Repository navigation

security: rate limit POST /api/auth with Rack::Attack - #101

Open

AjayPAnand wants to merge 413 commits into

thoth-tech:10.0.xfrom

AjayPAnand:fix/rate-limit-login-brute-force

Open

security: rate limit POST /api/auth with Rack::Attack#101
AjayPAnand wants to merge 413 commits into
thoth-tech:10.0.xfrom
AjayPAnand:fix/rate-limit-login-brute-force

This pull request is big! We're only showing the most recent 250 commits

Commits on Jul 3, 2026
- test: ensure pdf with excessive text wrapping has correct page count
  b0ink
  committed
  99c8547
- fix: run lualatex a third time to ensure correct page references
  b0ink
  committed
  fc40bde
Commits on Jul 4, 2026
- fix: ensure admins can manage communications
  b0ink
  committed
  25bcafc
- chore(release): 11.0.0-30
  b0ink
  committed
  8d2cd59
Commits on Jul 6, 2026
- Merge pull request #644 from b0ink/fix/pdf-page-count
  b0ink
  authored
  c6f1592
Commits on Jul 8, 2026
- chore(release): 11.0.0-31
  b0ink
  committed
  0eb873e
Commits on Jul 9, 2026
- feat: add rediscuss status
  b0ink
  committed
  05a44fa
Commits on Jul 13, 2026
- chore: add coverpage css
  b0ink
  committed
  1732604
- Merge pull request #645 from b0ink/feat/rediscuss-status
  b0ink
  authored
  dc76a5a
Commits on Jul 15, 2026
- docs: update development and deployment documentation
  b0ink
  committed
  6196b11
- docs: restore env var config
  b0ink
  committed
  444b0f7
- chore: extend observer only permissions
  b0ink
  committed
  b3ef36a
Commits on Jul 16, 2026
- feat: prompt for admin password when creating initial account
  b0ink
  committed
  7640a36
- chore: set default password in ci
  b0ink
  committed
  610daa3
- chore: fix rubocop
  b0ink
  committed
  923701d
- chore: only prompt for admin password in production
  b0ink
  committed
  18123d4
- feat: support word document submission (#647)
  b0ink
  authored
  a21daf8
- chore(release): 11.0.0-32
  b0ink
  committed
  b48edb7
Commits on Jul 19, 2026
- feat: content management system (#642)
  b0ink
  authored
  a87b250
- chore(release): 11.0.0-33
  b0ink
  committed
  184e01a
Commits on Jul 20, 2026
- fix: pass saml settings correctly to logout response
  b0ink
  committed
  4f60eff
Commits on Jul 22, 2026
- feat: track last access to site and unit
  b0ink
  committed
  2141fd6
- feat: add last sign in and last unit access communication conditions
  b0ink
  committed
  50fc821
- Merge pull request #649 from b0ink/feat/last-access-tracking
  b0ink
  authored
  8973496
Commits on Jul 23, 2026
- fix: prevent deleting task definitions used as prerequisites
  b0ink
  committed
  f26c9c5
Commits on Jul 24, 2026
- fix: allow unit deletion with task prerequisites
  b0ink
  committed
  2b3752a
- fix: iterate sentry exception interface values correctly
  b0ink
  committed
  4818049
- Merge pull request #652 from b0ink/fix/block-task-deletion-prerequisites
  b0ink
  authored
  d512955
- Merge pull request #654 from b0ink/fix/sentry-reporting
  b0ink
  authored
  9630a3e
- feat: discuss timeout (#646)
  b0ink
  authored
  f6dfd80
- refactor: serve only the content files that are being requested (#655)
  b0ink
  authored
  86753d5
- chore(release): 11.0.0-34
  b0ink
  committed
  a535d40
- fix: enable youtube embeds
  b0ink
  committed
  a8da36c
- chore(release): 11.0.0-35
  b0ink
  committed
  8d8b17c
- fix: normalize upload requirement file keys on save (#653)
  b0ink
  authored
  bf457a1
- feat: communication condition to check if student has portfolio (#651)
  b0ink
  authored
