Commit Graph

10459 Commits

Author SHA1 Message Date
Régis Behmo
d34aa1c643 Document lms/djangoapps/courseware feature toggles 2020-09-16 15:15:46 +02:00
Régis Behmo
c8892d321b Document openedx/core/djangoapps/user_authn feature toggles 2020-09-16 15:14:56 +02:00
Matt Hughes
d8a56eb64e Add programs celery tasks to Studio workers
following forward to work done in PROD-1230
2020-09-15 15:54:48 -04:00
Feanil Patel
d264490fb7 Merge pull request #24952 from regisb/regisb/simplify-waffle-module-name
[BD-21] Simplify hack to obtain waffle module names
2020-09-15 11:19:43 -04:00
Usman Khalid
8546fa6b6f Convert LibraryContentModule to LibraryContentBlock. (#24611) 2020-09-15 08:41:29 -04:00
Régis Behmo
307457a255 Simplify hack to obtain waffle module names
Instead of going up the stacktrace to find the module names of waffle
flags and switches, we manually pass the module __name__ whenever the
flag is created. This is similar to `logging.getLogger(__name__)`
standard behaviour.

As the waffle classes are used outside of edx-platform, we make the new
module_name argument an optional keyword argument. This will change once
we pull waffle_utils outside of edx-platform.

Note that the module name is normally only required to view the list of
existing waffle flags and switches. The module name should not be
necessary to verify if a flag is enabled. Thus, maybe it would make
sense to create a `add` class methor similar to:

    class WaffleFlag:
        @classmethod
        def add(cls, namespace, flag, module):
            instance = cls(namespace, flag)
            cls._class_instances.add((instance, module))
2020-09-14 09:30:24 +02:00
edX Transifex Bot
ee2a1495ff fix(i18n): update translations 2020-09-13 17:44:38 -04:00
Troy Sankey
fce015e08c Create new analytics_exporter.py settings
These new settings files are intended to be used by the Analytics
Exporter automation managed by the DE team.  The Analytics Exporter must
be able to simply clone edx-platform, install requirements, fetch
remote-config, then just run management commands without needing to run
any ansible or pull down any docker/AMI images.  Since the theming app
includes a check that fails if the themes base dir cannot be found, and
that check runs on app startup, we must disable the app.

DENG-379
2020-09-10 21:21:47 -04:00
Troy Sankey
26276c796d export_olx management command: write bytes to stdout correctly
This must have been broken ever since we upgraded from Python 2 to 3.

DENG-379
2020-09-10 21:17:17 -04:00
Ali Akbar
e63770431f Merge pull request #196 from edx/sustaining/security-fixes-4
Sustaining/security fixes 4
2020-09-07 08:26:40 +05:00
Kyle McCormick
b24cb48eb0 Decentralized Devstack changes: Add and push Dockerfile; add decentralized devstack settings (#24666)
* Add and push Dockerfile; add decentralized devstack settings

Co-Authored-By: Diana Huang <dkh@edx.org>
Co-Authored-By: Kyle McCormick <kmccormick@edx.org>

* Remove Python requirements hack

Remove the attempted optimization to the installation of Python
package dependencies.  The dependencies in edx-platform change
about three times per day, so this was of dubious value.  And
because npm is run through nodeenv, which is a Python package,
the Python dependencies installation has to happen first.

* ARCHBOM-1439: Changing workdir to /edx/app/edxapp/edx-platform (#24835)

Context: The Dockerfile tries to stay in sych with legacy stuff.
In the ansible we configure the directory structure such that things
relating to the app but not in the codebase,
such as the env file wind up in /edx/app/edxapp/.
And the codebase winds up in /edx/app/edxapp/edx-platform.

I think due to accident, the dockerfile does
/edx/app/edx-platform/edx-platform instead of /edx/app/edxapp/edx-platform.

This commit tries to have Dockerfile more reflect what is currently happening in production

* Update ports for decentralized devstack ARCHBOM-1447 (#24841)

Switch from the LMS ports we've historically used for NGINX to those used for gunicorn, and fix the Studio ports to match the ones we've historically used for its gunicorn service. Also removed some leftover bits of the requirements hack.

Co-authored-by: Adam Blackwell <ablackwell@edx.org>
Co-authored-by: Diana Huang <dkh@edx.org>
Co-authored-by: jinder1s <msingh@edx.org>
Co-authored-by: Jeremy Bowman <jbowman@edx.org>
Co-authored-by: Manjinder Singh <49171515+jinder1s@users.noreply.github.com>
2020-09-03 11:47:08 -04:00
Adam Butterworth
6231bad22e Revert "Revert "[BD-10] [DEPR-92] Remove directories that includes pattern library."" (#24696) 2020-09-02 15:39:58 -04:00
Awais Jibran
60822404e5 Fix video handouts uploads. 2020-09-02 19:04:01 +05:00
Ali Akbar
96fc73c13f Merge pull request #195 from edx/sustaining/security-fixes-3
Sustaining/security fixes 3
2020-09-01 11:14:55 +05:00
edx-pipeline-bot
98ad7ce677 Merge pull request #24877 from edx/private_to_public_372254e
Mergeback PR from private to public.
2020-08-31 19:19:38 +05:00
Régis Behmo
ba18d48ac3 Get rid of lepl deprecation warning by removing rfc6266 dependency (#24059)
The LEPL dependency was triggering a lot of deprecation warnings of the
form:

    venv/lib/python3.5/site-packages/lepl/matchers/support.py:497:
    DeprecationWarning: inspect.getargspec() is deprecated, use
    inspect.signature() instead
    argspec = getargspec(func)

It turns out that LEPL was only used by the rfc6266_parser package, which
itself was only used in one place to generate utf8-compliant
Content-Disposition headers.

This issue was noticed here:
https://github.com/SWW13/python-rfc6266-parser/issues/2
Unfortunately it is quite difficult to extract LEPL from the
rfc6266-parser package.

The rfc6266-parser package (https://pypi.org/project/rfc6266-parser/) is
itself a fork of the now-unmaintained rfc6266 package
(https://pypi.org/project/rfc6266/). Thus, it became high time to get
rid of this package. The FileResponse object can appropriately set the
Content-Disposition header, and thus replace the rfc6266 functionality,
since Django 2.0: https://code.djangoproject.com/ticket/16470

In our testing, the FileResponse object correctly set the
`filename*=utf-8''` value, following the RFC. The only difference is
that it does not provide "filename" fallback value, as expressed in the
RFC: https://tools.ietf.org/html/rfc6266#appendix-D

With rfc6266_parser:

    >> import rfc6266_parser
    >> rfc6266_parser.build_header("my_file_é.csv", filename_compat="video_urls.csv")
    b"attachment; filename=video_urls.csv; filename*=utf-8''my_file_%C3%A9.csv"

With FileResponse we have:

    >> from django.http import FileResponse
    >> import io
    >> response = FileResponse(io.StringIO(), as_attachment=True, filename="my_file_é.csv", content_type="text/csv")
    >> response.get("Content-Disposition")
    "attachment; filename*=utf-8''my_file_%C3%A9.csv"

