{"push_id":765117861,"size":1000,"distinct_size":0,"ref":"refs/heads/dev","head":"52227427df54874e77d7fbb2e6742aa702cf2959","before":"b2142822183167add2173e5dd6e95a795a4ee138","commits":[{"sha":"6f0fef831a441c4cf9651288be237ce0734adb9a","author":{"email":"088e16a1019277b15d58faf0541e11910eb756f6@instructure.com","name":"Simon Williams"},"message":"fix pagination in tinymce image embed widget\n\nthis is not a full fix, because the TreeView is assuming a certain type\nof containing element to set up it's pagination listener.  however,\nrestores functionality to how it was working before we genericized this\ncomponent.  a full fix is still needed.\n\nfixes CNVS-17617\n\ntest plan:\n- create a course with 11 folders in it\n- go to a page with a tinymce editor (like editing a wiki page)\n- click on the image embed\n- click on the canvas tab\n- scroll the list of folders\n- all 11 should be shown\n\nChange-Id: Ifbfe51df13ea45737a9ee4b592fda07d32697c7e\nReviewed-on: https://gerrit.instructure.com/46308\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nProduct-Review: Jeremy Stanley <jeremy@instructure.com>\nTested-by: Jenkins <jenkins@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Simon Williams <simon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/6f0fef831a441c4cf9651288be237ce0734adb9a"},{"sha":"c7e96508ee5f37394b94875b6dc1c9282cb3c562","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix content migration XSS vulnerability, closes #CNVS-17655\n\nprevent malicious LTI apps from XSSing users who use them to import course\ncontent\n\ntest plan:\n1. refer to repro steps on CNVS-17655\n\nChange-Id: Ib327432722b404f9f0ea4c3f15552eea309bc3eb\nReviewed-on: https://gerrit.instructure.com/46280\nTested-by: Jenkins <jenkins@instructure.com>\nProduct-Review: Bracken Mosbacker <bracken@instructure.com>\nReviewed-by: Bracken Mosbacker <bracken@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/c7e96508ee5f37394b94875b6dc1c9282cb3c562"},{"sha":"c746539ca29e14756b354afea9de7f5f09e4a399","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix account quota XSS vulnerability, fixes CNVS-17656\n\nprevent a malicious course title from XSSing an admin attempting to update\nthe course's storage quota from the accounts settings Quota tab\n\ntest plan:\n1. refer to repro steps on CNVS-17656\n\nChange-Id: I3b1dfc5675afc0a1889cb360101c6033cec1517e\nReviewed-on: https://gerrit.instructure.com/46281\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nProduct-Review: Jeremy Stanley <jeremy@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/c746539ca29e14756b354afea9de7f5f09e4a399"},{"sha":"feb864b35f8bb58b06240af459adb64d7431d694","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"prevent self-XSS when rating an app, fixes CNVS-17657\n\nlow severity, as you can only xss yourself\n\ntest plan: see CNVS-17657\n\nChange-Id: I4ab01fab4a6cec67da0bd83999eff9080dee005b\nReviewed-on: https://gerrit.instructure.com/46284\nProduct-Review: Bracken Mosbacker <bracken@instructure.com>\nReviewed-by: Bracken Mosbacker <bracken@instructure.com>\nTested-by: Jenkins <jenkins@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/feb864b35f8bb58b06240af459adb64d7431d694"},{"sha":"9dac1b43b3b40845c6cd64a337504e6794a6aa84","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix xss in some currently unused code\n\nthis UI is not currently accessible and is probably going away, but just\nin case...\n\nChange-Id: I6a1fb50696a66f6fd6855d7c7b37a3d4d859b377\nReviewed-on: https://gerrit.instructure.com/46291\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>\nQA-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/9dac1b43b3b40845c6cd64a337504e6794a6aa84"},{"sha":"e78d3929ab0a52ab96caa5d75bb2a5cdcfaa3fdd","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix media track/caption XSS vulnerability, fixes CNVS-17659\n\nensure locale and other fields are properly sanitized when building\n<track /> tags\n\ntest plan: see repro steps on CNVS-17659\n\nChange-Id: I8016d05ce12854166ed467f06a2769c5f1bfa979\nReviewed-on: https://gerrit.instructure.com/46288\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/e78d3929ab0a52ab96caa5d75bb2a5cdcfaa3fdd"},{"sha":"9fb25fc2b054dbb0a51eca46ba9f880f6c25fd01","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix potential xss vector in screenreader gradebook, fixes CNVS-17660\n\ni haven't been able to exploit this yet, but that doesn't mean it's not\npossible ;) ... make sure we sanitize the error messages we're putting\nin here\n\nChange-Id: I0a66696101834c6872d3b9c6e48a09c6525f6364\nReviewed-on: https://gerrit.instructure.com/46289\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/9fb25fc2b054dbb0a51eca46ba9f880f6c25fd01"},{"sha":"d6139353eec954b0104f7fc59509027c1e47b026","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix alerts XSS vulnerability, fixes CNVS-17661\n\nprevent XSS in the alerts UI by way of maliciously named account roles\n(or less likely, malicious translations)\n\ntest plan: infer from comment above, or see ticket\n\nChange-Id: Ia09a6535f238d2675bc9fb6d5aa93995ca4f2e5f\nReviewed-on: https://gerrit.instructure.com/46292\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/d6139353eec954b0104f7fc59509027c1e47b026"},{"sha":"ee4c7d2a94833f4e257df0aa781959aed51d8159","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"prevent xss in modules' \"Move To...