  90d362e
- chore(release): 11.0.0-36
  b0ink
  committed
  328b358
- fix: pass saml settings correctly to logout response (#648)
  b0ink
  authored
  8df3ea9
- feat: automated engagement stamps (#650)
  b0ink
  authored
  59641bd
- chore(release): 11.0.0-37
  b0ink
  committed
  c91418e
Commits on Jul 27, 2026
- fix: ensure feedback templates rollover to new unit
  b0ink
  committed
  df3bc30
- Merge pull request #656 from b0ink/fix/rollover-feedback-templates
  b0ink
  authored
  8b11923
Commits on Jul 28, 2026
- refactor: improve overseer step error handling
  b0ink
  committed
  1f83995
- chore(release): 11.0.0-38
  b0ink
  committed
  60a039a
- fix: only record discussion after successful transition
  b0ink
  committed
  c8bd418
- chore(release): 11.0.0-39
  b0ink
  committed
  fd2f926
Commits on Jul 30, 2026
- feat: enable unit content download
  b0ink
  committed
  1757731
- chore(release): 11.0.0-40
  b0ink
  committed
  a321cc1
- Merge pull request #662 from b0ink/fix/administrator-access
  b0ink
  authored
  57f0bfa
- chore(release): 11.0.0-41
  b0ink
  committed
  cf974a4
Commits on Jul 31, 2026
- fix: ensure screenshots embedded in markdown compiles correctly
  b0ink
  committed
  9b624d6
- Merge pull request #663 from b0ink/fix/markdown-images
  b0ink
  authored
  ba90b58
- chore(release): 11.0.0-42
  b0ink
  committed
  277506d
Commits on Aug 3, 2026
- feat: group engagement (#658)
  b0ink
  authored
  6f02a33
- chore(release): 11.0.0-43
  b0ink
  committed
  a60fdb6
- fix: ensure correct context is found for learning chips import
  b0ink
  committed
  76f3ff1
- feat: bulk upload staff notes
  b0ink
  committed
  6c3b3e0
- feat: bulk upload staff notes (#665)
  b0ink
  authored
  3e0f32d
Commits on Aug 8, 2026
- chore(release): 11.0.0-44
  b0ink
  committed
  dd833a4
Commits on Aug 10, 2026
- Merge pull request #664 from b0ink/fix/feedback-chip-import
  b0ink
  authored
  5db6234
Commits on Aug 11, 2026
- Merge branch '11.0.x' into fix/cve-2025-61594-uri-credential-leakage
  b0ink
  authored
  70f8f73
- chore: fix rubocop
  b0ink
  authored
  70faf42
- Merge pull request #633 from 224599437/fix/cve-2025-61594-uri-credential-leakage
  b0ink
  authored
  e174878
- fix: address uri mitigation and cors regressions
  b0ink
  committed
  919b6ab
- fix: validate user input (#668)
  b0ink
  authored
  a9649c7
Commits on Aug 12, 2026
- chore(release): 11.0.0-45
  b0ink
  committed
  c9beda2
Commits on Aug 17, 2026
- fix: extend valid character list
  b0ink
  committed
  c3da5be
- chore(release): 11.0.0-46
  b0ink
  committed
  5f29d96
- fix: support full width commas
  b0ink
  committed
  ed719ab
- chore(release): 11.0.0-47
  b0ink
  committed
  16a488a
- feat: add separate breaks for different campuses (#670)
  b0ink
  authored
  bfa41bf
- chore(release): 11.0.0-48
  b0ink
  committed
  c4864e8
- feat: tutorial duration (#672)
  b0ink
  authored
  c089777
- chore(release): 11.0.0-49
  b0ink
  committed
  1be12fb
- fix: remove default json value
  b0ink
  committed
  cb959bf
- chore(release): 11.0.0-50
  b0ink
  committed
  57ee1d4
Commits on Aug 19, 2026
- fix: allow admins to manage staff in units they are not part of
  b0ink
  committed
  cb9af9d
- Merge pull request #674 from b0ink/fix/admin-employment-access
  b0ink
  authored
  6177441
- feat: allow staff to delete engagement stamps within window
  b0ink
  committed
  18bff9e
- fix: avoid creating portfolio path unless intended
  b0ink
  committed
  6725f75
- refactor: fetch result for single rule
  b0ink
  committed
