christianlight/tutor
6
0
Fork 0
mirror of https://github.com/ChristianLight/tutor.git synced 2025-01-24 22:08:24 +00:00
Code Issues Releases Activity

fix: allow course import from Course Authoring MFE (#1063)

Browse Source 
Remove CORS_ALLOW_HEADERS setting from the LMS/Studio config template. This
setting, which holds site-agnostic application logic, is now consistently set
to a reasonable value upstream by LMS and CMS config. Using the upstream values
fixes a bug where course import in Studio using the new Course Authoring MFE
was broken in Tutor deployments because it required additional headers to be
allowed (content-range and content-disposition)

Co-authored-by: Kyle McCormick <kyle@axim.org>
This commit is contained in:
David Ormsbee 2024-05-08 16:31:02 -04:00 committed by GitHub
parent 9738eb051a
commit c3d35af807
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/20240508_111720_dave_fix_cors_headers.md Normal file
View File

@ -0,0 +1 @@
- [Bugfix] Remove CORS_ALLOW_HEADERS setting from the LMS/Studio config template. This setting, which holds site-agnostic application logic, is now consistently set to a reasonable value upstream by LMS and CMS config. Using the upstream values fixes a bug where course import in Studio using the new Course Authoring MFE was broken in Tutor deployments because it required additional headers to be allowed (content-range and content-disposition) (by @ormsbee)

3
tutor/templates/apps/openedx/settings/partials/common_all.py
View File

@ -230,7 +230,8 @@ FEATURES["ENABLE_CORS_HEADERS"] = True
CORS_ALLOW_CREDENTIALS = True
CORS_ORIGIN_ALLOW_ALL = False
CORS_ALLOW_INSECURE = {% if ENABLE_HTTPS %}False{% else %}True{% endif %}
CORS_ALLOW_HEADERS = corsheaders_default_headers + ('use-jwt-cookie',)
# Note: CORS_ALLOW_HEADERS is intentionally not defined here, because it should
# be consistent across deployments, and is therefore set in edx-platform.
# Add your MFE and third-party app domains here
CORS_ORIGIN_WHITELIST = []