Commit Graph

9100 Commits

Author SHA1 Message Date
Ali Akbar
e63770431f Merge pull request #196 from edx/sustaining/security-fixes-4
Sustaining/security fixes 4
2020-09-07 08:26:40 +05:00
Kyle McCormick
b24cb48eb0 Decentralized Devstack changes: Add and push Dockerfile; add decentralized devstack settings (#24666)
* Add and push Dockerfile; add decentralized devstack settings

Co-Authored-By: Diana Huang <dkh@edx.org>
Co-Authored-By: Kyle McCormick <kmccormick@edx.org>

* Remove Python requirements hack

Remove the attempted optimization to the installation of Python
package dependencies.  The dependencies in edx-platform change
about three times per day, so this was of dubious value.  And
because npm is run through nodeenv, which is a Python package,
the Python dependencies installation has to happen first.

* ARCHBOM-1439: Changing workdir to /edx/app/edxapp/edx-platform (#24835)

Context: The Dockerfile tries to stay in sych with legacy stuff.
In the ansible we configure the directory structure such that things
relating to the app but not in the codebase,
such as the env file wind up in /edx/app/edxapp/.
And the codebase winds up in /edx/app/edxapp/edx-platform.

I think due to accident, the dockerfile does
/edx/app/edx-platform/edx-platform instead of /edx/app/edxapp/edx-platform.

This commit tries to have Dockerfile more reflect what is currently happening in production

* Update ports for decentralized devstack ARCHBOM-1447 (#24841)

Switch from the LMS ports we've historically used for NGINX to those used for gunicorn, and fix the Studio ports to match the ones we've historically used for its gunicorn service. Also removed some leftover bits of the requirements hack.

Co-authored-by: Adam Blackwell <ablackwell@edx.org>
Co-authored-by: Diana Huang <dkh@edx.org>
Co-authored-by: jinder1s <msingh@edx.org>
Co-authored-by: Jeremy Bowman <jbowman@edx.org>
Co-authored-by: Manjinder Singh <49171515+jinder1s@users.noreply.github.com>
2020-09-03 11:47:08 -04:00
Adam Butterworth
6231bad22e Revert "Revert "[BD-10] [DEPR-92] Remove directories that includes pattern library."" (#24696) 2020-09-02 15:39:58 -04:00
Awais Jibran
60822404e5 Fix video handouts uploads. 2020-09-02 19:04:01 +05:00
Ali Akbar
96fc73c13f Merge pull request #195 from edx/sustaining/security-fixes-3
Sustaining/security fixes 3
2020-09-01 11:14:55 +05:00
edx-pipeline-bot
98ad7ce677 Merge pull request #24877 from edx/private_to_public_372254e
Mergeback PR from private to public.
2020-08-31 19:19:38 +05:00
Régis Behmo
ba18d48ac3 Get rid of lepl deprecation warning by removing rfc6266 dependency (#24059)
The LEPL dependency was triggering a lot of deprecation warnings of the
form:

    venv/lib/python3.5/site-packages/lepl/matchers/support.py:497:
    DeprecationWarning: inspect.getargspec() is deprecated, use
    inspect.signature() instead
    argspec = getargspec(func)

It turns out that LEPL was only used by the rfc6266_parser package, which
itself was only used in one place to generate utf8-compliant
Content-Disposition headers.

This issue was noticed here:
https://github.com/SWW13/python-rfc6266-parser/issues/2
Unfortunately it is quite difficult to extract LEPL from the
rfc6266-parser package.

The rfc6266-parser package (https://pypi.org/project/rfc6266-parser/) is
itself a fork of the now-unmaintained rfc6266 package
(https://pypi.org/project/rfc6266/). Thus, it became high time to get
rid of this package. The FileResponse object can appropriately set the
Content-Disposition header, and thus replace the rfc6266 functionality,
since Django 2.0: https://code.djangoproject.com/ticket/16470

In our testing, the FileResponse object correctly set the
`filename*=utf-8''` value, following the RFC. The only difference is
that it does not provide "filename" fallback value, as expressed in the
RFC: https://tools.ietf.org/html/rfc6266#appendix-D

With rfc6266_parser:

    >> import rfc6266_parser
    >> rfc6266_parser.build_header("my_file_é.csv", filename_compat="video_urls.csv")
    b"attachment; filename=video_urls.csv; filename*=utf-8''my_file_%C3%A9.csv"

With FileResponse we have:

    >> from django.http import FileResponse
    >> import io
    >> response = FileResponse(io.StringIO(), as_attachment=True, filename="my_file_é.csv", content_type="text/csv")
    >> response.get("Content-Disposition")
    "attachment; filename*=utf-8''my_file_%C3%A9.csv"

