Revert pull request #3466

cms/envs/common.py

@@ -318,7 +318,7 @@
             'css/vendor/ui-lightness/jquery-ui-1.8.22.custom.css',
             'css/vendor/jquery.qtip.min.css',
             'js/vendor/markitup/skins/simple/style.css',
-            'js/vendor/markitup/sets/wiki/style.css',
+            'js/vendor/markitup/sets/wiki/style.css'
         ],
         'output_filename': 'css/cms-style-vendor.css',
     },

common/djangoapps/student/firebase_token_generator.py

@@ -0,0 +1,99 @@
+'''
+    Firebase - library to generate a token
+    License: https://github.com/firebase/firebase-token-generator-python/blob/master/LICENSE
+    Tweaked and Edited by @danielcebrianr and @lduarte1991
+
+    This library will take either objects or strings and use python's built-in encoding
+    system as specified by RFC 3548. Thanks to the firebase team for their open-source
+    library. This was made specifically for speaking with the annotation_storage_url and
+    can be used and expanded, but not modified by anyone else needing such a process.
+'''
+from base64 import urlsafe_b64encode
+import hashlib
+import hmac
+import sys
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+__all__ = ['create_token']
+
+TOKEN_SEP = '.'
+
+
+def create_token(secret, data):
+    '''
+    Simply takes in the secret key and the data and
+    passes it to the local function _encode_token
+    '''
+    return _encode_token(secret, data)
+
+
+if sys.version_info < (2, 7):
+    def _encode(bytes_data):
+        '''
+        Takes a json object, string, or binary and
+        uses python's urlsafe_b64encode to encode data
+        and make it safe pass along in a url.
+        To make sure it does not conflict with variables
+        we make sure equal signs are removed.
+        More info: docs.python.org/2/library/base64.html
+        '''
+        encoded = urlsafe_b64encode(bytes(bytes_data))
+        return encoded.decode('utf-8').replace('=', '')
+else:
+    def _encode(bytes_info):
+        '''
+        Same as above function but for Python 2.7 or later
+        '''
+        encoded = urlsafe_b64encode(bytes_info)
+        return encoded.decode('utf-8').replace('=', '')
+
+
+def _encode_json(obj):
+    '''
+    Before a python dict object can be properly encoded,
+    it must be transformed into a jason object and then
+    transformed into bytes to be encoded using the function
+    defined above.
+    '''
+    return _encode(bytearray(json.dumps(obj), 'utf-8'))
+
+
+def _sign(secret, to_sign):
+    '''
+    This function creates a sign that goes at the end of the
+    message that is specific to the secret and not the actual
+    content of the encoded body.
+    More info on hashing: http://docs.python.org/2/library/hmac.html
+    The function creates a hashed values of the secret and to_sign
+    and returns the digested values based the secure hash
+    algorithm, 256
+    '''
+    def portable_bytes(string):
+        '''
+        Simply transforms a string into a bytes object,
+        which is a series of immutable integers 0<=x<=256.
+        Always try to encode as utf-8, unless it is not
+        compliant.
+        '''
+        try:
+            return bytes(string, 'utf-8')
+        except TypeError:
+            return bytes(string)
+    return _encode(hmac.new(portable_bytes(secret), portable_bytes(to_sign), hashlib.sha256).digest())  # pylint: disable=E1101
+
+
+def _encode_token(secret, claims):
+    '''
+    This is the main function that takes the secret token and
+    the data to be transmitted. There is a header created for decoding
+    purposes. Token_SEP means that a period/full stop separates the
+    header, data object/message, and signatures.
+    '''
+    encoded_header = _encode_json({'typ': 'JWT', 'alg': 'HS256'})
+    encoded_claims = _encode_json(claims)
+    secure_bits = '%s%s%s' % (encoded_header, TOKEN_SEP, encoded_claims)
+    sig = _sign(secret, secure_bits)
+    return '%s%s%s' % (secure_bits, TOKEN_SEP, sig)

common/djangoapps/student/tests/test_token_generator.py

@@ -0,0 +1,43 @@
+"""
+This test will run for firebase_token_generator.py.
+"""
+
+from django.test import TestCase
+
+from student.firebase_token_generator import _encode, _encode_json, _encode_token, create_token
+
+
+class TokenGenerator(TestCase):
+    """
+    Tests for the file firebase_token_generator.py
+    """
+    def test_encode(self):
+        """
+        This tests makes sure that no matter what version of python
+        you have, the _encode function still returns the appropriate result
+        for a string.
+        """
+        expected = "dGVzdDE"
+        result = _encode("test1")
+        self.assertEqual(expected, result)
+
+    def test_encode_json(self):
+        """
+        Same as above, but this one focuses on a python dict type
+        transformed into a json object and then encoded.
+        """
+        expected = "eyJ0d28iOiAidGVzdDIiLCAib25lIjogInRlc3QxIn0"
+        result = _encode_json({'one': 'test1', 'two': 'test2'})
+        self.assertEqual(expected, result)
+
+    def test_create_token(self):
+        """
+        Unlike its counterpart in student/views.py, this function
+        just checks for the encoding of a token. The other function
+        will test depending on time and user.
+        """
+        expected = "eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJ1c2VySWQiOiAidXNlcm5hbWUiLCAidHRsIjogODY0MDB9.-p1sr7uwCapidTQ0qB7DdU2dbF-hViKpPNN_5vD10t8"
+        result1 = _encode_token('4c7f4d1c-8ac4-4e9f-84c8-b271c57fcac4', {"userId": "username", "ttl": 86400})
+        result2 = create_token('4c7f4d1c-8ac4-4e9f-84c8-b271c57fcac4', {"userId": "username", "ttl": 86400})
+        self.assertEqual(expected, result1)
+        self.assertEqual(expected, result2)

