Fix/CVE 2025 61594 uri credential leakage - #99

Open

224599437 wants to merge 224 commits into

thoth-tech:10.0.xfrom

224599437:fix/cve-2025-61594-uri-credential-leakage

Commits on Mar 23, 2026

chore: reset submission date when deleting portfolio
b0ink
committed
1f6b326
chore: show portfolio submission date in grades csv
b0ink
committed
c997ab0

Commits on Mar 24, 2026

Merge pull request #593 from b0ink/refactor/portfolio-dates
b0ink
authored
f23b5dc
test: attempt fix for flaky test
b0ink
committed
5f49f46
fix: normalise test to ensure its consistent (#594)
b0ink
authored
a607486
Merge pull request #595 from b0ink/fix/status-test-fix
b0ink
authored
1717b16
Merge pull request #592 from b0ink/refactor/confirm-recursive-fix
b0ink
authored
e5f128d
chore(release): 10.0.0-95
b0ink
committed
18b6ea7
test: skip pdf gen to improve test speeds (#596)
b0ink
authored
7d36efc

Commits on Mar 25, 2026

feat: allow admin users to view any unit analytics (#597)
b0ink
authored
eb2195a

Commits on Mar 26, 2026

feat: pause days awaiting feedback during breaks (#599)
b0ink
authored
0aa2208
chore(release): 10.0.0-96
b0ink
committed
73203a2

Commits on Mar 27, 2026

Commits on Mar 29, 2026

feat: add enforce feedback unit setting
b0ink
committed
4d1c6ee

Commits on Mar 31, 2026

Commits on Apr 1, 2026

Merge pull request #605 from b0ink/feat/dont-override-aip-overseer
b0ink
authored
8ee540d

Commits on Apr 13, 2026

Commits on Apr 15, 2026

Merge pull request #602 from b0ink/refactor/tutor-discussion-workflow
b0ink
authored
4765b53
chore(release): 10.0.0-100
b0ink
committed
c0d6615

Commits on Apr 16, 2026

feat: query pinned tasks in task explorer
b0ink
committed
7a10685

Commits on Apr 18, 2026

Merge pull request #610 from b0ink/refactor/task-explorer-pins
b0ink
authored
0d7643c
feat: batch upload feedback csv (#609)
b0ink
authored
5baa171
chore(release): 10.0.0-101
b0ink
committed
d5127ea
refactor: ensure single pdf submission to use as final pdf
b0ink
committed
479bb66
chore(release): 10.0.0-102
b0ink
committed
b266498
chore: fix rubocop
b0ink
committed
90945ca
chore: fix rubocop
b0ink
committed
76afc3c
refactor: move batch tasks upload to sidekiq job
b0ink
committed
9960e31
chore(release): 10.0.0-103
b0ink
committed
e3af000

Commits on Apr 22, 2026

chore: rename outdated package
b0ink
committed
51f20a7

Commits on Apr 23, 2026

Commits on Apr 27, 2026

refactor: allow either student id or username for batch pdf upload
b0ink
committed
78d4f11
chore(release): 10.0.0-105
b0ink
committed
34d258e

Commits on Apr 28, 2026

feat: enable comment editing (#613)
b0ink
authored
4096f87
chore(release): 10.0.0-106
b0ink
committed
9dc7436

Commits on May 5, 2026

refactor: check for feedback on task status change server side (#616)
b0ink
authored
f883c37
chore(release): 10.0.0-107
b0ink
committed
b2e4e64

Commits on May 7, 2026

fix: mitigate URI credential leakage in relative URI merges
224599437
committed
60082f0

Commits on May 13, 2026

Commits on Jun 3, 2026

refactor: enable configuration of max shown comparisons in jplag report (#625)
b0ink
authored
7ea3d40
chore(release): 10.0.0-110
b0ink
committed
7a09ae5
feat: support zip file submissions (#624)
b0ink
authored
d5d8742
chore: update version
b0ink
committed
be3e59e
chore(release): 10.0.0
b0ink
committed
53223c7
chore(release): 11.0.0-1
b0ink
committed
ef5727b

