Skip to content

Merge ulmo.3 into release-ulmo#318

Open
dianakhuang wants to merge 24 commits into
release-ulmofrom
edx/ulmo.3
Open

Merge ulmo.3 into release-ulmo#318
dianakhuang wants to merge 24 commits into
release-ulmofrom
edx/ulmo.3

Conversation

@dianakhuang

Copy link
Copy Markdown
Member

No description provided.

pdpinch and others added 17 commits December 9, 2025 13:10
chore(logging): add additional logs for LTI launch flow
This update is required for the Catalog MFE to function, as the new
`unstable/v0/course_list_search/` endpoint was released in `4.4.0`.
django security fixes

Commit generated by workflow `openedx/openedx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`
…penedx#37991) (openedx#37992)

We hope this will fix an error where loremipsum is using pkg_resources,
which setuptools dropped support for as of v82 (released yesterday).
…i-logging

chore(logging): add additional logs for LTI launch flow (backport)
The activation_key field was exposed in /api/user/v1/accounts/{username},
allowing an attacker to bypass email verification by combining two behaviors:
1. OAuth2 password grant issues tokens to inactive users (intentional)
2. activation_key returned in API response (the vulnerability)

An attacker could register, get an OAuth2 token, read the activation_key
from the API, then GET /activate/{key} to activate without email access.

Fix: remove activation_key from UserReadOnlySerializer.to_representation()
and from ACCOUNT_VISIBILITY_CONFIGURATION["admin_fields"] (which controls
the field whitelist in _filter_fields — listed fields default to None even
if absent from the serializer data dict).

Reported by Daniel Baillo via the Open edX security working group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* build: Fix the docs build.

Our use of `fs` means we have a runtime dependency on setuptools. The
newest version is not compatible with the current version of `fs` so
we've added a constraint.  But the docs build didn't previously install
our specified version of setuptools.  This is to fix that.

Co-authored-by: Sarina Canelake <sarina@axim.org>
The view_survey endpoint accepted a redirect_url GET parameter and passed
it directly to HttpResponseRedirect() with no validation. If a non-existent
survey name was requested, this produced an immediate 302 to an
attacker-controlled URL. If a valid survey was requested, the same URL was
embedded in a hidden _redirect_url form field; after submission, submit_answers
echoed it back in JSON and client-side JS used it as location.href — a second
unvalidated redirect path.

Fix both by ignoring user-supplied redirect URLs entirely:
- view_survey no longer reads redirect_url from GET params
- submit_answers always redirects to reverse('dashboard') rather than
  reading _redirect_url from the POST body

Note: view_student_survey retains its redirect_url parameter because it is
also called from the courseware view (courseware/views/views.py), which passes
a server-controlled course_home_url. That call path is unaffected.

Fixes: GHSA-2843-x998-f8r2

BREAKING CHANGE: The redirect_url GET parameter on /survey/<name>/ is no longer
honored. Requests that previously redirected to a caller-specified URL after
survey completion will now always redirect to the dashboard.
Backports: 42e4e0d
Likely fixes: openedx#38027

Co-authored-by: María Fernanda Magallanes <35668326+MaferMazu@users.noreply.github.com>
`clean_thread_html_body()` was missing `<style>` from its tag denylist,
allowing arbitrary CSS to survive sanitization and be rendered via the
`|safe` filter in email templates. This enabled CSS-based email tracking
(IP disclosure via background-image/import), content spoofing, and
phishing via pseudo-elements.

Uses `decompose()` rather than `unwrap()` so the CSS text content is
also removed, not just the tag wrapper.

Ref: GHSA-4xv3-5j4x-q8g4

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds `validate_saml_metadata_url()` to `third_party_auth/utils.py` which
enforces HTTPS and blocks requests to loopback, link-local, and reserved
addresses unconditionally, and RFC 1918 private ranges by default
(configurable via `SAML_METADATA_URL_ALLOW_PRIVATE_IPS`).

The validator is called in three places where user-supplied metadata URLs
are fetched: `fetch_metadata_xml()` in utils.py, the inline fetch in
`tasks.py::fetch_saml_metadata`, and `sync_provider_data` in the
SAMLProviderDataViewSet. A 30-second timeout is also added to all
`requests.get()` calls that were previously unbounded.

Fixes GHSA-328g-7h4g-r2m9.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings June 1, 2026 14:53

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

@github-actions

github-actions Bot commented Jun 1, 2026

Copy link
Copy Markdown

Thank you for your pull request! Congratulations on completing the Open edX tutorial! A team member will be by to take a look shortly.
To those watching community pull requests: No need to worry about this one, a tCRIL team member will be taking care of it.
For this PR's author: If this is a PR that is NOT coming from the Open edX tutorial, please comment and let us know to disregard this message.

This reverts commit 84f4afb.
This is to prevent conflicts when we bring in the upstream version. It
should be reapplied.
Copilot AI review requested due to automatic review settings June 1, 2026 19:54

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot AI review requested due to automatic review settings June 2, 2026 14:03

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot AI review requested due to automatic review settings June 2, 2026 14:38

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

farhan and others added 2 commits June 22, 2026 14:21
- Change the `i18n` service declaration from `wants` to `needs`, since the
  runtime must provide it for the block to function correctly.

- Update the `public_view` webpack JS reference from `VideoBlockMain` to
  `VideoBlockDisplay`, as all VideoBlock JS files are bundled into
  `VideoBlockDisplay` and `VideoBlockMain` is not referring to anything
   or no longer exists in the repository.
…kMain-to-VideoBlockDisplay-ulmo.3

chore: optimize/correct the VideoBlock code (openedx#38012)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants