Commit Graph

18549 Commits

Author SHA1 Message Date
Tim McCormack
129cd48266 Include security patch for pinning JWT signature algorithm in apple-id (#26059)
Extract from social-auth-core eed3007c4ccdbe959b1a3ac83102fe869d261948
2021-01-13 17:19:37 +00:00
David Ormsbee
098e047fce Merge pull request #25987 from edx/ormsbee/tnl-7636-xblock-access
Check sequence-level gating in render_xblock (TNL-7636)
2021-01-13 09:35:56 -05:00
Ahtisham Shahid
780deeed7a Merge pull request #217 from edx/ahtisham/PROD-1916-p
Error incase of disabled user social login
2021-01-13 16:24:02 +05:00
edX Transifex Bot
5d1934725d geoip2: update maxmind geolite country database 2021-01-13 04:52:41 -05:00
David Ormsbee
5f94a082ce Check sequence-level gating in render_xblock (TNL-7636).
There is certain gating logic around pre-reqs, timed exams, etc.
that happen at the SequenceModule level, and should be respected
when rendering descendant XBlocks (like individual problems) that
are in that Sequence. Rather than do a risky refactoring, I'm
keeping that logic where it is and having the render_xblock view
climb up through the ancestor list to call the SequenceModule for
that gating information.

We do _not_ check all descendants (so cousin leaf nodes in the
sequence) for cotent-type-based restrictions because sequences can
become very large (esp. when content libraries are used), and there
is a performance overhead.

If the enclosing sequence is gated in some way, we redirect to the
render_xblock view for that sequence, where hopefully some useful
messaging will be available. This is a stopgap. That redirect
should never happen because we should never be calling the leaf
XBlock for a sequence that is restricted in the MFE. But if somehow
we get there anyway, either by bug or by intrepid user fiddling,
it's better to redirect somewhere that an error _might_ be surfaced
rather than just failing.

This will actually be a little overzealous and lock things down
that should be made visible later. If there's a timed exam and the
exam is completed, it should be the case that content is visible
(just read-only). This commit will block the content before the exam
starts (this is right), open the content while the exam is live
(this is right), but make the content unavailable after the exam
period has finished (this is wrong).

But I am going to go forward with this even knowing it's wrong
because:

1. The render_xblock endpoint should never currently be used in
   timed exams in an intentional way. Neither the mobile experience
   nor the courseware MFE support it.
2. This fix will address security concerns for creative access
   patterns, even if it goes too far.
3. We're going to need to do a lot of work to address both pluggable
   access permissions handling and special exams in the courseware
   MFE, and a better implementation can be done then.
4. I've had multiple failed attempts to get this to work without
   breaking things on and off over the course of weeks, and this
   is a relatively low risk way of doing it that doesn't involve
   a major refactoring (though the bill for that will come due
   when we bring timed exams to the MFE).
2021-01-12 12:57:22 -05:00
Nizar
1e872d4e10 Adds support for enabling custom tinymce plugins in Studio's HTML editor (#25695) 2021-01-11 11:28:20 -05:00
Nizar
b49ebb93f8 Adds clean-js jake command to JakePackage and updates building instructions (#25324)
The clean-js jake command helps remove all minified js files that get generated using the minify bundle jake command

By running clean-js before running the minify command, we ensure that the tinymce files are consistent after being rebuilt/minified.

This is helpful with multiple app servers that are applying the same changes to the TinyMCE editor

This ensures that no matter on which machine the files are rebuilt, the resulting minified plugin files are consistent among all
2021-01-11 11:28:07 -05:00
Matthew Piatetsky
53ccf9bd84 Merge pull request #25988 from edx/AA-488
[AA-488] Remove uses of the active field on the schedule model in the code.
2021-01-11 09:34:00 -05:00
Michael Terry
1c322bbe67 Merge pull request #26008 from edx/mikix/timezone-alerts
Show discount deadline in a timezone-aware way
2021-01-11 08:00:43 -05:00
Michael Terry
1482755bbd Show discount deadline in a timezone-aware way
Also, fix it and the access expiration deadline to not hardcode
the date presentation in an American way.
2021-01-08 13:56:18 -05:00
Ali Akbar
0e2d12fc7c Merge pull request #213 from edx/IM/security-fixes-4
Incident Management Security Fixes 4
2021-01-08 21:46:05 +05:00
Usman Khalid
9e38b17202 Convert ErrorModule and NonStaffErrorModule to XBlocks. (#25570) 2021-01-07 10:51:33 -05:00
edX Transifex Bot
3d79b8ab95 geoip2: update maxmind geolite country database 2021-01-06 16:04:06 -05:00
edX cache uploader bot
830ca33564 Updating Bokchoy testing database cache (#25996) 2021-01-07 00:19:47 +05:00
Ahtisham Shahid
b2466c8c2b Error incase of disabled user social login
Updated status code and manage user func