Commits on Jun 4, 2026

feat: clear submission in process with no active sidekiq job (#626)
b0ink
authored
bb453ce
chore(release): 11.0.0-2
b0ink
committed
f592202
chore: update task pdf failed subject line
b0ink
committed
a85024c
fix: allow error log emails with no backtrace
b0ink
committed
f5b383f
chore: capture sentry alert instead of error
b0ink
committed
6e2b1e2
chore: raise sentry alerts where error log mailer is used
b0ink
committed
7fda505
refactor: improve failed pdfgen sentry error
b0ink
committed
e2afc12
chore: improve stale in process submission sentry error
b0ink
committed
7f469a6
chore: capture additional error on failed accept submission job
b0ink
committed
d139b7b
chore(release): 11.0.0-3
b0ink
committed
14c3d45
fix: ensure we check for queued jobs
b0ink
committed
3790c9f
feat: suspend any stale overseer assessments
b0ink
committed
678f386
chore(release): 11.0.0-4
b0ink
committed
c206553
fix: correctly get task
b0ink
committed
1949b42
feat: notify students when overseer tests fail (#627)
b0ink
authored
4280df3
chore(release): 11.0.0-5
b0ink
committed
b07d4f5
chore: ensure test submissions dont receive overseer notification
b0ink
committed
c359c0e
chore: set executable permissions
b0ink
committed
f46a6ec
chore(release): 11.0.0-6
b0ink
committed
3dfffd9
chore: remove files
b0ink
committed
8a1c6e6
refator: align wording closer to the automated comment
b0ink
committed
b33556b

Commits on Jun 5, 2026

Commits on Jun 6, 2026

fix: handle incomplete notebook metadata and markdown lists in pdfs
b0ink
committed
a01e4d7

Commits on Jun 8, 2026

fix: normalize notebook source lines
b0ink
committed
b950e55
Merge pull request #629 from b0ink/fix/jupyter-notebook-support
b0ink
authored
163ff5e
chore(release): 11.0.0-7
b0ink
committed
280f3a0

Commits on Jun 9, 2026

chore: include task definition abbreviation in portfolio overall task status
b0ink
committed
4a7141f
feat: communications system (#617)
b0ink
authored
9724909
chore(release): 11.0.0-8
b0ink
committed
a417f0e

Commits on Jun 10, 2026

fix: ensure more reliable test
b0ink
committed
93599d2
refactor: improve latex work directory naming (#632)
b0ink
authored
8ff358a
refactor: reset portfolio compilation after completion (#630)
b0ink
authored
0bedbfc

Commits on Jun 11, 2026

feat: expose route to fetch tasks waiting for pdf gen
b0ink
committed
5d3407e
test: cover portfolio task pdf processing state
b0ink
committed
5a5dea7
Merge pull request #635 from b0ink/feat/tasks-still-processing
b0ink
authored
568fee4
feat: overflow task claim logs (#614)
b0ink
authored
065180f
chore(release): 11.0.0-9
b0ink
committed
eb5d872
feat: add column for days awaiting feedback including breaks
b0ink
committed
f7b877c
chore: refresh feedback in active units only
b0ink
committed
90cf453

Commits on Jun 17, 2026

chore: enforce utf8mb4 encoding in development
b0ink
committed
ba7ca98
chore: enforce utf8mb4 encoding in tests
b0ink
committed
433e60d
test: ensure native uft8 emojis can be added
b0ink
committed
b0bf4d3
feat: submission history (#636)
b0ink
authored
4f95d61
chore(release): 11.0.0-10
b0ink
committed
91d0b19
fix: serve public web cal as raw text
b0ink
committed
6836a20
refactor: ensure webcal uses students local start/target dates
b0ink
committed
c782911
Merge pull request #639 from b0ink/fix/calendar
b0ink
authored
0b206c1

Commits on Jun 18, 2026

feat: engagement passport (#631)
b0ink
authored
d32145e
refactor: make access and refresh token expiry configurable (#637)
b0ink
authored
c16f755
chore(release): 11.0.0-11
b0ink
committed
ea1bd13

