Commit Graph

9300 Commits

Author SHA1 Message Date
Aarif
cce5c9ef1a replaced unittest assertions pytest assertions (#26530) 2021-02-19 12:25:51 +05:00
Ali Akbar
096bfe95dc Merge pull request #223 from edx/IM/security-fixes-12
Incident Management Security Fixes 12
2021-02-17 01:31:49 +05:00
Usman Khalid
62ed654b31 Convert LTIModule into LTIBlock. (#25713) 2021-02-16 09:09:13 -05:00
Jawayria
4fc7b2f640 BOM-2351: Removed unused imports from common/lib/{capa, safe_lxml, symmath, conftest.py} 2021-02-15 13:21:19 +05:00
Carla Duarte
8d2d78dc61 AA-650: block deprecated keys from course home MFE 2021-02-08 13:00:36 -05:00
Ali-D-Akbar
f87507bdfa PROD-2253 2021-02-08 23:00:17 +05:00
Usama Sadiq
1bb06669e3 Merge branch 'master' into usamasadiq/bom-2312-pylint-amnesty-common-lib 2021-02-08 18:26:15 +05:00
Usama Sadiq
90666a6231 Merge pull request #26311 from edx/usamasadiq/bom-2305-pylint-amnesty
Applied pylint-amnesty
2021-02-08 18:23:34 +05:00
usamasadiq
1175838fa5 fix pep8 warnings 2021-02-08 16:08:01 +05:00
usamasadiq
7bbde8f0f5 Applied pylint-amnesty 2021-02-08 13:00:22 +05:00
Matthew Piatetsky
b91f720b7e Merge pull request #26293 from edx/AA-613
[AA-613] Return content type gate for staff users when masquerading as the Learner in Audit or Learner in Limited Access Roles
2021-02-05 09:18:34 -05:00
Matthew Piatetsky
ae7d0a1ed8 Return content type gate for staff users when masquerading as the Learner in Audit or Learner in Limited Access Roles
This is necessary to display the content type gate in the UI
AA-613
2021-02-04 17:34:16 -05:00
Ned Batchelder
ceb0933f18 Merge pull request #26278 from edx/nedbat/less-specific
fix: Studio setting descriptions shouldn't mention edx.org
2021-02-04 16:59:57 -05:00
usamasadiq
bbc386752f Applied pylint-amnesty 2021-02-04 18:52:10 +05:00
Ali Akbar
c5b0056b30 Merge pull request #215 from edx/IM/security-fixes-6
Incident Management Security Fixes 6
2021-02-04 00:03:38 +05:00
Jawayria
12065a30e0 pylint-amnesty on common/lib 2021-02-02 20:12:07 +05:00
Ned Batchelder
70ddda4e71 fix: messages shouldn't name edx.org
These messages appear on 1000 other sites that are not publishing to
edx.org.  There's no need to be so specific.
2021-02-01 08:00:11 -05:00
usamasadiq
dbfec8ee3c Remove nonrequired conditions 2021-02-01 16:30:47 +05:00
Ali-D-Akbar
d6f6dad9a9 PROD-2205 2021-02-01 15:32:27 +05:00
Ali-D-Akbar
3c41404190 PROD-2116 2021-02-01 15:32:27 +05:00
Ali Akbar
0aa1b8f2bf Merge pull request #214 from edx/IM/security-fixes-5
Incident Management Security Fixes 5
2021-01-29 16:55:08 +05:00
Matthew Piatetsky
ff839c364e Merge pull request #26143 from edx/AA-613
[AA-613] Add contains_content_type_gated_content attribute to display items in the Sequence Metadata API.
2021-01-28 12:28:05 -05:00
Matthew Piatetsky
84fb4679c9 Add contains_content_type_gated_content attribute to display items in the Sequence Metadata API. This attribute is used to display the content type gating paywall in frontend-app-learning.
Also, refactor existing timed exam code that checks for content_type_gated_content in a sequence to make it try with the new code
AA-613
2021-01-28 12:00:53 -05:00
stvn
b55a3f9680 Merge PR #26200 fix/mfe-rollout/anonymous-access
* Commits:
  fix: Fix KeyError in vertical_block
2021-01-27 12:19:20 -08:00
stvn
e09a5c9d94 fix: Fix KeyError in vertical_block
This now mimics the way this is (safely) done in the sequence module [1].