We consider that this is a sufficiently minor difference, that will
impact very few browsers.
2020-08-31 09:30:27 -04:00
Uzair Rasheed
372254e3cb Merge pull request #200 from edx/security-fix/fix-xss-in-templates
Security fix/fix xss in templates
2020-08-31 10:53:24 +05:00
edX Transifex Bot
7a7cb2f984 fix(i18n): update translations 2020-08-30 17:48:44 -04:00
Saleem Latif
9b72042bf4 Merge pull request #24854 from edx/saleem-latif/3336
ENT-3336: Added default for new enterprise setting INTEGRATED_CHANNELS_API_CHUNK_TRANSMISSION_LIMIT
2020-08-28 14:04:15 +05:00
Saleem Latif
c5502057b1 Added default for new enterprise setting INTEGRATED_CHANNELS_API_CHUNK_TRANSMISSION_LIMIT 2020-08-28 13:17:49 +05:00
Soban Javed
e945013b39 Make redis broker compatible with celery 4.0 2020-08-27 18:46:33 +05:00
Troy Sankey
6e8a114b96 Merge pull request #24823 from edx/pwnage101/cleanup-unused-config-root
Cleanup unused CONFIG_ROOT variable and dead code.
2020-08-26 10:20:55 -04:00
Sid Verma
8d33a5a3e1 Add indexing support for blockstore content libraries 2020-08-24 10:45:01 -04:00
edX Transifex Bot
21edb9f2b4 fix(i18n): update translations 2020-08-23 17:38:59 -04:00
Uzair Rasheed
ea69e0d4b6 Merge pull request #24664 from edx/ratelimit-registration-api
Ratelimit the registration endpoint
2020-08-21 17:39:46 +05:00
uzairr
8ba1d522df fix xss in transcript not found template
PROD-2017
2020-08-21 13:31:49 +05:00
uzairr
ffd585cfab fix xss in grading editor template
PROD-2024
2020-08-21 13:19:46 +05:00
uzairr
1c737b3dd9 fix xblock outline template
PROD-2019
2020-08-21 13:17:38 +05:00
uzairr
636240a400 fix xss in metadata template
PROD-2015
2020-08-21 13:11:43 +05:00
uzairr
ec5a1be52b fix xss in transcript replace template
PROD-2013
2020-08-21 13:08:43 +05:00
uzairr
4481908b02 fix xss in edit section template
PROD-2011
2020-08-21 13:06:35 +05:00
uzairr
57823e16dc fix xss in transcript import template
PROD-2018
2020-08-21 13:04:48 +05:00
uzairr
ef014f5d7f Fix xss in transcript upload template
PROD-2014
2020-08-21 13:00:30 +05:00
uzairr
103a4f20a6 Fix xss in transcript template
PROD-2012
2020-08-21 12:56:30 +05:00
uzairr
e890ec6dd5 Fix xss in team member template
PROD-2009
2020-08-21 12:52:27 +05:00
uzairr
643736e613 Fix xss in signatories templates
PROD-2010
2020-08-21 12:38:37 +05:00
uzairr
6887ab1c26 Fix xss in course handout template
PROD-2002
2020-08-21 12:36:08 +05:00
Troy Sankey
3b6b066c72 Cleanup unused CONFIG_ROOT variable and dead code.
From what I've gleaned, CONFIG_FILE (and LMS_CFG and STUDIO_CFG
environment variables) supercedes CONFIG_ROOT.  There's no code anymore
that reads the value of the CONFIG_ROOT django setting, and in turn the
CONFIG_ROOT environment variable.

Tangentially related to DENG-369
2020-08-20 16:30:33 -04:00
Kyle McCormick
926a40def0 Enable ORGANIZATIONS_APP for devstack Studio (#24820)
It is already enabled in devstack LMS, stage LMS/Studio,
and prod LMS/Studio.

However, it is currently disabled in edge LMS/Studio,
and as far as I know, sandbox LMS/Studio as well as the
default Open edX LMS/Studio.

We would like to move towards enabling it globally by
default, and enabling it in devstack Studio would be
a first step towards that.
2020-08-20 12:19:39 -04:00
Dillon Dumesnil
d75fbde9e7 Merge pull request #24813 from edx/ddumesnil/xml-import-lcm-disable
Disable updating Library Content children during import
2020-08-20 09:10:42 -07:00
Dillon Dumesnil
79e96af197 Disable updating Library Content children during import 2020-08-20 07:26:27 -07:00
uzairr
7bc17c7dd9 Ratelimit the registration endpoint
PROD-880
2020-08-20 18:38:26 +05:00
Kyle McCormick
885627e14f Extend expiration of DEPRECATE_OLD_COURSE_KEYS_IN_STUDIO toggle (#24804)
TNL-7423
2020-08-19 09:53:14 -04:00
Ahtisham Shahid
5d38314fc5 Fixed xss lint issues for prod-1465/66 2020-08-19 13:59:36 +05:00
Ahtisham Shahid
e14e944e86 Fixed xsslinter issue for PROD-1527/28 2020-08-19 13:59:36 +05:00
Ali-D-Akbar
6d8e7dc81e PROD-1575 2020-08-18 17:32:49 +05:00
Ali-D-Akbar
71593b140c PROD-1535 2020-08-18 17:32:49 +05:00
Ali-D-Akbar
c788bb3bf8 PROD-1531 2020-08-18 17:32:49 +05:00
SaadYousaf
0bda30a393 fix issue with transcript dropdown. 2020-08-18 02:15:42 +05:00
alangsto
458b8b14ce added override settings for test (#24777) 2020-08-13 15:46:54 -04:00
alangsto
1f5b1e6c4d Removed waffle flag for proctoring backend advanced setting (#24606)
* remove waffle flag for proctoring providers

removed waffle flag

removed tests

updates for requested changes

corrected mistake

Add edX Django Rest Framework Extensions CSRF App URLS to Studio

MST-334 Make sure the CSRF hooks are in INSTALLED_APPS on Studio (#24607)

ENT-2894: Use new welcome template when redirected from enterprise proxy login view (#24587)

* using new welcome template when redirected from enterprise proxy login view

* enabling safe redirects to enterprise learner portal from login in devstack

* ading admin portal to login redirect whitelist

* running make upgrade to version bump edx-enterprise

fix(i18n): update translations

Updating Python Requirements

[REV-1257] Add upsell tracking for upgrading all programs button on program dashboard (#24589)

Added upsell tracking to the course upgrade all button on the program dashboard so we have a better understanding of when users are clicking our upsell links.

POST proctored exam settings (#24597)

allow blank escalation email (#24613)

[BD-10] Remove _uses_pattern_library property from EdxFragmentViews (#24536)

[BD-10] remove edx-pattern-library from JS bundles (#24165)

Co-authored-by: Sankar Raj <sankar.raj@crystaldelta.com>

Make the ExperimentWaffleFlag respect course masquerading when checking if it's active for a specific enrollment

[REV-1205] Add doc location comment so future devs can easily find it  (#24615)

AA-204: passing correct section information to frontend to complete outline portion of tab

AA-204: adding tests

AA-204: fixed up documentation and tests

[BD-10] Remove uses bootstrap method  (#24535)

Remove pattern library of certificate styles.

update search description on new search string (#24619)

* update search description on new search string

* disable xss-lint rule for jquery.html

make comment more general, to allow for future changes (#24618)

[BD-10] [DEPR-92] Remove pattern library of pavelib folder (#24591)

[BD-10] [DEPR-92] Remove directories that includes pattern-library. (#24602)

Add SSO Records endpoint for support tools

Bucket users regardless of enrollment in courseware MFE experiment

Updating Python Requirements

Change the default value of allow_proctoring_opt_out (#24626)

MST-333

ENT-3143: display message banner guiding user to their enterprise LP if enabled (#24625)

* display message banner guiding user to their enterprise LP if enabled

* adding new sass class name to use same styling as recovery email alert

Add "Source from library" XBlock

This lets the user import a block from a blockstore-based content library into a (modulestore based) course, by copying the block into the course.

Revert "[BD-10] [DEPR-92] Remove pattern library of certificate styles." (#24633)

Revert "[BD-10] [DEPR-92] Remove directories that includes pattern-library. (#24602)"

This reverts commit e4f28debb7.

Revert "[BD-10] [DEPR-92] Remove pattern library of pavelib folder (#24591)" (#24635)

This reverts commit 6980291d96.

allow plus or minus one (#24637)

geoip2: update maxmind geolite country database

fix keyerror with request.session (#24642)

* fix keyerror with request.session

* improve the conditional

AA-127: Created MFE Outline Tab Waffle Flag

Note: The team settled on raising a 404 when the waffle flag is disabled.
Upon receiving the 404, the frontend will redirect to the LMS.

Fixes session caching for enterprise portal links by only caching for auth'd learners

BUG: fixes for saml provider config/data lookup

Fix xss in edit member template

Fix xss while rendering file-upload

Fix xss in date

Fix xss in base site template

* revert

* removed from test_views
2020-08-13 11:37:17 -04:00
Aura Milena Alba
0192de00b2 [BD-10] [DEPR-92] Remove scss files that use pattern library 2020-08-12 13:12:36 -04:00
edx-pipeline-bot
a64970de74 Merge pull request #24760 from edx/private_to_public_8df43bd
Mergeback PR from private to public.
2020-08-12 17:38:12 +05:00
Manjinder Singh
c76ed6ae45 Extracting plugin app from edx-platform (#24678)
* Moving plugins infrastructure to edx-django-utils
This PR extracts the code that enables plugins in edx-platform and puts it in edx-django-utils. This is done to allow other IDAS to add plugin functionality.
2020-08-12 07:48:53 -04:00
Ali Akbar
8df43bd201 Merge pull request #194 from edx/aakbar/PROD-1534
PROD-1534 security fixes
2020-08-12 12:30:25 +05:00
Ali Akbar
fb94f09bea Merge pull request #186 from edx/sustaining/security-fixes-2
Sustaining/security fixes 2
2020-08-12 12:30:14 +05:00
Zia Fazal
601dc79ded Merge pull request #24743 from edx/ziafazal/e2e-tests-devstack
[BD-18] Disable django debug toolbar when running e2e tests
2020-08-12 09:51:47 +05:00
Aura Milena Alba
39900f052c [BD-10] Remove uses of variable uses_pattern_library (#24628) 2020-08-11 09:57:12 -04:00
SaadYousaf
0631b4bc97 PROD-1529 2020-08-11 17:48:57 +05:00