update auth verification

Fixed auth condition

fixed test failuers

fixed style issues

fixed style issues

Created test for auth disabled use

Code refactor

Fixed form ain auth exchange

Fixed oauth apps with disabled user fail

applied quality fixes

Refactored tests

fixed quality issues

removed extra files

Fixed linter issues

Fixed linter issues
2021-01-06 20:37:01 +05:00
Dillon Dumesnil
e17e691d54 AA-501: Use hidden blocks to determine past due status
Blocks that were hidden by access checks would not be used when
calculating past due status for a unit. This adds in a check to
still look at those blocks, but will maintain not rendering them
when being accessed via the MFE
2021-01-06 14:11:03 +00:00
Ali-D-Akbar
a5982c7e09 PROD-2160 2021-01-06 11:36:36 +05:00
Ali-D-Akbar
4a54aa8054 PROD-2157 2021-01-06 11:36:36 +05:00
azanbinzahid
6d7752b5c1 PROD-2212 2021-01-06 11:36:36 +05:00
azanbinzahid
17261b9886 PROD-2143 2021-01-06 11:36:36 +05:00
azanbinzahid
e26f8f223a PROD-2210 2021-01-06 11:36:36 +05:00
Matthew Piatetsky
101c9b6633 Remove uses of the active field on the schedule model in the code.
Removing the active field from the model itself and the database is broken out into a separate ticket (AA-574)
AA-488
2021-01-05 18:25:44 -05:00
Awais Qureshi
44d97d72f1 Merge pull request #25799 from edx/awais786/make-docs
Fixing make docs issue
2021-01-06 01:09:09 +05:00
Michael Terry
c3baf5c19e Merge pull request #25972 from edx/mikix/banner-cta-tweaks
AA-505: Some design updates for courseware "shift dates" UI
2021-01-05 13:28:37 -05:00
Awais Qureshi
1f616f6fcd Fixing make docs
Adding constraint on sphinx.
2021-01-05 22:42:01 +05:00
Usman Khalid
75391262da [BD-04] Convert SplitTest XModule to XBlock. (#25696) 2021-01-05 09:55:14 -05:00
Ali-D-Akbar
6cdcfb9f72 Merge branch 'master' into private_to_public_d93abb8 2021-01-05 11:43:25 +05:00
Zainab Amir
d5c9536f0a send in-active user details on auth failure (#25931) 2021-01-05 10:33:04 +05:00
Michael Terry
d000eb4f67 AA-505: Some design updates for courseware "shift dates" UI
- Makes the action buttons underneath problems into link buttons
  instead of push buttons. Per UI team
- Updates some colors of status pills like "Past due" or "Completed"
2021-01-04 13:29:58 -05:00
Ali Akbar
d93abb8d6e Merge pull request #212 from edx/IM/security-fixes-3
Incident Management Security Fixes 3
2021-01-04 18:41:49 +05:00
edX Transifex Bot
6aa37e2b4d geoip2: update maxmind geolite country database 2020-12-30 16:28:51 -05:00
edX Transifex Bot
e19f474e54 geoip2: update maxmind geolite country database 2020-12-23 16:28:39 -05:00
Awais Jibran
90776770dc Revert ".is-hidden" CSS hack and related hint fix (#25938)
Reverts two PRs:
* "Fix hiding of completion/bookmark indicators in legacy courseware (#25919)"
* "Fix hint show" (#25930)

TNL-7845
2020-12-23 11:35:25 -05:00
Awais Jibran
409a3c799f Update display.js
fixes quality
2020-12-22 16:19:15 +05:00
Awais Jibran
278a5d0e5c Fix hint show 2020-12-22 15:31:15 +05:00
Kyle McCormick
a03bb13492 Fix hiding of completion/bookmark indicators in legacy courseware (#25919)
In the edx.org-next theme, the completion green check-
marks and the little bookmark icons were appearing on every
single unit. This was because a fontawesome CSS rule
in the new theme was overriding the `display: none`,
as set by `.is-hidden`, to be `display: inline: block`.

The fix is to add `!important` to a couple definitions
of `.is-hidden`. Definitely somewhat hacky, but this is
SCSS that we plan to deprecate at some point anyway.

TNL-7823
2020-12-18 17:08:13 -05:00
David Ormsbee
bb0492e598 Merge pull request #25338 from open-craft/nizar/xframe_allow_whitelist
Sets default X-Frame-Options for login and registration forms to environment setting
2020-12-18 12:39:08 -05:00
Ali-D-Akbar
5b44c8007e PROD-2209 2020-12-18 20:48:05 +05:00
Ali-D-Akbar
8159d76e8c PROD-2211 2020-12-18 20:48:05 +05:00
azanbinzahid
35d658e66c PROD-2215 2020-12-18 20:48:05 +05:00
Ali-D-Akbar
6104eda482 PROD-2252 2020-12-18 20:48:05 +05:00
Ali-D-Akbar
a63848bfd5 PROD-2219 2020-12-18 20:48:05 +05:00
edX cache uploader bot
8edcda1189 Updating Bokchoy testing database cache (#25912) 2020-12-18 14:13:29 +05:00
Dillon Dumesnil
dce0778b94 Merge pull request #25905 from edx/ddumesnil/aa-496
AA-496: Don't show reset deadlines banner if no graded problem is pas…
2020-12-17 12:29:39 -08:00
Dillon Dumesnil
6237bce0e7 AA-496: Don't show reset deadlines banner if no graded problem is past due
When determining completion status to show on the vertical, we take
into account if the problems are graded and scored (have a score
and weight). Now we take that into account in regards to showing the
banner inside the vertical too
2020-12-17 20:00:14 +00:00
Bianca Severino
c589601b5b Merge pull request #25900 from edx/bseverino/timed-exams
[MST-575] Enable timed exams by default
2020-12-17 12:31:23 -05:00
Bianca Severino
4984fa73c6 Enable timed exams by default 2020-12-17 12:07:57 -05:00
edX Transifex Bot
b2f1b6935c geoip2: update maxmind geolite country database 2020-12-16 15:58:27 -05:00
Carla Duarte
3fb3f913b5 Merge pull request #25661 from edx/ciduarte/AA-131
AA-131: Allow anonymous users through course home MFE
2020-12-16 15:49:20 -05:00
Dillon Dumesnil
2f7fcdea85 Merge pull request #25897 from edx/ddumesnil/fix-masquerade-for-mfe
Fixes for Shift deadlines during masquerade in Learning MFE
2020-12-16 11:57:23 -08:00