/reference/outline_status_message-error.html | 1 + cms/templates/ux/reference/outline_status_message-lock.html | 1 + .../ux/reference/outline_status_message-unpublished_changes.html | 1 + .../ux/reference/outline_status_message-unpublished_units.html | 1 + cms/templates/ux/reference/outline_status_release-draft.html | 1 + cms/templates/ux/reference/outline_status_release-lock.html | 1 + cms/templates/ux/reference/outline_status_release-released.html | 1 + .../reference/outline_status_release-released_with_parent.html | 1 + cms/templates/ux/reference/outline_status_release-scheduled.html | 1 + .../reference/outline_status_release-scheduled_with_parent.html | 1 + .../ux/reference/outline_subsection_header-collapsed.html | 1 + .../ux/reference/outline_subsection_header-expanded.html | 1 + cms/templates/ux/reference/outline_unit_header.html | 1 + cms/templates/widgets/_ui-dnd-indicator-after.html | 1 + cms/templates/widgets/_ui-dnd-indicator-before.html | 1 + cms/templates/widgets/_ui-dnd-indicator-initial.html | 1 + cms/templates/widgets/metadata-only-edit.html | 1 + cms/templates/widgets/sequence-edit.html | 1 + 30 files changed, 30 insertions(+) diff --git a/cms/templates/dev/dev_mode.html b/cms/templates/dev/dev_mode.html index 9ee409d5de..71252bad1f 100644 --- a/cms/templates/dev/dev_mode.html +++ b/cms/templates/dev/dev_mode.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%inherit file="../base.html" /> <%block name="content"> You're in dev mode! diff --git a/cms/templates/ux/reference/index.html b/cms/templates/ux/reference/index.html index eeb956f495..4121778dcd 100644 --- a/cms/templates/ux/reference/index.html +++ b/cms/templates/ux/reference/index.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/> <%inherit file="../../base.html" /> <%block name="view_notes"> diff --git a/cms/templates/ux/reference/modal_access-component.html b/cms/templates/ux/reference/modal_access-component.html index c52c26cc7e..7608244c3e 100644 --- a/cms/templates/ux/reference/modal_access-component.html +++ b/cms/templates/ux/reference/modal_access-component.html @@ -1,3 +1,4 @@ +<%page expression_filter="h"/>