panda_pal 5.19.2 → 5.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96a96c637e50a15e4df9574a2ca806b7bb61081a4484971fce1d21249349864b
-  data.tar.gz: 1fd58e43b549aee982cf75e8d4310f7ca60cf1802ba8941cb42e93e17e66c394
+  metadata.gz: 05adff1a6ac1e3c077fce392acaf5ac773b516f75ffa90d171ed8cb9c6c1b4b0
+  data.tar.gz: 243c14022da12a505d38f0be0a05c135412ab1eaba1a5478c3fec2d7ff967062
 SHA512:
-  metadata.gz: 1e7324dfc180a9dbd5edc202e22a6cec895d97894fbaaa56dfa97b41eb055507ca2b641ad2daad6da6b55c46ca48338a5282d00586d66d25232a88c0c9a2c740
-  data.tar.gz: aeab62e5f22cbe0ace446e1b29ffc942c2dba5a50d29c15c2f87f2f363b005ad65aaad36a356193838d78c728e3066e6a8b90b1b4df77b2b7c58252ebc2e3549
+  metadata.gz: 992ba7279928e36ae595362aaee43babe52f5b0cce6bbf75a9eb42c1f803588fd62221039714726aef283aec7becea7b69cbff1aba4dd3beaf7f6492d5291d67
+  data.tar.gz: 3e75a8857d2df28981c883922221d964edbfd324c7269034aa984a5eb5aaf9a97b2757e7a46740ae044086cbe312798b333cf5b5bd9645442d385ffe6cfc7e74

data/app/controllers/panda_pal/lti_v1_p3_controller.rb

@@ -133,6 +133,9 @@ module PandaPal
     end
 
     def public_jwks
+      # non-LTI-Advantage tools can lack this value; return 404 instead of 500
+      return head :not_found if PandaPal.lti_private_key.blank?
+
       render json: JWT::JWK::Set.new(PandaPal.jwk).export
     end
 

data/config/initializers/apartment.rb

@@ -273,17 +273,23 @@ Apartment.configure do |config|
 end
 
 Rails.application.config.middleware.use Apartment::Elevators::Generic, lambda { |request|
+  params = lambda do
+    request.params
+  rescue EOFError, Rack::Utils::InvalidParameterError, Rack::Utils::ParameterTypeError, Rack::QueryParser::ParamsTooDeepError
+    {}
+  end
+
   tenant = if match = request.path.match(/\/(?:orgs?|organizations?)\/(\d+)/)
       PandaPal::Organization.find_by(id: match[1]).try(:tenant_name)
     elsif match = request.path.match(/\/(?:orgs?|organizations?|o)\/(\w+)/)
       PandaPal::Organization.find_by(name: match[1]).try(:tenant_name)
-    elsif (panda_token = PandaPal::Session.extract_panda_token(request)).present?
+    elsif (panda_token = PandaPal::Session.extract_panda_token(request, params.call)).present?
       header, sig = panda_token.split('.')
       # This is just switching the tenant. Auth should be performed elsewhere (eg via `forbid_access_if_lacking_session`/`valid_session?`).
       decoded_header = JSON.parse(Base64.urlsafe_decode64(header))
       PandaPal::Organization.find_by(id: decoded_header['o']).try(:tenant_name)
     elsif request.path.start_with?('/rails/active_storage/blobs/')
-      PandaPal::Organization.find_by(id: request.params['organization_id']).try(:tenant_name)
+      PandaPal::Organization.find_by(id: params.call['organization_id']).try(:tenant_name)
     end
   tenant || 'public'
 }

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.19.2'
+  VERSION = '5.20.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.19.2
+  version: 5.20.1
 platform: ruby
 authors:
 - Instructure CustomDev