  d902b9d
- test: ensure rules are ordered by position
  b0ink
  committed
  e7da47c
Commits on Aug 20, 2026
Commits on Aug 21, 2026
- fix: ensure discuss timeout emails are not sent to withdrawn students
  b0ink
  committed
  569bc55
- chore: ensure bulk feedback does not notify withdrawn students
  b0ink
  committed
  7bb5b59
- chore(release): 11.0.0-52
  b0ink
  committed
  2802603
Commits on Aug 24, 2026
- refactor: replace comment read receipts with per-task cursors (#659)
  b0ink
  authored
  0c01c15
- chore(release): 11.0.0-53
  b0ink
  committed
  e5833bb
Commits on Aug 27, 2026
- fix: show group overseer reports across member tasks (#669)
  b0ink
  authored
  be022d4
Commits on Aug 28, 2026
- feat: ensure rules are reordered when deleted
  b0ink
  committed
  ef41d86
- Merge branch '11.0.x' of https://github.com/doubtfire-lms/doubtfire-api into 11.0.x
  b0ink
  committed
  0b44135
- fix: rubocop
  b0ink
  committed
  db2859e
Commits on Sep 2, 2026
Commits on Sep 3, 2026
- chore(release): 11.0.0-54
  b0ink
  committed
  ade4de3
- fix: catch tutorials with no campus set
  b0ink
  committed
  d6fcdef
- feat: statistics endpoint
  b0ink
  committed
  5359c94
- chore(release): 11.0.0-55
  b0ink
  committed
  a1cf60a
- Merge pull request #681 from b0ink/fix/nil-campus-timezone
  b0ink
  authored
  ad7964f
- chore(release): 11.0.0-56
  b0ink
  committed
  753ef9e
Commits on Sep 4, 2026
- fix: ensure blank passwords do not create empty user
  b0ink
  committed
  0338a9d
- fix: init disk space endpoint config outside of overseer
  b0ink
  committed
  566a6b0
- Merge pull request #682 from b0ink/fix/task-status-chart-student-count
  b0ink
  authored
  a53433a
- Merge branch '11.0.x' into fix/blank-password-check
  b0ink
  committed
  f981d35
- fix: ensure blank passwords do not create empty user (#683)
  b0ink
  authored
  fa1da37
- chore(release): 11.0.0-57
  b0ink
  committed
  96cdf31
Commits on Sep 8, 2026
- fix: handle concurrently cleared submission history markers
  b0ink
  committed
  d3c623d
- fix: use redis for production cache
  b0ink
  committed
  53695e9
Commits on Sep 9, 2026
- test: fix task cache
  b0ink
  committed
  1ac4a6f
Commits on Sep 14, 2026
- Merge pull request #685 from b0ink/fix/redis-cache-race
  b0ink
  authored
  e3e66de
- chore(release): 11.0.0-58
  b0ink
  committed
  ed5390a
- refactor: caddy file serving (#667)
  b0ink
  authored
  571a699
- chore(release): 11.0.0-59
  b0ink
  committed
  e541948
Commits on Sep 15, 2026
- fix: ensure unique email seed
  b0ink
  committed
  c4c7a34
- feat: expose waiting_since date on inbox tasks
  b0ink
  committed
  a49205e
Commits on Sep 16, 2026
- fix: allow students to submit tasks locked to a tutorial stream
  b0ink
  committed
  a8ae905
- test: cover student submission on stream-locked tasks
  b0ink
  committed
  6b2f1c9
- test: ensure task results in rff
  b0ink
  committed
  4f57a67
- chore: rename success messages
  b0ink
  committed
  47cdd26
- feat: authorise jplag report downloads for the caddy file server
  b0ink
  committed
  d44acf2
- chore: include unit code in jplag report download name
  b0ink
  committed
  3a42be6
- fix: prioritise unit staff role for owned projects
  b0ink
  committed
  238b6a7
- fix: prioritise unit staff role for owned projects (#688)
  b0ink
  authored
  aac3a8c
Commits on Sep 17, 2026
Commits on Sep 20, 2026
- fix: advance comment cursor past authored comments
  b0ink
  committed
  06a8b48
Commits on Sep 21, 2026
- fix: advance comment cursor past authored comments (#693)
