Skip to content

Commit

Permalink
Allow teachers to add any normal links to the course menu
Browse files Browse the repository at this point in the history
Normal links do not transmit personal data (like LTI launch does),
so we need a balance between user experience and overzealous
security and data privacy.

Fixes #563
  • Loading branch information
ihalaij1 committed Feb 1, 2024
1 parent 700d596 commit 0ef09c8
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 19 deletions.
5 changes: 2 additions & 3 deletions external_services/models.py
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,7 @@


def validate_no_domain(value):
if value and '://' in value:
raise ValidationError(_('URL_CANNOT_CONTAIN_SCHEME_OR_DOMAIN'))
pass


class LinkService(ModelWithInheritance):
Expand Down Expand Up @@ -250,7 +249,7 @@ class MenuItem(UrlMixin, models.Model):
max_length=256,
blank=True,
null=True,
help_text=_('MENU_ITEM_MENU_URL_HELPTEXT'""),
help_text=_('MENU_ITEM_MENU_URL_HELPTEXT'),
validators=[validate_no_domain],
)
menu_group_label = models.CharField(
Expand Down
16 changes: 6 additions & 10 deletions locale/en/LC_MESSAGES/django.po
Original file line number Diff line number Diff line change
Expand Up @@ -4791,10 +4791,6 @@ msgstr "This is a draft. Remember to submit your answer for grading!"
msgid "LTI_SERVICE_COURSE_ENROLLMENT_REQUIRED_FOR_ACCESS"
msgstr "Course enrolment required for accessing the LTI service."

#: external_services/models.py
msgid "URL_CANNOT_CONTAIN_SCHEME_OR_DOMAIN"
msgstr "The URL cannot contain scheme or domain part."

#: external_services/models.py
msgid "DESTINATION_INTERNAL_PRIVACY_NOTICE"
msgstr "The destination is hosted internally. Link to internal privacy notice."
Expand Down Expand Up @@ -4978,13 +4974,13 @@ msgstr "URL"
#: external_services/models.py
msgid "MENU_ITEM_MENU_URL_HELPTEXT"
msgstr ""
"An URL that is a) relative to the service URL or b) this course if no "
"service is selected.<br>\n"
"Case a: An URL starting with '/' overwrites path in service URL and extends "
"A URL that is a) relative to the service URL or b) this course if no service "
"is selected or c) a link to some external website.<br>\n"
"Case a: A URL starting with '/' overwrites path in service URL and extends "
"it otherwise.<br>\n"
"Case b: An URL starting with '/' is absolute within this service and "
"relative to the course path otherwise.<br>\n"
"Note that URL entered here can not include scheme or domain."
"Case b: A URL starting with '/' is absolute within this service and relative "
"to the course path otherwise.<br>\n"
"Case c: A link, for example https://google.com"

#: external_services/models.py
msgid "LABEL_MENU_GROUP_LABEL"
Expand Down
8 changes: 2 additions & 6 deletions locale/fi/LC_MESSAGES/django.po
Original file line number Diff line number Diff line change
Expand Up @@ -4805,10 +4805,6 @@ msgstr "Tämä on luonnos. Muista lähettää vastauksesi arvosteltavaksi!"
msgid "LTI_SERVICE_COURSE_ENROLLMENT_REQUIRED_FOR_ACCESS"
msgstr "Kurssille ilmoittautuminen vaaditaan LTI-palveluun pääsemiseksi."

#: external_services/models.py
msgid "URL_CANNOT_CONTAIN_SCHEME_OR_DOMAIN"
msgstr "Url ei voi sisältää skeema- tai verkkotunnusosaa."

#: external_services/models.py
msgid "DESTINATION_INTERNAL_PRIVACY_NOTICE"
msgstr ""
Expand Down Expand Up @@ -4998,12 +4994,12 @@ msgstr "URL"
msgid "MENU_ITEM_MENU_URL_HELPTEXT"
msgstr ""
"URL joka on a) suhteellinen palvelun URL:ään tai b) tähän kurssiin, mikäli "
"palvelua ei ole valittu.<br>\n"
"palvelua ei ole valittu tai c) linkki ulkoiselle sivustolle.<br>\n"
"Tilanne a: URL, joka alkaa /-merkillä ylikirjoittaa palvelun koko polun, "
"muutoin jatkaa sitä.<br>\n"
"Tilanne b: URL, joka alkaa /-merkillä on absoluuttinen tämän palvelun "
"suhteen, muutoin on suhteellinen kurssin polkuun.<br>\n"
"Huomaa ettei tämä URL voi sisältää skeemaa tai verkkotunnusta."
"Tilanne c: Linkki, esimerkiksi https://google.com"

#: external_services/models.py
msgid "LABEL_MENU_GROUP_LABEL"
Expand Down

0 comments on commit 0ef09c8

Please sign in to comment.