LMS provides fully qualified callback URL

common/lib/capa/capa/responsetypes.py

@@ -905,7 +905,7 @@ class CodeResponse(LoncapaResponse):
     def _send_to_queue(self, extra_payload):
         # Prepare payload
         xmlstr = etree.tostring(self.xml, pretty_print=True)
-        header = {'return_url': self.system.xqueue_callback_url,
+        header = {'lms_callback_url': self.system.xqueue_callback_url,
                   'queue_name': self.queue_name,
                  }
 
@@ -914,7 +914,7 @@ class CodeResponse(LoncapaResponse):
         h.update(str(self.system.seed))
         h.update(str(time.time()))
         queuekey = int(h.hexdigest(), 16)
-        header.update({'queuekey': queuekey})
+        header.update({'lms_key': queuekey})
 
         body = {'xml': xmlstr,
                 'edX_cmd': 'get_score',

lms/djangoapps/courseware/module_render.py

@@ -140,8 +140,11 @@ def get_module(user, request, location, student_module_cache, position=None):
     # TODO (vshnayder): fix hardcoded urls (use reverse)
     # Setup system context for module instance
     ajax_url = settings.MITX_ROOT_URL + '/modx/' + descriptor.location.url() + '/'
-    xqueue_callback_url = (settings.MITX_ROOT_URL + '/xqueue/' +
-                           str(user.id) + '/' + descriptor.location.url() + '/')
+
+    # Fully qualified callback URL for xqueue
+    xqueue_callback_url = (request.build_absolute_uri('/') + settings.MITX_ROOT_URL + 
+                          'xqueue/' + str(user.id) + '/' + descriptor.location.url() + '/' + 
+                          'score_update')
 
     def _get_module(location):
         (module, _, _, _) = get_module(user, request, location,
@@ -202,8 +205,6 @@ def get_module(user, request, location, student_module_cache, position=None):
 
     return (module, instance_module, shared_module, descriptor.category)
 
-
-# TODO: TEMPORARY BYPASS OF AUTH!
 @csrf_exempt
 def xqueue_callback(request, userid, id, dispatch):
     # Parse xqueue response