From 48ee155af8de551fe5b2896921220e23938b6dc1 Mon Sep 17 00:00:00 2001
From: Braden MacDonald <braden@opencraft.com>
Date: Thu, 5 Sep 2019 21:57:41 -0700
Subject: [PATCH] Minor fixes for blockstore runtime

---
 common/lib/xmodule/xmodule/video_module/video_module.py | 3 +++
 openedx/core/djangoapps/xblock/rest_api/views.py        | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/common/lib/xmodule/xmodule/video_module/video_module.py b/common/lib/xmodule/xmodule/video_module/video_module.py
index 7e9032fe6c..a19fcf2aac 100644
--- a/common/lib/xmodule/xmodule/video_module/video_module.py
+++ b/common/lib/xmodule/xmodule/video_module/video_module.py
@@ -23,6 +23,7 @@ from operator import itemgetter
 import six
 from django.conf import settings
 from lxml import etree
+from opaque_keys.edx.keys import CourseKey
 from opaque_keys.edx.locator import AssetLocator
 from web_fragments.fragment import Fragment
 from xblock.completable import XBlockCompletionMode
@@ -200,6 +201,8 @@ class VideoBlock(
         return waffle_flags()[DEPRECATE_YOUTUBE].is_enabled(self.location.course_key)
 
     def youtube_disabled_for_course(self):
+        if not isinstance(self.location.course_key, CourseKey):
+            return False  # Only courses have this flag
         if CourseYoutubeBlockedFlag.feature_enabled(self.location.course_key):
             return True
         else:
diff --git a/openedx/core/djangoapps/xblock/rest_api/views.py b/openedx/core/djangoapps/xblock/rest_api/views.py
index 2e8e12ce3f..425ee09394 100644
--- a/openedx/core/djangoapps/xblock/rest_api/views.py
+++ b/openedx/core/djangoapps/xblock/rest_api/views.py
@@ -27,6 +27,7 @@ User = get_user_model()
 
 
 @api_view(['GET'])
+@view_auth_classes(is_authenticated=False)
 @permission_classes((permissions.AllowAny, ))  # Permissions are handled at a lower level, by the learning context
 def block_metadata(request, usage_key_str):
     """
@@ -39,6 +40,7 @@ def block_metadata(request, usage_key_str):
 
 
 @api_view(['GET'])
+@view_auth_classes(is_authenticated=True)
 @permission_classes((permissions.AllowAny, ))  # Permissions are handled at a lower level, by the learning context
 def render_block_view(request, usage_key_str, view_name):
     """