  b0ink
  authored
  caaa1ac
- chore(release): 11.0.0-61
  b0ink
  committed
  bb23ee7
- Merge pull request #686 from b0ink/feat/waiting-since-field
  b0ink
  authored
  e00c3e2
Commits on Sep 22, 2026
- feat: view inbox as another tutor
  b0ink
  committed
  2627ac8
- Merge pull request #696 from b0ink/feat/view-inbox-as
  b0ink
  authored
  5cccd3e
- fix: teaching period authentication
  b0ink
  committed
  bb7571c
- Add target grade stats to task completion snapshot API (#694)
  audreypho
  authored
  9c58d3e
- chore(release): 11.0.0-62
  b0ink
  committed
  638182e
Commits on Sep 23, 2026
- fix: avoid sending full error message in task comments (#695)
  b0ink
  authored
  caa8fa1
- feat: resumable uploads
  b0ink
  committed
  c9c5d9a
- feat: automate lti syncing and add moodle course data (#690)
  b0ink
  authored
  e4b4db6
- chore(release): 11.0.0-63
  b0ink
  committed
  14b3d19
Commits on Sep 24, 2026
- fix: teaching period authentication (#697)
  b0ink
  authored
  80ca5b0
- Merge pull request #699 from b0ink/feat/resumable-uploads
  b0ink
  authored
  f74ad77
- chore(release): 11.0.0-64
  b0ink
  committed
  cf50d95
- fix: store batch feedback chunks as separate files instead of locking
  b0ink
  committed
  68530ee
- refactor: share user identity lookup across SAML, LTI and LMS imports
  b0ink
  committed
  b734947
- Merge pull request #700 from b0ink/fix/resumable-uploads-chunks
  b0ink
  authored
  e21f52b
- chore(release): 11.0.0-65
  b0ink
  committed
  4dade69
- feat: detect accounts linked to a different login id
  b0ink
  committed
  0f34f4e
- fix: rotate refresh token when signing in near expiry
  JBarazani
  committed
  55cef4d
Commits on Sep 27, 2026
- Merge pull request #702 from JBarazani/fix/refresh-token-rotation
  b0ink
  authored
  1c2f157
- fix: rollover unit content
  b0ink
  committed
  a82b291
- feat: rollover per-grade target dates and include them in task csv
  b0ink
  committed
  aab3256
- feat: configure batch feedback chunk size
  b0ink
  committed
  bebbb1a
- Merge pull request #703 from b0ink/fix/unit-content-rollover
  b0ink
  authored
  b7de688
Commits on Sep 28, 2026
- Merge pull request #704 from b0ink/feat/export-grade-due-dates
  b0ink
  authored
  9da7b41
- Merge pull request #705 from b0ink/feat/batch-feedback-size-env-var
  b0ink
  authored
  c8b3349
- chore: raise alert on username change using same login id
  b0ink
  committed
  3284b55
- chore(release): 11.0.0-66
  b0ink
  committed
  572d765
- Merge pull request #701 from b0ink/refactor/identity-matcher
  b0ink
  authored
  ecf6a94
- chore(release): 11.0.0-67
  b0ink
  committed
  c5e3744
Commits on Oct 14, 2026
- fix: handle large jpeg submissions
  b0ink
  committed
  61e8ba9
- test: add test image with large pixel count
  b0ink
  committed
  f396e85
Commits on Oct 15, 2026
- Merge pull request #706 from b0ink/fix/large-jpeg-submission-processing
  b0ink
  authored
  3516c39
- chore: automatically set student id from lti
  b0ink
  committed
  a910807
- chore(release): 11.0.0-68
  b0ink
  committed
  06cc24c
- fix: count students once per task status across tutorial streams
  b0ink
  committed
  50a36ab
- feat: name downloaded submission files after upload requirements
  b0ink
  committed
  a065b0e
- Merge pull request #708 from b0ink/feat/student-count-stats
  b0ink
  authored
  42a9b4d
- fix: skip missing submissions
  b0ink
  committed
  7887181
- fix: skip withdrawn projects
  b0ink
  committed
  43e11e7
- Merge pull request #709 from b0ink/feat/plain-text-communication-emails