Commits on Jun 24, 2026

chore: ignore commit in git blame
b0ink
committed
dabd06d
feat: customisable grades (#638)
b0ink
authored
57cb9e2
chore(release): 11.0.0-12
b0ink
committed
9c3f8b1
fix: avoid json default
b0ink
committed
3a0c879
fix: allow nullable grade values
b0ink
committed
8b586f9
chore(release): 11.0.0-13
b0ink
committed
5c3c0dc
fix: avoid serialisation
b0ink
committed
1a47564
fix: check grade value is valid json
b0ink
committed
ea7c5db
chore(release): 11.0.0-14
b0ink
committed
b6648a3
fix: check grade value is valid json
b0ink
committed
3dd6106
chore(release): 11.0.0-15
b0ink
committed
9fff328

Commits on Jun 25, 2026

feat: add sentry tunnel support
b0ink
committed
3eecd2f
chore(release): 11.0.0-16
b0ink
committed
5edfe6c
refactor: move sentry tunnel to controller
b0ink
committed
3329076
chore(release): 11.0.0-17
b0ink
committed
1834b41
fix: rename tunnel route to avoid ad blockers
b0ink
committed
baf4f69
chore(release): 11.0.0-18
b0ink
committed
81d7b27
refactor: support session replay data
b0ink
committed
f461d2d
chore(release): 11.0.0-19
b0ink
committed
113e9e4
fix: ensure overseer image is pulled before running test
b0ink
committed
0e0ce34
refactor: revert change to preserve overdue statuses on failure
b0ink
committed
91402b0
feat: capture daily snapshots of aggregated task completion data (#607)

audreypho
and
b0ink
authored
86b2040
fix: relocate submission history on unit code change
b0ink
committed
d9085b5
refactor: move jplag report dir under student work and remove config
b0ink
committed
4ff4ff3
chore: relocate units jplag report dir on unit code change
b0ink
committed
b495dc1
chore: minify test task names
b0ink
committed
14c4240
chore(release): 11.0.0-20
b0ink
committed
791f06d
Merge pull request #641 from b0ink/refactor/test-abbrv
b0ink
authored
06edb26

Commits on Jun 26, 2026

ci: remove jplag report dir env var
b0ink
committed
40cefee
fix: support mysql 8 reserved keyword in task completion stats query
b0ink
committed
87fe813
chore(release): 11.0.0-21
b0ink
committed
5981dfb
Merge pull request #640 from b0ink/refactor/jplag-report-dir
b0ink
authored
f8041e7
chore(release): 11.0.0-22
b0ink
committed
7cc533f
fix: ensure jplag scan continues on failed report
b0ink
committed
3215c08
chore(release): 11.0.0-23
b0ink
committed
85e36f9
fix: ensure non text comments cant be deleted
b0ink
committed
964e957

Commits on Jun 29, 2026

chore(release): 11.0.0-24
b0ink
committed
4404d96
fix: ensure pii is not submitted to sentry
b0ink
committed
d98d318
chore(release): 11.0.0-25
b0ink
committed
2ab0bb7
fix: improve error when adding prerequisite to non existing task def
b0ink
committed
f217c61
fix: avoid skipping task names containing 'name' during import
b0ink
committed
4c2e194
test: ensure tasks containing name dont get skipped
b0ink
committed
ae1b620
chore(release): 11.0.0-26
b0ink
committed
924bb36
fix: prevent convenors with observer only perms to be made main convenor
b0ink
committed
19a459c

Commits on Jun 30, 2026

test: reload model
b0ink
committed
a49698c

Commits on Jul 1, 2026

chore(release): 11.0.0-27
b0ink
committed
262a5c6
fix: only allow convenors to pull overflow stats
b0ink
committed
d5ca748
chore(release): 11.0.0-28
b0ink
committed
5b4bc71

Commits on Jul 2, 2026

fix: allow students to get submission history timestamps
b0ink
committed
a4bb79a
chore(release): 11.0.0-29
b0ink
committed
0ea20bc

Commits on Jul 3, 2026

Commits on Jul 4, 2026

fix: ensure admins can manage communications
b0ink
committed
25bcafc
chore(release): 11.0.0-30
b0ink
committed
8d2cd59

Commits on Jul 6, 2026

Merge pull request #644 from b0ink/fix/pdf-page-count
b0ink
authored
c6f1592

Commits on Jul 8, 2026

chore(release): 11.0.0-31
b0ink
committed
0eb873e

Commits on Jul 9, 2026

feat: add rediscuss status
b0ink
committed
05a44fa

Commits on Jul 13, 2026

chore: add coverpage css
b0ink
committed
1732604
Merge pull request #645 from b0ink/feat/rediscuss-status
b0ink
authored
dc76a5a