\" dialog, fixes CNVS-17662\n\nensure we properly escape module and item names when presenting them as\noptions in the dialog\n\nalso ensure translations are escaped, and rename some variables to\nappease the linter\n\ntest plan: infer from the above, or see ticket for more info\n\nChange-Id: I8cc16bb9828db8653843b5bbd35dc49bac6d0c00\nReviewed-on: https://gerrit.instructure.com/46294\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/ee4c7d2a94833f4e257df0aa781959aed51d8159"},{"sha":"c140546736dc18442fa1b924a1351f4b82c9cbd6","author":{"email":"e53c8988cd428dde240324ce2797c8eb7073560f@instructure.com","name":"Matthew Berns"},"message":"resolves group discussion entries not appearing in gradebook and speedgrader\n\nfixes CNVS-17632\n\ntest plan:\n- create a graded group discussion\n- add an entry to the group discussion as a student that is part of that group\n- the gradebook should show a submission for that student\n- the student's entry should also appear in speedgrader\n\n- go back through test plan from gerrit.instructure.com/#/c/45461\n- ensure that test plan still passes\n\nChange-Id: Ib47a9c1299c8fa4083be19a61337dfc26060c36e\nReviewed-on: https://gerrit.instructure.com/46315\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nProduct-Review: Jeremy Stanley <jeremy@instructure.com>\nQA-Review: Derek Hansen <dhansen@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/c140546736dc18442fa1b924a1351f4b82c9cbd6"},{"sha":"d40372e44354c262cc227cda12dac386af3c9948","author":{"email":"b3f594e10a9edcf5413cf1190121d45078c62290@instructure.com","name":"Jeremy Stanley"},"message":"re-hide features when site admin turns them off\n\npreviously, this worked only in site admin context. this commit\nmakes it work in any context.\n\ntest plan:\n 1. as site admin user A, go to the Features tab of the\n    account settings for the Site Admin account and find a\n    feature with the 'hidden' tag, such as \"Google Docs\n    Domain Restriction\". toggle it on and off.\n 2. as a root account admin B with no site admin privileges,\n    confirm the feature is not visible on the Features tab\n    of the root account\n 3. as site admin user A, visit the root account's Features\n    tab and confirm the hidden feature is visible (with the\n    \"hidden\" tag). turn it on.\n 4. confirm that B sees the feature on the root account's\n    Features tab\n 5. as A, turn the feature back off in B's account settings\n    (not site admin settings)\n 6. confirm that, after a page reload, B can no longer see\n    the feature on the root account's Features tab\n\nfixes CNVS-16251\n\nChange-Id: I2e1bebe1e710471f2a0efeb8e744cabddee89df8\nReviewed-on: https://gerrit.instructure.com/45751\nTested-by: Jenkins <jenkins@instructure.com>\nQA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>\nReviewed-by: James Williams  <jamesw@instructure.com>\nProduct-Review: Matt Fairbourn <mfairbourn@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/d40372e44354c262cc227cda12dac386af3c9948"},{"sha":"927c0e495b250e2320052baa4e890e3cf3e2c730","author":{"email":"088e16a1019277b15d58faf0541e11910eb756f6@instructure.com","name":"Simon Williams"},"message":"fix pagination in tinymce image embed widget\n\nthis is not a full fix, because the TreeView is assuming a certain type\nof containing element to set up it's pagination listener.  however,\nrestores functionality to how it was working before we genericized this\ncomponent.  a full fix is still needed.\n\nfixes CNVS-17617\n\ntest plan:\n- create a course with 11 folders in it\n- go to a page with a tinymce editor (like editing a wiki page)\n- click on the image embed\n- click on the canvas tab\n- scroll the list of folders\n- all 11 should be shown\n\nChange-Id: Ifbfe51df13ea45737a9ee4b592fda07d32697c7e\nReviewed-on: https://gerrit.instructure.com/46308\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nProduct-Review: Jeremy Stanley <jeremy@instructure.com>\nTested-by: Jenkins <jenkins@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Simon Williams <simon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/927c0e495b250e2320052baa4e890e3cf3e2c730"},{"sha":"686f2b67123d3b7000652ad5154d7afefee78929","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix content migration XSS vulnerability, closes #CNVS-17655\n\nprevent malicious LTI apps from XSSing users who use them to import course\ncontent\n\ntest plan:\n1. refer to repro steps on CNVS-17655\n\nChange-Id: Ib327432722b404f9f0ea4c3f15552eea309bc3eb\nReviewed-on: https://gerrit.instructure.com/46280\nTested-by: Jenkins <jenkins@instructure.com>\nProduct-Review: Bracken Mosbacker <bracken@instructure.com>\nReviewed-by: Bracken Mosbacker <bracken@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/686f2b67123d3b7000652ad5154d7afefee78929"},{"sha":"a101e82e1925ae098d448c64e0cd2557875ab187","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix account quota XSS vulnerability, fixes CNVS-17656\n\nprevent a malicious course title from XSSing an admin attempting to update\nthe course's storage quota from the accounts settings Quota tab\n\ntest plan:\n1. refer to repro steps on CNVS-17656\n\nChange-Id: I3b1dfc5675afc0a1889cb360101c6033cec1517e\nReviewed-on: https://gerrit.instructure.com/46281\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nProduct-Review: Jeremy Stanley <jeremy@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/a101e82e1925ae098d448c64e0cd2557875ab187"},{"sha":"fe89fa9b266a50f8779ae37fbe23569ea9d26719","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"prevent self-XSS when rating an app, fixes CNVS-17657\n\nlow severity, as you can only xss yourself\n\ntest plan: see CNVS-17657\n\nChange-Id: I4ab01fab4a6cec67da0bd83999eff9080dee005b\nReviewed-on: https://gerrit.instructure.com/46284\nProduct-Review: Bracken Mosbacker <bracken@instructure.com>\nReviewed-by: Bracken Mosbacker <bracken@instructure.com>\nTested-by: Jenkins <jenkins@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/fe89fa9b266a50f8779ae37fbe23569ea9d26719"},{"sha":"0e61d114dd479012e44316499b511bebd390c2cd","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix xss in some currently unused code\n\nthis UI is not currently accessible and is probably going away, but just\nin case...\n\nChange-Id: I6a1fb50696a66f6fd6855d7c7b37a3d4d859b377\nReviewed-on: https://gerrit.instructure.com/46291\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>\nQA-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/0e61d114dd479012e44316499b511bebd390c2cd"},{"sha":"aab5447ce21de03e226bb6ca032fcf7e485ff0da","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix media track/caption XSS vulnerability, fixes CNVS-17659\n\nensure locale and other fields are properly sanitized when building\n<track /> tags\n\ntest plan: see repro steps on CNVS-17659\n\nChange-Id: I8016d05ce12854166ed467f06a2769c5f1bfa979\nReviewed-on: https://gerrit.instructure.com/46288\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/aab5447ce21de03e226bb6ca032fcf7e485ff0da"},{"sha":"36adba7448b50d90d947533093ab046e28a7bc55","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix potential xss vector in screenreader gradebook, fixes CNVS-17660\n\ni haven't been able to exploit this yet, but that doesn't mean it's not\npossible ;) ... make sure we sanitize the error messages we're putting\nin here\n\nChange-Id: I0a66696101834c6872d3b9c6e48a09c6525f6364\nReviewed-on: https://gerrit.instructure.com/46289\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/36adba7448b50d90d947533093ab046e28a7bc55"},{"sha":"ca93effe75113ec4c542d8575977a22e7c390e70","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"fix alerts XSS vulnerability, fixes CNVS-17661\n\nprevent XSS in the alerts UI by way of maliciously named account roles\n(or less likely, malicious translations)\n\ntest plan: infer from comment above, or see ticket\n\nChange-Id: Ia09a6535f238d2675bc9fb6d5aa93995ca4f2e5f\nReviewed-on: https://gerrit.instructure.com/46292\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Cody Cutrer <cody@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/ca93effe75113ec4c542d8575977a22e7c390e70"},{"sha":"e552343668d17f63e91612228493ec0d1c707257","author":{"email":"44f878afe53efc66b76772bd845eb65944ed8232@instructure.com","name":"Jon Jensen"},"message":"prevent xss in modules' \"Move To...\" dialog, fixes CNVS-17662\n\nensure we properly escape module and item names when presenting them as\noptions in the dialog\n\nalso ensure translations are escaped, and rename some variables to\nappease the linter\n\ntest plan: infer from the above, or see ticket for more info\n\nChange-Id: I8cc16bb9828db8653843b5bbd35dc49bac6d0c00\nReviewed-on: https://gerrit.instructure.com/46294\nTested-by: Jenkins <jenkins@instructure.com>\nReviewed-by: Jeremy Stanley <jeremy@instructure.com>\nQA-Review: Caleb Guanzon <cguanzon@instructure.com>\nProduct-Review: Jon Jensen <jon@instructure.com>","distinct":false,"url":"https://api.github.com/repos/berkleemusic/canvas-lms/commits/e552343668d17f63e91612228493ec0d1c707257"}]}