common/djangoapps/student/tests/tests.py

@@ -26,7 +26,7 @@
 
 from student.models import anonymous_id_for_user, user_by_anonymous_id, CourseEnrollment, unique_id_for_user
 from student.views import (process_survey_link, _cert_info,
-                           change_enrollment, complete_course_mode_info)
+                           change_enrollment, complete_course_mode_info, token)
 from student.tests.factories import UserFactory, CourseModeFactory
 
 import shoppingcart
@@ -498,3 +498,26 @@ def test_roundtrip_for_logged_user(self):
         anonymous_id = anonymous_id_for_user(self.user, self.course.id)
         real_user = user_by_anonymous_id(anonymous_id)
         self.assertEqual(self.user, real_user)
+
+
+@override_settings(MODULESTORE=TEST_DATA_MIXED_MODULESTORE)
+class Token(ModuleStoreTestCase):
+    """
+    Test for the token generator. This creates a random course and passes it through the token file which generates the
+    token that will be passed in to the annotation_storage_url.
+    """
+    request_factory = RequestFactory()
+    COURSE_SLUG = "100"
+    COURSE_NAME = "test_course"
+    COURSE_ORG = "edx"
+
+    def setUp(self):
+        self.course = CourseFactory.create(org=self.COURSE_ORG, display_name=self.COURSE_NAME, number=self.COURSE_SLUG)
+        self.user = User.objects.create(username="username", email="username")
+        self.req = self.request_factory.post('/token?course_id=edx/100/test_course', {'user': self.user})
+        self.req.user = self.user
+
+    def test_token(self):
+        expected = HttpResponse("eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJpc3N1ZWRBdCI6ICIyMDE0LTAxLTIzVDE5OjM1OjE3LjUyMjEwNC01OjAwIiwgImNvbnN1bWVyS2V5IjogInh4eHh4eHh4LXh4eHgteHh4eC14eHh4LXh4eHh4eHh4eHh4eCIsICJ1c2VySWQiOiAidXNlcm5hbWUiLCAidHRsIjogODY0MDB9.OjWz9mzqJnYuzX-f3uCBllqJUa8PVWJjcDy_McfxLvc", mimetype="text/plain")
+        response = token(self.req)
+        self.assertEqual(expected.content.split('.')[0], response.content.split('.')[0])

common/djangoapps/student/views.py

@@ -44,6 +44,7 @@
     create_comments_service_user, PasswordHistory
 )
 from student.forms import PasswordResetFormNoActive
+from student.firebase_token_generator import create_token
 
 from verify_student.models import SoftwareSecurePhotoVerification, MidcourseReverificationWindow
 from certificates.models import CertificateStatuses, certificate_status_for_student
@@ -1851,3 +1852,26 @@ def change_email_settings(request):
         track.views.server_track(request, "change-email-settings", {"receive_emails": "no", "course": course_id}, page='dashboard')
 
     return JsonResponse({"success": True})
+
+
+@login_required
+def token(request):
+    '''
+    Return a token for the backend of annotations.
+    It uses the course id to retrieve a variable that contains the secret
+    token found in inheritance.py. It also contains information of when
+    the token was issued. This will be stored with the user along with
+    the id for identification purposes in the backend.
+    '''
+    course_id = request.GET.get("course_id")
+    course = course_from_id(course_id)
+    dtnow = datetime.datetime.now()
+    dtutcnow = datetime.datetime.utcnow()
+    delta = dtnow - dtutcnow
+    newhour, newmin = divmod((delta.days * 24 * 60 * 60 + delta.seconds + 30) // 60, 60)
+    newtime = "%s%+02d:%02d" % (dtnow.isoformat(), newhour, newmin)
+    secret = course.annotation_token_secret
+    custom_data = {"issuedAt": newtime, "consumerKey": secret, "userId": request.user.email, "ttl": 86400}
+    newtoken = create_token(secret, custom_data)
+    response = HttpResponse(newtoken, mimetype="text/plain")
+    return response

common/lib/xmodule/xmodule/tests/test_textannotation.py

@@ -38,6 +38,17 @@ def setUp(self):
             ScopeIds(None, None, None, None)
         )
 
+    def test_render_content(self):
+        """
+        Tests to make sure the sample xml is rendered and that it forms a valid xmltree
+        that does not contain a display_name.
+        """
+        content = self.mod._render_content()  # pylint: disable=W0212
+        self.assertIsNotNone(content)
+        element = etree.fromstring(content)
+        self.assertIsNotNone(element)
+        self.assertFalse('display_name' in element.attrib, "Display Name should have been deleted from Content")
+
     def test_extract_instructions(self):
         """
         Tests to make sure that the instructions are correctly pulled from the sample xml above.
@@ -59,5 +70,5 @@ def test_get_html(self):
         Tests the function that passes in all the information in the context that will be used in templates/textannotation.html
         """
         context = self.mod.get_html()
-        for key in ['display_name', 'tag', 'source', 'instructions_html', 'content_html', 'annotation_storage', 'token']:
+        for key in ['display_name', 'tag', 'source', 'instructions_html', 'content_html', 'annotation_storage']:
             self.assertIn(key, context)