coalescing_panda 4.8.0.beta.1 → 5.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2890e7eb4eb1f91be53b1a0063850b01a19b6433cd4d58415a0077603ee90ca2
-  data.tar.gz: c687e98abbe7ac80c96a28a07c9b5aa896a4d606e22f32912c78c55df0594bca
+  metadata.gz: 683daed32c44f738fe0747932f43a2be9ee00490ac44b6bbda7a0c5f2e513660
+  data.tar.gz: 893aca1614fee0eef49a1bf9eeb2f0b02de240df3168ae82940a0f102a7e6a30
 SHA512:
-  metadata.gz: b1370a25a326aa117263653f4c5ad3e2c033923db39503f18b9d5e4a2676f379e34f6ee9b998c3234cf381ff0fe14a3ff9906c861f335e168f236f5f2b78b6c5
-  data.tar.gz: 85014215aa9943baba3f7946a1459093ffff62e42b0a7f99e11ff2fa2c2c311c117e4be60c4ef22c5e7ab9c69bb3cd84f21e597a7c4125b0834e8a97f83e2125
+  metadata.gz: 5c1666f7c708b34cd1161e53fcc2346c5122fd847797d9d2ddb7e9887ddb30e4e54a8992fc50b7998bf15153f6fc3bd851a1542bf7b93e0de34fa3a5b7aff4ca
+  data.tar.gz: c385b2c0e634fa4edc0bef7c2f14f7b6c5c484e8c0cee109095aed1bc1fd57c91d742aa401e6f2ad85cf8aeb232c0dea60c9dbb4f149706edb24cd0713c7ae92

data/app/assets/config/coalescing_panda/manifest.js

@@ -0,0 +1,3 @@
+//= link_tree ../../images
+//= link_directory ../../javascripts/coalescing_panda/ .js
+//= link_directory ../../stylesheets/coalescing_panda/ .css

data/app/controllers/coalescing_panda/oauth2_controller.rb

@@ -7,6 +7,8 @@ module CoalescingPanda
     end
 
     def redirect
+      use_secure_headers_override(:allow_inline_scripts)
+
       if !params[:error] && retrieve_oauth_state
         lti_account = LtiAccount.find_by_key(@oauth_state.data[:key])
         client_id = lti_account.oauth2_client_id

data/app/models/coalescing_panda/persistent_session.rb

@@ -10,7 +10,7 @@ module CoalescingPanda
 
     def self.create_from_launch(launch_params, account_id)
       session = PersistentSession.new(coalescing_panda_lti_account_id: account_id)
-      session.data[:launch_params] = launch_params.to_unsafe_h
+      session.data[:launch_params] = launch_params.to_unsafe_h.with_indifferent_access
       session.data[:roles] = launch_params['roles'].split(',').map { |role|
         case role.downcase.strip
         when 'admin'

data/lib/coalescing_panda/controller_helpers.rb

@@ -187,11 +187,11 @@ module CoalescingPanda
     end
 
     def organization_key
-      params[:oauth_consumer_key] || current_session_data[:organization_key]
+      params[:oauth_consumer_key] || (current_session_data[:launch_params][:oauth_consumer_key] if @current_session)
     end
 
     def organization_id
-      params[:organization_id]
+      params[:organization_id] || (current_session_data[:launch_params][:organization_id] if @current_session)
     end
 
     def session_key
@@ -218,26 +218,26 @@ module CoalescingPanda
     # nicely with webpack-dev-server live reloading (otherwise
     # you get an access error every time it tries to live reload).
 
-    def redirect_with_session_to(path, id_or_model = nil, params = {})
-      if Rails.env.development?
-        redirect_development_mode(path, id_or_model, params)
+    def redirect_with_session_to(path, id_or_resource = nil, redirect_params = {})
+      if Rails.env.development? || Rails.env.test?
+        redirect_development_mode(path, id_or_resource, redirect_params)
       else
-        redirect_production_mode(path, id_or_model, params)
+        redirect_production_mode(path, id_or_resource, redirect_params)
       end
     end
 
-    def redirect_development_mode(path, id_or_model = nil, params)
-      redirect_to send(path, id_or_model, {
+    def redirect_development_mode(path, id_or_resource = nil, redirect_params)
+      redirect_to send(path, id_or_resource, {
           session_key: current_session.session_key,
           organization_id: current_lti_account.id
-      }.merge(params))
+      }.merge(redirect_params))
     end
 
-    def redirect_production_mode(path, id_or_model = nil, params)
-      redirect_to send(path, id_or_model, {
+    def redirect_production_mode(path, id_or_resource = nil, redirect_params)
+      redirect_to send(path, id_or_resource, {
           encrypted_session_key: encrypted_session_key,
           organization_id: current_lti_account.id
-      }.merge(params))
+      }.merge(redirect_params))
     end
 
   end

data/lib/coalescing_panda/engine.rb

@@ -25,6 +25,10 @@ module CoalescingPanda
       end
     end
 
+    initializer 'coalescing_panda.assets' do |app|
+      app.config.assets.precompile << 'coalescing_panda/manifest.js'
+    end
+
     initializer 'cloaescing_panda.route_helper' do |route|
       ActionDispatch::Routing::Mapper.send :include, CoalescingPanda::RouteHelpers
     end
@@ -50,6 +54,9 @@ module CoalescingPanda
         # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
         # DON'T ENABLE THIS FOR PRODUCTION!
         script_src << "'unsafe-eval'"
+      elsif CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
+        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
+        script_src << "'unsafe-eval'"
       end
 
       SecureHeaders::Configuration.default do |config|
@@ -80,6 +87,10 @@ module CoalescingPanda
       SecureHeaders::Configuration.override(:safari_override) do |config|
         config.cookies = SecureHeaders::OPT_OUT
       end
+
+      SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
+        config.csp[:script_src] << "'unsafe-inline'"
+      end
     end
 
   end

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '4.8.0.beta.1'
+  VERSION = '5.0.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 4.8.0.beta.1
+  version: 5.0.2
 platform: ruby
 authors:
 - Nathan Mills
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-02 00:00:00.000000000 Z
+date: 2020-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -400,6 +400,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - Rakefile
+- app/assets/config/coalescing_panda/manifest.js
 - app/assets/images/bootstrap/glyphicons-halflings-white.png
 - app/assets/images/bootstrap/glyphicons-halflings.png
 - app/assets/javascripts/coalescing_panda/application.js
@@ -563,9 +564,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubygems_version: 3.1.2
 signing_key: