Incident Management security fixes

.tx/config

@@ -66,3 +66,15 @@ file_filter = conf/locale/<lang>/LC_MESSAGES/edx_proctoring_proctortrack.po
 source_file = conf/locale/en/LC_MESSAGES/edx_proctoring_proctortrack.po
 source_lang = en
 type = PO
+
+[open-edx-releases.release-koa]
+file_filter = conf/locale/<lang>/LC_MESSAGES/django.po
+source_file = conf/locale/en/LC_MESSAGES/django.po
+source_lang = en
+type = PO
+
+[open-edx-releases.release-koa-js]
+file_filter = conf/locale/<lang>/LC_MESSAGES/djangojs.po
+source_file = conf/locale/en/LC_MESSAGES/djangojs.po
+source_lang = en
+type = PO

cms/envs/common.py

@@ -658,7 +658,7 @@
 
     # A newer and safer request cache.
     'edx_django_utils.cache.middleware.RequestCacheMiddleware',
-    'edx_django_utils.monitoring.middleware.MonitoringMemoryMiddleware',
+    'edx_django_utils.monitoring.MonitoringMemoryMiddleware',
 
     # Cookie monitoring
     'openedx.core.lib.request_utils.CookieMonitoringMiddleware',

cms/templates/widgets/footer.html

@@ -15,28 +15,28 @@
 
     <div class="footer-content-primary">
       <div class="colophon">
-        <p>&copy; ${datetime.now(pytz.timezone(settings.TIME_ZONE)).year} <a data-rel="edx.org" href="${marketing_link('ROOT')}" rel="external">${settings.PLATFORM_NAME}</a>.</p>
+        <p>&copy; ${datetime.now(pytz.timezone(settings.TIME_ZONE)).year} <a href="${marketing_link('ROOT')}" rel="external">${settings.PLATFORM_NAME}</a>.</p>
       </div>
 
         <nav class="nav-peripheral" aria-label="${_("Policies")}">
           <ol>
             % if is_marketing_link_set('TOS'):
               <li class="nav-item nav-peripheral-tos">
-                <a data-rel="edx.org" href="${marketing_link('TOS')}">${_("Terms of Service")}</a>
+                <a href="${marketing_link('TOS')}">${_("Terms of Service")}</a>
               </li>
             % endif
             % if is_marketing_link_set('PRIVACY'):
               <li class="nav-item nav-peripheral-pp">
-                <a data-rel="edx.org" href="${marketing_link('PRIVACY')}">${_("Privacy Policy")}</a>
+                <a href="${marketing_link('PRIVACY')}">${_("Privacy Policy")}</a>
               </li>
             % endif
             % if waffle().is_enabled(ENABLE_ACCESSIBILITY_POLICY_PAGE):
               <li class="nav-item nav-peripheral-aar">
-                <a data-rel="edx.org" href="${reverse('accessibility')}">${_("Accessibility Accommodation Request")}</a>
+                <a href="${reverse('accessibility')}">${_("Accessibility Accommodation Request")}</a>
               </li>
             %endif
             <li class="nav-item">
-              <a data-rel="edx.org" id="lms-link" href="${settings.LMS_ROOT_URL}">${_("LMS")}</a>
+              <a id="lms-link" href="${settings.LMS_ROOT_URL}">${_("LMS")}</a>
             </li>
           </ol>
         </nav>
@@ -48,7 +48,7 @@
         <p>
           ## Translators: 'edX' and 'Open edX' are trademarks of 'edX Inc.'. Please do not translate any of these trademarks and company names.
           ${Text(_("edX, Open edX, and the edX and Open edX logos are registered trademarks of {link_start}edX Inc.{link_end}")).format(
-            link_start=HTML(u"<a data-rel='edx.org' href='https://www.edx.org/'>"),
+            link_start=HTML(u"<a href='https://www.edx.org/'>"),
             link_end=HTML(u"</a>")
           )}
         </p>

common/djangoapps/static_replace/__init__.py

@@ -23,8 +23,7 @@ def _url_replace_regex(prefix):
     To anyone contemplating making this more complicated:
     http://xkcd.com/1171/
     """
-    return u"""
-        (?x)                      # flags=re.VERBOSE
+    return """(?x)                # flags=re.VERBOSE
         (?P<quote>\\\\?['"])      # the opening quotes
         (?P<prefix>{prefix})      # the prefix
         (?P<rest>.*?)             # everything else in the url

common/lib/xmodule/xmodule/modulestore/tests/django_utils.py

@@ -12,6 +12,7 @@
 
 from django.conf import settings
 from django.contrib.auth.models import AnonymousUser, User
+from django.db import connections
 from django.test import TestCase
 from django.test.utils import override_settings
 from mock import patch
@@ -397,7 +398,7 @@ def setUp(self):
     for Django ORM models that will get cleaned up properly.
     """
     # Tell Django to clean out all databases, not just default
-    multi_db = True
+    databases = {alias for alias in connections}
 
     @classmethod
     @contextmanager
@@ -486,7 +487,7 @@ class FooTest(ModuleStoreTestCase):
     CREATE_USER = True
 
     # Tell Django to clean out all databases, not just default
-    multi_db = True
+    databases = {alias for alias in connections}
 
     @classmethod
     def setUpClass(cls):

common/lib/xmodule/xmodule/video_module/transcripts_utils.py

@@ -5,6 +5,7 @@
 
 
 import copy
+import html
 import logging
 import os
 from functools import wraps
@@ -19,7 +20,6 @@
 from pysrt.srtexc import Error
 from six import text_type
 from six.moves import range, zip
-from six.moves.html_parser import HTMLParser
 
 from openedx.core.djangolib import blockstore_cache
 from openedx.core.lib import blockstore_api
@@ -660,7 +660,7 @@ def convert(content, input_format, output_format):
 
             if output_format == 'txt':
                 text = SubRipFile.from_string(content.decode('utf-8')).text
-                return HTMLParser().unescape(text)
+                return html.unescape(text)
 
             elif output_format == 'sjson':
                 try:
@@ -679,7 +679,7 @@ def convert(content, input_format, output_format):
             if output_format == 'txt':
                 text = json.loads(content)['text']
                 text_without_none = [line if line else '' for line in text]
-                return HTMLParser().unescape("\n".join(text_without_none))
+                return html.unescape("\n".join(text_without_none))
 
             elif output_format == 'srt':
                 return generate_srt_from_sjson(json.loads(content), speed=1.0)

import_shims/generate_shims.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 #
+# Context: docs/decisions/0007-sys-path-modification-removal.rst
+#
 # Usage:
 #
 #      ~/edx-platform> import_shims/generate_shims.sh SOURCE DESTINATION
@@ -34,12 +36,12 @@ for path in $(find "${SOURCE}/" -name '*.py' | grep -v migrations); do
         continue
     fi
     if [[ "$path" == "lms/djangoapps/courseware/management/commands/import.py" ]]; then
-        # Skip this file because its name is problematic for the sys path hack.
+        # Skip this file because its name is problematic for import shim.
         # We've gone to prod with this excluded, and it hasn't been a problem.
         continue
     fi
     if [[ "$path" == "cms/djangoapps/contentstore/management/commands/import.py" ]]; then
-        # Also skip this file because its name is problematic for the sys path hack.
+        # Also skip this file because its name is problematic for the import shim.
         continue
     fi
     new_path=$(echo "$path" | sed "s#${SOURCE}/#${DESTINATION}/#")
@@ -48,6 +50,9 @@ for path in $(find "${SOURCE}/" -name '*.py' | grep -v migrations); do
     echo "Writing ${new_path}"
     mkdir -p "$(dirname "$new_path")"
     {
+        echo '"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""'
+        echo "# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long"
+        echo
         echo "from import_shims.warn import warn_deprecated_import"
         echo
         echo "warn_deprecated_import('${old_python_path}', '${new_python_path}')"

import_shims/lms/badges/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges', 'lms.djangoapps.badges')

import_shims/lms/badges/admin.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.admin', 'lms.djangoapps.badges.admin')

import_shims/lms/badges/api/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.api', 'lms.djangoapps.badges.api')

import_shims/lms/badges/api/serializers.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.api.serializers', 'lms.djangoapps.badges.api.serializers')

import_shims/lms/badges/api/tests.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.api.tests', 'lms.djangoapps.badges.api.tests')

import_shims/lms/badges/api/urls.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.api.urls', 'lms.djangoapps.badges.api.urls')

import_shims/lms/badges/api/views.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.api.views', 'lms.djangoapps.badges.api.views')

import_shims/lms/badges/apps.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.apps', 'lms.djangoapps.badges.apps')

import_shims/lms/badges/backends/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.backends', 'lms.djangoapps.badges.backends')

import_shims/lms/badges/backends/badgr.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.backends.badgr', 'lms.djangoapps.badges.backends.badgr')

import_shims/lms/badges/backends/base.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.backends.base', 'lms.djangoapps.badges.backends.base')

import_shims/lms/badges/backends/tests/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.backends.tests', 'lms.djangoapps.badges.backends.tests')

import_shims/lms/badges/backends/tests/dummy_backend.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.backends.tests.dummy_backend', 'lms.djangoapps.badges.backends.tests.dummy_backend')

import_shims/lms/badges/backends/tests/test_badgr_backend.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.backends.tests.test_badgr_backend', 'lms.djangoapps.badges.backends.tests.test_badgr_backend')

import_shims/lms/badges/events/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.events', 'lms.djangoapps.badges.events')

import_shims/lms/badges/events/course_complete.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.events.course_complete', 'lms.djangoapps.badges.events.course_complete')

import_shims/lms/badges/events/course_meta.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.events.course_meta', 'lms.djangoapps.badges.events.course_meta')

import_shims/lms/badges/events/tests/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.events.tests', 'lms.djangoapps.badges.events.tests')

import_shims/lms/badges/events/tests/test_course_complete.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.events.tests.test_course_complete', 'lms.djangoapps.badges.events.tests.test_course_complete')

import_shims/lms/badges/events/tests/test_course_meta.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.events.tests.test_course_meta', 'lms.djangoapps.badges.events.tests.test_course_meta')

import_shims/lms/badges/handlers.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.handlers', 'lms.djangoapps.badges.handlers')

import_shims/lms/badges/models.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.models', 'lms.djangoapps.badges.models')

import_shims/lms/badges/service.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.service', 'lms.djangoapps.badges.service')

import_shims/lms/badges/tests/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.tests', 'lms.djangoapps.badges.tests')

import_shims/lms/badges/tests/factories.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.tests.factories', 'lms.djangoapps.badges.tests.factories')

import_shims/lms/badges/tests/test_models.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.tests.test_models', 'lms.djangoapps.badges.tests.test_models')

import_shims/lms/badges/utils.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('badges.utils', 'lms.djangoapps.badges.utils')

import_shims/lms/branding/__init__.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('branding', 'lms.djangoapps.branding')

import_shims/lms/branding/admin.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('branding.admin', 'lms.djangoapps.branding.admin')

import_shims/lms/branding/api.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('branding.api', 'lms.djangoapps.branding.api')

import_shims/lms/branding/api_urls.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('branding.api_urls', 'lms.djangoapps.branding.api_urls')

import_shims/lms/branding/models.py

@@ -1,3 +1,6 @@
+"""Deprecated import support. Auto-generated by import_shims/generate_shims.sh."""
+# pylint: disable=redefined-builtin,wrong-import-position,wildcard-import,useless-suppression,line-too-long
+
 from import_shims.warn import warn_deprecated_import
 
 warn_deprecated_import('branding.models', 'lms.djangoapps.branding.models')