References:
- [1] 5f94a082ce/common/lib/xmodule/xmodule/seq_module.py (L657-L658)
2021-01-27 11:40:13 -08:00
Muhammad Soban Javed
d26a59eb67 import task decorator from celery APP instance in CMS (#25953)
* import task decorator from celery APP instance instead of celery package in CMS

* replaced task decorator with shared_task in cms and common

* Fixed import of shared_task

* Fixed import
2021-01-27 18:35:11 +05:00
Manjinder Singh
2723e0e2bd [ARCHBOM-1645] Modifying anonymous_id_for_user() to handly SECRET_KEY rotation (#26162)
These changes were initially made to make it easier to do SECRET_KEY rotations.  Along the way, we found it made sense to refractor the code as well.

Changes made:
- changed get_to_create to create because now the code should only get to this block when a write is necessary
- added a lookup for anonymous_user_id. This is to return an existing anonymous_user_id rather than calculating. This will mitigate the results of SECRET_KEY rotation.
- Added monitoring to help us make better decisions: should we not sue SECRET_KEY, performance considerations...
- put old function behind toggle in case something goes wrong in production with new code
- refractoring function structure for better understanding
2021-01-27 07:23:19 -05:00
Kyle McCormick
e3cfaab487 Merge pull request #25955 from open-craft/symbolist/convert-hidden-module-to-xblock
[BD-04] [SE-3708] Convert HiddenDescriptor to an XBlock.
2021-01-26 13:56:06 -05:00
Régis Behmo
97399cf97c Fix TypeError during transcript upload to S3
On a platform that is configured to upload video transcripts to S3
(`DEFAULT_FILE_STORAGE = "storages.backends.s3boto3.S3Boto3Storage"`),
uploads from the studio fail with a TypeError: "Unicode-objects must be
encoded before hashing"

A full stacktrace of the issue can be found here:
https://sentry.overhang.io/share/issue/2249b6f67d794c7e986cc288758f4ebe/

This error is triggered by md5 hashing in the botocore library, which
itself is used by the S3Boto3Storage storage class. This error does not
occur with filesystem-based uploads because it does not perform checksum
verification. The reason why this error would not occur on edx.org is
unknown. Similar issues were already fixed from edxval.

To address this issue, we encode the transcript file content prior to
sending it to s3.
2021-01-25 12:23:31 +01:00
Ali-D-Akbar
752e0b918d PROD-2145 2021-01-20 00:42:34 +05:00
Usman Khalid
9116599f00 Convert HiddenDescriptor to an XBlock.
The class name has been retained because the class path is
specified in the modulestore config in a number of places.
2021-01-14 01:22:08 +05:00
David Ormsbee
098e047fce Merge pull request #25987 from edx/ormsbee/tnl-7636-xblock-access
Check sequence-level gating in render_xblock (TNL-7636)
2021-01-13 09:35:56 -05:00
David Ormsbee
5f94a082ce Check sequence-level gating in render_xblock (TNL-7636).
There is certain gating logic around pre-reqs, timed exams, etc.
that happen at the SequenceModule level, and should be respected
when rendering descendant XBlocks (like individual problems) that
are in that Sequence. Rather than do a risky refactoring, I'm
keeping that logic where it is and having the render_xblock view
climb up through the ancestor list to call the SequenceModule for
that gating information.

We do _not_ check all descendants (so cousin leaf nodes in the
sequence) for cotent-type-based restrictions because sequences can
become very large (esp. when content libraries are used), and there
is a performance overhead.

If the enclosing sequence is gated in some way, we redirect to the
render_xblock view for that sequence, where hopefully some useful
messaging will be available. This is a stopgap. That redirect
should never happen because we should never be calling the leaf
XBlock for a sequence that is restricted in the MFE. But if somehow
we get there anyway, either by bug or by intrepid user fiddling,
it's better to redirect somewhere that an error _might_ be surfaced
rather than just failing.

