Skip to content

fix: apply upstream security patch to remove activation_key exposure from account API #1366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahmed-arb merged 2 commits into from
Apr 17, 2026
+9 −1
Merged

fix: apply upstream security patch to remove activation_key exposure from account API #1366

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd339b1
fix: apply upstream security patch to remove activation_key exposure …
Gi-ron Apr 9, 2026
5dc18df
feat: update tutor version
Gi-ron Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,11 @@ instructions, because git commits are used to generate release notes:

<!-- scriv-insert-here -->

<a id='changelog-21.0.4'></a>
## v21.0.4 (2026-04-10)

- [Security] Backport fix to remove `activation_key` exposure from `/api/user/v1/accounts/{username}`, preventing email verification bypass via OAuth2 password grant flow (source: upstream edx-platform commit 21cead238466ca398ba368518f1d3288431d68f4).

<a id='changelog-21.0.3'></a>
## v21.0.3 (2026-04-09)

Expand Down
2 changes: 1 addition & 1 deletion tutor/__about__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

# Increment this version number to trigger a new release. See
# docs/tutor.html#versioning for information on the versioning scheme.
__version__ = "21.0.3"
__version__ = "21.0.4"

# The version suffix will be appended to the actual version, separated by a
# dash. Use this suffix to differentiate between the actual released version and
Expand Down
3 changes: 3 additions & 0 deletions tutor/templates/build/openedx/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,9 @@ RUN git config --global user.email "tutor@overhang.io" \
{# RUN curl -fsSL https://github.com/openedx/edx-platform/commit/<GITSHA1>.patch | git am #}
{# Include a comment on why the patch is neccessary. #}

# SECURITY FIX: remove activation_key exposure from account API
RUN curl -fsSL https://github.com/openedx/openedx-platform/commit/21cead238466ca398ba368518f1d3288431d68f4.patch | git am

{{ patch("openedx-dockerfile-post-git-checkout") }}

##### Empty layer with just the repo at the root.
Expand Down
Loading