Improve JS course key validation to not allow special chars. - #28
Closed
mtyaka wants to merge 95 commits into
Closed
Improve JS course key validation to not allow special chars. #28mtyaka wants to merge 95 commits into
mtyaka wants to merge 95 commits into
Conversation
mtyaka
changed the title
mtyaka
force-pushed
the
mtyaka/validate-chars
branch
from
January 8, 2015 15:10
11cf572 to
b9bab9b
Compare
mtyaka
force-pushed
the
mtyaka/validate-chars
branch
from
January 9, 2015 07:31
b9bab9b to
84fd78e
Compare
mtyaka
changed the title
In inline discussion if we have two discussion module the new post button open form for both discussions as well as cancel button of one discussion call the cancel of other. Click and button actions are now being handled inside view of each module so that they don't disturb eachother. TNL-776
…ified-courses' into aamir-khan/ECOM-528-donation-verified-courses Conflicts: common/djangoapps/student/tests/test_recent_enrollments.py
This hotfix patches the functionality of the GridFS PR by dismissing the error msg when the user uploads a large file and fails, then uploads a regular file. This includes a Jasmine test to cover this case.
e-kolpakov
force-pushed
the
content-libraries
branch
from
January 12, 2015 13:28
a622c71 to
134a75b
Compare
of dangling children references to blocks. TNL-1141
…-verified-courses Aamir khan/ecom 528 donation verified courses
Fix flakiness on annotation selenium test
…r-khan/ECOM-335-caching-api into this branch.
update copyright dates
…-update Update translations (autogenerated message)
Improve Django Admin Panel for Admin Roles.
Fix i18n from Destination team pages
…rt-command Fix email_opt_in_list export command to parse options correctly.
Fix visual bug with large file error msg in cms.
edX Solutions Team: Default LMS security settings changes (Matasano)
Adding the Enrollment API as a Django App in LMS.
…ngs-fontawesome FIX - Studio: resolving xblock warning messages icons
Fix pep8 violations in common.py
…ent-plurality Fixed pluralization of matching problems in Library Content Module.
Make Tender optional and configurable
…tests add test security settings to bokchoy envs
Co-Authored-By: Jean-Michel Claus <jmc@edx.org> Co-Authored-By: Brian Talbot <btalbot@edx.org> Co-Authored-By: Tim Babych <tim@edx.org> Co-Authored-By: Oleg Marshev <oleg@edx.org> Co-Authored-By: Chris Rodriguez <crodriguez@edx.org>
update django to release 1.4.18
TNL-213: Student Notes
Add help tokens: cohort courses & content libraries
Logger: Add possibility to send sync requests.
Course and Library keys cannot contiain !'()* special characters, but the JS validation on the new course/library failed to detect these characters. `encodeURIComponent` is used to check the string for special characters, but `encodeURIComponent` does not encode these characters: -_!~*'(). (see https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent) The -_~ characters are allowed in course keys, but !'()* are not, so add an explicit check for these characters to make sure a field containing these characters does not pass the validation.
mtyaka
force-pushed
the
mtyaka/validate-chars
branch
from
January 15, 2015 07:33
84fd78e to
d8e0765
Compare
Member
Author
clemente
pushed a commit
that referenced
this pull request
Nov 1, 2020
SE-2898 Cherry pick xss fixes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background: Existing JS validation on new course and library forms prevents the user from submitting course/library keys that contain special characters, but it fails to detect these special characters:
!'()*.Discussions: The issue was discovered by @catong while reviewing #23 (diff)
Affected Components: Studio
Test Instructions: Go to the Studio home page and click the 'New Course' button to display the new course form. Put a string containing one of the special
!'()*characters in any of 'Organization', 'Course Number', or 'Course Run' fields. Without this patch, the JS validation will fail to detect the special characters and will let you submit the form. Course creation will fail on the server because special characters are not allowed in these fields. With this patch enabled, JS validation will detect the special characters and will not let you submit the form (see screenshot).