Skip to content

Invalid display courseware through the LTI iframe in IE 10+ #11607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
douglashall merged 1 commit into from
Mar 4, 2016
Merged

Invalid display courseware through the LTI iframe in IE 10+ #11607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions cms/envs/common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,6 +358,9 @@
# Clickjacking protection can be enabled by setting this to 'DENY'
X_FRAME_OPTIONS = 'ALLOW'

# Platform for Privacy Preferences header
P3P_HEADER = 'CP="Open EdX does not have a P3P policy."'

@robrap robrap Mar 3, 2016

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@douglashall I think we should tag someone (who?) on legal based on the following blog article.
https://blogs.msdn.microsoft.com/ie/2012/02/20/google-bypassing-user-privacy-settings/

Thoughts?

Other than that, it looks fine.

@douglashall douglashall Mar 3, 2016

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW that article was written in 2012 and I think things have evolved since then. From the research I have done, P3P seems to be a dead standard that no one except for IE implements. @smagoun Is there someone in legal who can/should look at this?

@robrap robrap Mar 3, 2016

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@douglashall I did a quick search/read on my commute. If what you say is true, I'd say we shouldn't waste much time on this and I would give it a 👍 . What do you think?


############# XBlock Configuration ##########

# Import after sys.path fixup
Expand Down
19 changes: 19 additions & 0 deletions common/djangoapps/util/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,3 +374,22 @@ def accepts(request, media_type):
"""Return whether this request has an Accept header that matches type"""
accept = parse_accept_header(request.META.get("HTTP_ACCEPT", ""))
return media_type in [t for (t, p, q) in accept]


def add_p3p_header(view_func):
"""
This decorator should only be used with views which may be displayed through the iframe.
It adds additional headers to response and therefore gives IE browsers an ability to save cookies inside the iframe
Details:
http://blogs.msdn.com/b/ieinternals/archive/2013/09/17/simple-introduction-to-p3p-cookie-blocking-frame.aspx
http://stackoverflow.com/questions/8048306/what-is-the-most-broad-p3p-header-that-will-work-with-ie
"""
@wraps(view_func)
def inner(request, *args, **kwargs):
"""
Helper function
"""
response = view_func(request, *args, **kwargs)
response['P3P'] = settings.P3P_HEADER
return response
return inner
2 changes: 2 additions & 0 deletions lms/djangoapps/lti_provider/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
from lms_xblock.runtime import unquote_slashes
from opaque_keys.edx.keys import CourseKey, UsageKey
from opaque_keys import InvalidKeyError
from util.views import add_p3p_header

log = logging.getLogger("edx.lti_provider")

Expand All @@ -32,6 +33,7 @@


@csrf_exempt
@add_p3p_header
def lti_launch(request, course_id, usage_id):
"""
Endpoint for all requests to embed edX content via the LTI protocol. This
Expand Down
3 changes: 3 additions & 0 deletions lms/envs/common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1151,6 +1151,9 @@
# Clickjacking protection can be enabled by setting this to 'DENY'
X_FRAME_OPTIONS = 'ALLOW'

# Platform for Privacy Preferences header
P3P_HEADER = 'CP="Open EdX does not have a P3P policy."'

############################### PIPELINE #######################################

PIPELINE_ENABLED = True
Expand Down