LoginSign Up
← Back to all sparks
O

Open edX

EDTECH
Velocity5.0

Open-source learning platform powering massive open online courses

openedx.org ↗

Open edX maintenance branches carrying security backports, not features

lmsopen-sourcesecuritybackportsauthorization
◆Current state
The visible stream is release-branch commits rather than named releases, and the recent ones are all corrective. Two July entries backport the same fix — an authorization gap where CourseTeamManageAPIView required only authentication, letting any enrolled learner call the endpoint. Earlier entries block SSRF in SAML metadata fetching by validating the URL against loopback, link-local, reserved and private ranges, add LTI launch logging, and normalize block structure keys.
◆Where it's heading
This window shows the maintenance side of a large deployment-driven platform: fixes land on master and are backported across named release branches (teak, ulmo, verawood) so operators on older lines get them. The security items share a shape — endpoints and integrations that trusted their callers more than they should. Nothing here indicates feature direction, because feature work does not surface in this branch stream.
◆Prediction
Expect continued backporting across the active named branches, since the same authorization fix already landed on two of them within a minute of each other. What ships in the next named release is not visible from these entries.

◆Recent moves

  1. 20d ago

    Course-team endpoint gated behind manage permission

    The support course-team GET endpoint required only authentication, so any enrolled learner could call it and read back information through response differences. Gating it on can-manage closes a real exposure on the newest release branch.

    View source ↗
  2. 20d ago

    Same authorization fix backported to the prior branch

    The identical fix applied to the older release line a minute later. Operators track named branches rather than master, so a backport is how a fix actually reaches most installations.

    View source ↗
  3. 3mo ago

    SSRF blocked in SAML metadata URL fetching

    SAML metadata URLs are now validated to enforce HTTPS and reject loopback, link-local and reserved addresses outright, with private ranges blocked by default. Third-party auth configuration is operator-supplied, which is exactly where SSRF tends to hide.

    View source ↗
  4. 6mo ago

    LTI launch logging backported

    Additional logging around the LTI launch flow, backported to a release branch. Diagnostic support for integration debugging with no user-visible effect.

    View source ↗
  5. 7mo ago

    Block structure keys normalized

    Branch and version information is stripped when building block structures so locations normalize consistently. Internal correctness work in the course content pipeline.

    View source ↗
  6. 11mo ago

    Forum dependency bump backported

    A dependency version update backported to an older release branch. Routine maintenance on a long-lived line.

    View source ↗