christianlight/tutor
6
0
Fork 0
mirror of https://github.com/ChristianLight/tutor.git synced 2024-12-12 14:17:46 +00:00
Code Issues Releases Activity

sec: fix edx-platform xss vulnerability on "next" parameter

Browse Source
This commit is contained in:
Régis Behmo 2022-11-02 10:42:10 +01:00
parent f95c394e38
commit b46a7b0fa8
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -18,6 +18,8 @@ Every user-facing change should have an entry in this changelog. Please respect
## Unreleased
- [Security] Fix edx-platform XSS vulnerability on "next" parameter. (by @regisb)
## v14.1.1 (2022-10-25)
- [Deprecation] Tutor is no longer compatible with Python 3.6. (by @regisb)

3
tutor/templates/build/openedx/Dockerfile
View File

@ -53,6 +53,9 @@ RUN curl -fsSL https://github.com/open-craft/edx-platform/commit/3d54f284f82b61e
# Fix xblock ajax handler vulnerability
# https://github.com/overhangio/edx-platform/tree/overhangio/sec-xblock-ajax
RUN curl -fsSL https://github.com/overhangio/edx-platform/commit/3f0f9eed42.patch | git am
# Fix XSS vulnerability on "next" parameter
# https://github.com/overhangio/edx-platform/tree/overhangio/sec-redirect-xss
RUN curl -fsSL https://github.com/overhangio/edx-platform/commit/e16f8c0986.patch | git am
{%- endif %}
{# Example: RUN curl -fsSL https://github.com/openedx/edx-platform/commit/<GITSHA1> | git am #}