We consider that this is a sufficiently minor difference, that will
impact very few browsers.
2020-08-31 09:30:27 -04:00
Uzair Rasheed
372254e3cb Merge pull request #200 from edx/security-fix/fix-xss-in-templates
Security fix/fix xss in templates
2020-08-31 10:53:24 +05:00
edX Transifex Bot
7a7cb2f984 fix(i18n): update translations 2020-08-30 17:48:44 -04:00
Saleem Latif
9b72042bf4 Merge pull request #24854 from edx/saleem-latif/3336
ENT-3336: Added default for new enterprise setting INTEGRATED_CHANNELS_API_CHUNK_TRANSMISSION_LIMIT
2020-08-28 14:04:15 +05:00
Saleem Latif
c5502057b1 Added default for new enterprise setting INTEGRATED_CHANNELS_API_CHUNK_TRANSMISSION_LIMIT 2020-08-28 13:17:49 +05:00
Soban Javed
e945013b39 Make redis broker compatible with celery 4.0 2020-08-27 18:46:33 +05:00
Troy Sankey
6e8a114b96 Merge pull request #24823 from edx/pwnage101/cleanup-unused-config-root
Cleanup unused CONFIG_ROOT variable and dead code.
2020-08-26 10:20:55 -04:00
Sid Verma
8d33a5a3e1 Add indexing support for blockstore content libraries 2020-08-24 10:45:01 -04:00
edX Transifex Bot
21edb9f2b4 fix(i18n): update translations 2020-08-23 17:38:59 -04:00
Uzair Rasheed
ea69e0d4b6 Merge pull request #24664 from edx/ratelimit-registration-api
Ratelimit the registration endpoint
2020-08-21 17:39:46 +05:00
uzairr
8ba1d522df fix xss in transcript not found template
PROD-2017
2020-08-21 13:31:49 +05:00
uzairr
ffd585cfab fix xss in grading editor template
PROD-2024
2020-08-21 13:19:46 +05:00
uzairr
1c737b3dd9 fix xblock outline template
PROD-2019
2020-08-21 13:17:38 +05:00
uzairr
636240a400 fix xss in metadata template
PROD-2015
2020-08-21 13:11:43 +05:00
uzairr
ec5a1be52b fix xss in transcript replace template
PROD-2013
2020-08-21 13:08:43 +05:00
uzairr
4481908b02 fix xss in edit section template
PROD-2011
2020-08-21 13:06:35 +05:00
uzairr
57823e16dc fix xss in transcript import template
PROD-2018
2020-08-21 13:04:48 +05:00
uzairr
ef014f5d7f Fix xss in transcript upload template
PROD-2014
2020-08-21 13:00:30 +05:00
uzairr
103a4f20a6 Fix xss in transcript template
PROD-2012
2020-08-21 12:56:30 +05:00
uzairr
e890ec6dd5 Fix xss in team member template
PROD-2009
2020-08-21 12:52:27 +05:00
uzairr
643736e613 Fix xss in signatories templates
PROD-2010
2020-08-21 12:38:37 +05:00
uzairr
6887ab1c26 Fix xss in course handout template
PROD-2002
2020-08-21 12:36:08 +05:00
Troy Sankey
3b6b066c72 Cleanup unused CONFIG_ROOT variable and dead code.
From what I've gleaned, CONFIG_FILE (and LMS_CFG and STUDIO_CFG
environment variables) supercedes CONFIG_ROOT.  There's no code anymore
that reads the value of the CONFIG_ROOT django setting, and in turn the
CONFIG_ROOT environment variable.

Tangentially related to DENG-369
2020-08-20 16:30:33 -04:00
Kyle McCormick
926a40def0 Enable ORGANIZATIONS_APP for devstack Studio (#24820)
It is already enabled in devstack LMS, stage LMS/Studio,
and prod LMS/Studio.

However, it is currently disabled in edge LMS/Studio,
and as far as I know, sandbox LMS/Studio as well as the
default Open edX LMS/Studio.

We would like to move towards enabling it globally by
default, and enabling it in devstack Studio would be
a first step towards that.
2020-08-20 12:19:39 -04:00
Dillon Dumesnil
d75fbde9e7 Merge pull request #24813 from edx/ddumesnil/xml-import-lcm-disable
Disable updating Library Content children during import
2020-08-20 09:10:42 -07:00
Dillon Dumesnil
79e96af197 Disable updating Library Content children during import 2020-08-20 07:26:27 -07:00
uzairr
7bc17c7dd9 Ratelimit the registration endpoint
PROD-880
2020-08-20 18:38:26 +05:00
Kyle McCormick
885627e14f Extend expiration of DEPRECATE_OLD_COURSE_KEYS_IN_STUDIO toggle (#24804)
TNL-7423
2020-08-19 09:53:14 -04:00
Ahtisham Shahid
5d38314fc5 Fixed xss lint issues for prod-1465/66 2020-08-19 13:59:36 +05:00
Ahtisham Shahid
e14e944e86 Fixed xsslinter issue for PROD-1527/28 2020-08-19 13:59:36 +05:00
Ali-D-Akbar
6d8e7dc81e PROD-1575 2020-08-18 17:32:49 +05:00
Ali-D-Akbar
71593b140c PROD-1535 2020-08-18 17:32:49 +05:00
Ali-D-Akbar
c788bb3bf8 PROD-1531 2020-08-18 17:32:49 +05:00
SaadYousaf
0bda30a393 fix issue with transcript dropdown. 2020-08-18 02:15:42 +05:00
alangsto
458b8b14ce added override settings for test (#24777) 2020-08-13 15:46:54 -04:00