  b0ink
  authored
  bcfe90a
Commits on Oct 16, 2026
- feat: name downloaded submission files after upload requirements (#707)
  b0ink
  authored
  86614eb
- fix: ensure submission date is saved correctly
  b0ink
  committed
  5ddf9bd
- fix: check prerequisites for tasks with no upload requirement
  b0ink
  committed
  446a303
- Merge pull request #710 from b0ink/fix/pdf-submission-date
  b0ink
  authored
  175b4ca
- Merge pull request #712 from b0ink/fix/prereq-check-no-upload-req
  b0ink
  authored
  099dd35
- chore(release): 11.0.0-69
  b0ink
  committed
  c7a1669
Commits on Oct 20, 2026
- refactor: fetch lms tab course data in a single moodle request
  b0ink
  committed
  88215b8
- chore(release): 11.0.0-70
  b0ink
  committed
  fd84098
- Merge pull request #713 from b0ink/refactor/discussion-deadline-end-of-day
  b0ink
  authored
  eff4c7f
Commits on Oct 21, 2026
- fix: define \lt and \gt for notebook pdf compilation
  b0ink
  committed
  2ce78de
- test: cover \lt in notebook pdf generation
  b0ink
  committed
  03a5f23
- feat: resolve template variable for main convenor name
  b0ink
  committed
  6b0b18e
- fix: support docx files in learning summary report uploads (#714)
  b0ink
  authored
  d6d3e6d
- chore(release): 11.0.0-71
  b0ink
  committed
  a350abf
- fix: file permissions
  b0ink
  committed
  690d1ff
- chore(release): 11.0.0-72
  b0ink
  committed
  c0d398e
- chore: add sortable descriptive gotenberg work directory names
  b0ink
  committed
  500b645
- chore: add sortable descriptive gotenberg work directory names (#715)
  b0ink
  authored
  049e583
Commits on Oct 22, 2026
- fix: add missing task status colors for pdf gen
  b0ink
  committed
  598639e
- test: ensure coverage of missing task status colors in pdf gen
  b0ink
  committed
  e7ca3c6
- chore: match portfolio pdf status colors to web palette
  b0ink
  committed
  0b66ead
- Merge pull request #717 from b0ink/fix/missing-pdf-task-status-colors
  b0ink
  authored
  fa8c1c4
- chore(release): 11.0.0-73
  b0ink
  committed
  265c00a
- chore: update alpine image to latest for jplag
  b0ink
  committed
  f037ddc
- fix: remove obsolete hash fragments from notification links
  b0ink
  committed
  63ef0cc
- test: cover portfolio pdf generation with an empty task description
  b0ink
  committed
  4d9327a
- fix: show placeholder for empty task descriptions in portfolio pdfs
  b0ink
  committed
  a2745ea
- Merge pull request #719 from b0ink/fix/href-links
  b0ink
  authored
  dd30dc7
- Merge pull request #720 from b0ink/fix/pdfgen-empty-task-description
  b0ink
  authored
  1d17b87
- Merge pull request #718 from b0ink/fix/redact-failed-pdf-gen-sentry
  b0ink
  authored
  2e2d49c
- chore(release): 11.0.0-74
  b0ink
  committed
  8a7d5fc
- test: cover docx draft learning summary in generated portfolio
  b0ink
  committed
  6554728
Commits on Oct 23, 2026
- fix: restrict global learning outcome changes to admins
  b0ink
  committed
  f4e402f
- refactor: add better logging to the submission history migration
  b0ink
  committed
  ed123c4
- fix: ensure authentication for tii group attachment api
  b0ink
  committed
  1fc7cf0
- fix: restrict global learning outcome changes to admins (#721)
  b0ink
  authored
  a7ad239
- Merge pull request #716 from b0ink/feat/last-teaching-date
  b0ink
  authored
  1d149d7
- fix: ensure authentication for tii group attachment api (#722)
  b0ink
  authored
  2b7ee3c
- chore(release): 11.0.0-75
  b0ink
  committed
  386e6c9
Commits on Oct 24, 2026
