chore: cherry-pick security fixes - #855

Merged

kaustavb12 merged 12 commits into

viadanna/teak/bump-edxvalfrom

kaustav/cherry-pick-security-fixes

Aug 5, 2026

Commits on Jul 27, 2026

fix: remove activation_key from account REST API response

authored and
kaustavb12
committed
c297cf5
fix!: Merge commit from fork

feanil
authored and
kaustavb12
committed
61b4824
fix: require Django staff to call set_course_mode_price endpoint

authored and
kaustavb12
committed
5b8a769
fix: implement OAuth nonce replay protection in LTI provider

authored and
kaustavb12
committed
1a16277
fix: prevent SSRF in the Studio video download endpoint

authored and
kaustavb12
committed
4c1e811
fix(lint): remove extra empty line added during merge

tecoholic
authored and
kaustavb12
committed
d5eca7b
fix: bump vendored pdf.js to 5.7.284 (#850)

authored and
kaustavb12
committed
6478cbe
fix: escape user input in notification content templates

feanil
authored and
kaustavb12
committed
3a26b58
fix: replace string-prefix check in safe_extractall with commonpath

authored and
kaustavb12
committed
37a3d5d
chore: fix lint issue
kaustavb12
committed
7cb3d10

Commits on Aug 4, 2026

fix: fix offline tests
viadanna
committed
75fbc71
fix: fix lint issue
viadanna
committed
542111d