security: fix JWT scopes in XBlock callbacks

See: GHSA-qx8m-mqx3-j9fm openedx/edx-platform#34047
kdmccormick · Feb 8, 2024 · 44f52f8 · 44f52f8
1 parent 02ee7ff
commit 44f52f8
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/changelog.d/20240122_093036_regis_jwt_security.md b/changelog.d/20240122_093036_regis_jwt_security.md
@@ -0,0 +1 @@
+- [Security] Fix JWT scopes in XBlock callbacks. (by @regisb)
diff --git a/tutor/templates/build/openedx/Dockerfile b/tutor/templates/build/openedx/Dockerfile
@@ -81,6 +81,8 @@ RUN git config --global user.email "tutor@overhang.io" \
 {{ patch("openedx-dockerfile-git-patches-default") }}
 {%- else %}
 # Patch edx-platform
+# XBlock JWT security fix https://github.com/openedx/edx-platform/pull/34047
+RUN curl -fsSL https://github.com/openedx/edx-platform/commit/89f5f69682a5e1422f89e867491e8974dd0a8208.patch | git am
 {%- endif %}
 
 {# Example: RUN curl -fsSL https://github.com/openedx/edx-platform/commit/<GITSHA1>.patch | git am #}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- [Security] Fix JWT scopes in XBlock callbacks. (by @regisb)