- fix: prevent students from grading their own tasks
  b0ink
  committed
  6bbfbb4
Commits on Oct 25, 2026
- fix: restrict tutor feedback moderation to mentors, convenors and admins (#723)
  b0ink
  authored
  161450a
- fix: prevent students from grading their own tasks (#724)
  b0ink
  authored
  9c1f74e
- chore: upgrade rails to 8.0.5.1
  b0ink
  committed
  c1cfdff
- fix: bump ruby-saml to 1.18.1
  b0ink
  committed
  0a2ee1c
- feat: split submission processing and other jobs into parallel serial queues (#711)
  b0ink
  authored
  e97bc27
- chore(release): 11.0.0-76
  b0ink
  committed
  fe9af93
- chore: upgrade rails to 8.0.5.1 (#725)
  b0ink
  authored
  adf16f2
- chore(release): 11.0.0-77
  b0ink
  committed
  6ca6e0b
- fix: require authentication for scorm extension routes
  b0ink
  committed
  ef24b3c
- Merge pull request #726 from b0ink/fix/scorm-extension-authentication
  b0ink
  authored
  5dc654f
- fix: require authentication for Turnitin EULA acceptance
  b0ink
  committed
  7846be6
- Merge pull request #728 from b0ink/fix/turnitin-eula-authentication
  b0ink
  authored
  e8e0a13
Commits on Oct 26, 2026
- fix: prevent pdfgen from claiming sidekiq-owned submissions (#730)
  b0ink
  authored
  ca9e274
- fix: whitelist similarity languages and avoid shell execution (#727)
  b0ink
  authored
  b47c050
- feat: setting to restrict task submissions and status changes to staff (#731)
  b0ink
  authored
  aaaff74
- refactor: improve naming of overseer work directory
  b0ink
  committed
  f61a01c
- feat: allow staff to reuse submissions for feedback (#732)
  b0ink
  authored
  5d02218
- feat: enable sentry for sidekiq (#698)
  b0ink
  authored
  770c49a
- refactor: add unit code to work dir name (#733)
  b0ink
  authored
  98746fd
- feat: support image and pdf attachments in staff notes (#734)
  b0ink
  authored
  b9a1009
- chore(release): 11.0.0-78
  b0ink
  committed
  bd3ec15
- fix: skip docker login job if vars not set
  b0ink
  committed
  84f366f
- chore(release): 11.0.0-79
  b0ink
  committed
  cd2a07c
- chore(release): 11.0.0
  b0ink
  committed
  914ddf3
- fix: allow task title punctuation and clarify validation errors (#735)
  b0ink
  authored
  4675793
- chore(release): 11.0.1
  b0ink
  committed
  65d4233
Commits on Oct 27, 2026
- refactor: format test files (#736)
  b0ink
  authored
  b644fa2
- chore: ignore format commit in git blame
  b0ink
  committed
  94d5b40
- Merge branch '11.1.x' into pr-634
  b0ink
  committed
  9255dfa
- feat: add env vars for rack attack configuration
  b0ink
  committed
  c5b898f
- fix: disable rack attack inbetween standard tests
  b0ink
  committed
  a5281df
- test: extend coverage for rack attack
  b0ink
  committed
  1aec2ed
- chore: sort gemfile
  b0ink
  committed
  f7dc3aa

Commits

Commits on Jul 3, 2026

Commits on Jul 4, 2026

Commits on Jul 6, 2026

Commits on Jul 8, 2026

Commits on Jul 9, 2026

Commits on Jul 13, 2026

Commits on Jul 15, 2026

Commits on Jul 16, 2026

Commits on Jul 19, 2026

Commits on Jul 20, 2026

Commits on Jul 22, 2026

Commits on Jul 23, 2026

Commits on Jul 24, 2026

Commits on Jul 27, 2026

Commits on Jul 28, 2026

Commits on Jul 30, 2026

Commits on Jul 31, 2026

Commits on Aug 3, 2026

Commits on Aug 8, 2026

Commits on Aug 10, 2026

Commits on Aug 11, 2026

Commits on Aug 12, 2026

Commits on Aug 17, 2026

Commits on Aug 19, 2026

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 24, 2026

Commits on Aug 27, 2026

Commits on Aug 28, 2026

Commits on Sep 2, 2026

Commits on Sep 3, 2026

Commits on Sep 4, 2026