DO NOT MERGE - DO NOT CLOSE - Dummy PR to track upstream master#824
Draft
kaustavb12 wants to merge 647 commits into
Draft
DO NOT MERGE - DO NOT CLOSE - Dummy PR to track upstream master#824kaustavb12 wants to merge 647 commits into
kaustavb12 wants to merge 647 commits into
Conversation
kaustavb12
marked this pull request as draft
February 6, 2026 08:34
kaustavb12
changed the title
kaustavb12
changed the title
…ails feat: Drop support for the legacy Schedule and Details page.
feat: enterprise 8.0.9 Commit generated by workflow `openedx/openedx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`
* fix: Return 403 when a masqueraded user attempts to access instructor dashboard * fix: Address PR feedback
…38510) Co-Authored-By: Kyle D McCormick <kyle@axim.org>
* feat: add generate exception certificates modal * feat: add tests * fix: tests * fix: linting
The legacy Certificates page in Studio has been replaced with a new view in the Authoring MFE. This change removes the now unused JS/HTML/Python related to the old page. This work is part of #36108 BREAKING CHANGE: The 'legacy_studio.certificates' waffle flag will no longer be respected. The system will behave as if the flag is set to false permanently.
feat: Drop support for the legacy Certificates page.
The legacy Course Team page in Studio has been replaced with a new view in the Authoring MFE. This change removes the now unused JS/HTML/Python related to the old page. This work is part of #36108 BREAKING CHANGE: The 'legacy_studio.course_team' waffle flag will no longer be respected. The system will behave as if the flag is set to false permanently.
feat: Drop support for the legacy Course Team page.
…ages Remove JS models, views, spec files, and Underscore templates that were exclusively used by the legacy Grading and Schedule Details pages, which were dropped in prior commits. This work is part of #36108 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
feat: replace enterprise username import in progress/views.py with pluggable_override
This was part of the old static assets builds pipeline. Its implementation was removed back in ~Redwood. This is just a dangling pointer which would result in `File not found` if anyone tried to run it.
Commit generated by workflow `openedx/openedx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master` Co-authored-by: bcitro <67378070+bcitro@users.noreply.github.com>
…ding-cleanup chore: Fixed remaining code after depr 36108 schedule grading cleanup
Discussion thread titles (and other user-controlled context fields — replier_name, author_name, username) were interpolated raw into notification.content via `str.format(**context)`. That output is rendered with Django's `|safe` filter in digest_content.html, which is included by both the email_digest and batched_email body templates, so a `<style>` block in a thread title survived into recipient inboxes as executable CSS on email open — enabling open-tracking, content spoofing, and phishing. Escape at the source: in `get_notification_content`, wrap every context value with `django.utils.html.escape` before `template.format(**context)`, exempting the two structural keys (`p`, `strong`) that content_templates use as HTML tag names. This defends every renderer of `notification.content` in one place. This is the incomplete-patch companion of GHSA-4xv3-5j4x-q8g4 (CVE-2026-42857), which sanitized the post body via `clean_thread_html_body()` but did not cover the title path. Fixes GHSA-rv5w-f4r5-h77g.
`startswith` is the wrong primitive for "is target inside directory base": once a trailing separator drops anywhere along the way, sibling directories whose names extend base match. We could spot-fix by re-appending the separator before the check, but `commonpath` makes the directory-boundary intent explicit and removes the failure mode entirely. Fixes GHSA-6cmm-8875-5pcw. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…n test Exempt users returned early before UserProfile.objects.get_or_create, so users without a profile never got one created on login while PREVENT_CONCURRENT_LOGINS was enabled. Move the exemption check to only skip set_login_session, and add coverage for SINGLE_LOGIN_EXEMPT_GROUPS and for client1 remaining authenticated after a concurrent login.
…ashboard view The dashboard-view GET added to test_single_session_exempt_user passed locally but failed in CI's shared-with-cms-1 job (400 instead of 200), likely from unrelated view-layer state (MFE redirect flags, site config) picked up when run alongside the rest of that shard. Assert against Session.objects directly instead -- that's the actual mechanism set_login_session uses to evict a session, so it verifies the same thing without depending on the dashboard view rendering successfully.
Each unit-test shard was printing a ~3,700-line per-file coverage table at the end of its log (the default `--cov=.` behavior is `--cov-report=term`). The numbers are also misleading per shard because each shard only runs a subset of the suite. The dedicated `coverage` job already does the meaningful work: it downloads every shard's `.coverage` artifact, runs `coverage combine` + `coverage report` + `coverage xml`, and uploads the result to codecov. Passing `--cov-report=""` to pytest disables the terminal report while leaving the `.coverage` data file intact, so codecov reporting is unaffected and the failure summary is much easier to find in the CI log. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…date-api-issue fix: return certificate_available_date in courses list API response
…iewStarted filter (#38106) Co-authored-by: Kira Miller <31229189+kiram15@users.noreply.github.com>
* feat: convert get_enterprise_customer into a pluggable override * chore: ruff fix for UP045 --------- Co-authored-by: Troy Sankey <tsankey@2u.com>
This is intended to help operators respond to situations where a failing heartbeat check due to an unhealthy backend service causes the entire edxapp cluster to be ejected from the load balancer. Also remove a debugging print line from a unit test. Cherry picked from commits 3956db3 and 4fc67f6 (2U fork).
Adds a library branch to export_handler so that GET /export/<library_key> generates and streams the OLX .tar.gz directly to the browser. Unlike the async Celery flow used for courses, libraries are small enough to export synchronously in a single request with no need to queue a background task, poll for status, or store the output file. This supports the Export button added in the Authoring MFE migration wizard. See: openedx/frontend-app-authoring#2911 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: return relative path from get_proctored_exam_settings_url to prevent double /authoring prefix in MFE sidebar
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Settings
Tutor requirements