This will actually be a little overzealous and lock things down
that should be made visible later. If there's a timed exam and the
exam is completed, it should be the case that content is visible
(just read-only). This commit will block the content before the exam
starts (this is right), open the content while the exam is live
(this is right), but make the content unavailable after the exam
period has finished (this is wrong).

But I am going to go forward with this even knowing it's wrong
because:

1. The render_xblock endpoint should never currently be used in
   timed exams in an intentional way. Neither the mobile experience
   nor the courseware MFE support it.
2. This fix will address security concerns for creative access
   patterns, even if it goes too far.
3. We're going to need to do a lot of work to address both pluggable
   access permissions handling and special exams in the courseware
   MFE, and a better implementation can be done then.
4. I've had multiple failed attempts to get this to work without
   breaking things on and off over the course of weeks, and this
   is a relatively low risk way of doing it that doesn't involve
   a major refactoring (though the bill for that will come due
   when we bring timed exams to the MFE).
2021-01-12 12:57:22 -05:00
Nizar
1e872d4e10 Adds support for enabling custom tinymce plugins in Studio's HTML editor (#25695) 2021-01-11 11:28:20 -05:00
Ali Akbar
0e2d12fc7c Merge pull request #213 from edx/IM/security-fixes-4
Incident Management Security Fixes 4
2021-01-08 21:46:05 +05:00
Usman Khalid
9e38b17202 Convert ErrorModule and NonStaffErrorModule to XBlocks. (#25570) 2021-01-07 10:51:33 -05:00
Dillon Dumesnil
e17e691d54 AA-501: Use hidden blocks to determine past due status
Blocks that were hidden by access checks would not be used when
calculating past due status for a unit. This adds in a check to
still look at those blocks, but will maintain not rendering them
when being accessed via the MFE
2021-01-06 14:11:03 +00:00
Ali-D-Akbar
a5982c7e09 PROD-2160 2021-01-06 11:36:36 +05:00
Ali-D-Akbar
4a54aa8054 PROD-2157 2021-01-06 11:36:36 +05:00
azanbinzahid
e26f8f223a PROD-2210 2021-01-06 11:36:36 +05:00
Michael Terry
c3baf5c19e Merge pull request #25972 from edx/mikix/banner-cta-tweaks
AA-505: Some design updates for courseware "shift dates" UI
2021-01-05 13:28:37 -05:00
Usman Khalid
75391262da [BD-04] Convert SplitTest XModule to XBlock. (#25696) 2021-01-05 09:55:14 -05:00
Michael Terry
d000eb4f67 AA-505: Some design updates for courseware "shift dates" UI
- Makes the action buttons underneath problems into link buttons
  instead of push buttons. Per UI team
- Updates some colors of status pills like "Past due" or "Completed"
2021-01-04 13:29:58 -05:00
Ali Akbar
d93abb8d6e Merge pull request #212 from edx/IM/security-fixes-3
Incident Management Security Fixes 3
2021-01-04 18:41:49 +05:00
Awais Jibran
90776770dc Revert ".is-hidden" CSS hack and related hint fix (#25938)
Reverts two PRs:
* "Fix hiding of completion/bookmark indicators in legacy courseware (#25919)"
* "Fix hint show" (#25930)

TNL-7845
2020-12-23 11:35:25 -05:00
Awais Jibran
409a3c799f Update display.js
fixes quality
2020-12-22 16:19:15 +05:00
Awais Jibran
278a5d0e5c Fix hint show 2020-12-22 15:31:15 +05:00
Ali-D-Akbar
5b44c8007e PROD-2209 2020-12-18 20:48:05 +05:00
Dillon Dumesnil
dce0778b94 Merge pull request #25905 from edx/ddumesnil/aa-496
AA-496: Don't show reset deadlines banner if no graded problem is pas…
2020-12-17 12:29:39 -08:00
Dillon Dumesnil
6237bce0e7 AA-496: Don't show reset deadlines banner if no graded problem is past due
When determining completion status to show on the vertical, we take
into account if the problems are graded and scored (have a score
and weight). Now we take that into account in regards to showing the
banner inside the vertical too
2020-12-17 20:00:14 +00:00