Commits on Jul 15, 2026

docs: update development and deployment documentation
b0ink
committed
6196b11
docs: restore env var config
b0ink
committed
444b0f7
chore: extend observer only permissions
b0ink
committed
b3ef36a

Commits on Jul 16, 2026

Commits on Jul 19, 2026

feat: content management system (#642)
b0ink
authored
a87b250
chore(release): 11.0.0-33
b0ink
committed
184e01a

Commits on Jul 20, 2026

fix: pass saml settings correctly to logout response
b0ink
committed
4f60eff

Commits on Jul 22, 2026

feat: track last access to site and unit
b0ink
committed
2141fd6
feat: add last sign in and last unit access communication conditions
b0ink
committed
50fc821
Merge pull request #649 from b0ink/feat/last-access-tracking
b0ink
authored
8973496

Commits on Jul 23, 2026

fix: prevent deleting task definitions used as prerequisites
b0ink
committed
f26c9c5

Commits on Jul 24, 2026

fix: allow unit deletion with task prerequisites
b0ink
committed
2b3752a
fix: iterate sentry exception interface values correctly
b0ink
committed
4818049
Merge pull request #652 from b0ink/fix/block-task-deletion-prerequisites
b0ink
authored
d512955
Merge pull request #654 from b0ink/fix/sentry-reporting
b0ink
authored
9630a3e
feat: discuss timeout (#646)
b0ink
authored
f6dfd80
refactor: serve only the content files that are being requested (#655)
b0ink
authored
86753d5
chore(release): 11.0.0-34
b0ink
committed
a535d40
fix: enable youtube embeds
b0ink
committed
a8da36c
chore(release): 11.0.0-35
b0ink
committed
8d8b17c
fix: normalize upload requirement file keys on save (#653)
b0ink
authored
bf457a1
feat: communication condition to check if student has portfolio (#651)
b0ink
authored
90d362e
chore(release): 11.0.0-36
b0ink
committed
328b358
fix: pass saml settings correctly to logout response (#648)
b0ink
authored
8df3ea9
feat: automated engagement stamps (#650)
b0ink
authored
59641bd
chore(release): 11.0.0-37
b0ink
committed
c91418e

Commits on Jul 27, 2026

Commits on Jul 28, 2026

refactor: improve overseer step error handling
b0ink
committed
1f83995
chore(release): 11.0.0-38
b0ink
committed
60a039a
fix: only record discussion after successful transition
b0ink
committed
c8bd418
chore(release): 11.0.0-39
b0ink
committed
fd2f926

Commits on Jul 30, 2026

feat: enable unit content download
b0ink
committed
1757731
chore(release): 11.0.0-40
b0ink
committed
a321cc1
Merge pull request #662 from b0ink/fix/administrator-access
b0ink
authored
57f0bfa
chore(release): 11.0.0-41
b0ink
committed
cf974a4

Commits on Jul 31, 2026

fix: ensure screenshots embedded in markdown compiles correctly
b0ink
committed
9b624d6
Merge pull request #663 from b0ink/fix/markdown-images
b0ink
authored
ba90b58
chore(release): 11.0.0-42
b0ink
committed
277506d

Commits on Aug 3, 2026

feat: group engagement (#658)
b0ink
authored
6f02a33
chore(release): 11.0.0-43
b0ink
committed
a60fdb6
fix: ensure correct context is found for learning chips import
b0ink
committed
76f3ff1
feat: bulk upload staff notes
b0ink
committed
6c3b3e0
feat: bulk upload staff notes (#665)
b0ink
authored
3e0f32d

Commits on Aug 8, 2026

chore(release): 11.0.0-44
b0ink
committed
dd833a4

Commits on Aug 10, 2026

Merge pull request #664 from b0ink/fix/feedback-chip-import
b0ink
authored
5db6234

Commits on Aug 11, 2026

Merge branch '11.0.x' into fix/cve-2025-61594-uri-credential-leakage
b0ink
authored
70f8f73
chore: fix rubocop
b0ink
authored
70faf42