From 8e3dbf2d2af2d6b723bd1f5e4ccb44ac01234d2e Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Wed, 14 Oct 2026 10:15:19 -0400 Subject: [PATCH] fix!: gate the forum HTTP API behind a toggle and require a staff caller The fix for GHSA-c6fp-f54c-6cv4 landed on master as 322ca142a8f8c3b14aa693ecbc63925c560509eb, but merging from the security advisory replaced its conventional-commit subject with "Merge commit from fork", so python-semantic-release could not parse it, missed its BREAKING CHANGE footer, and made no release. This commit restates that change so the next Release run publishes it, and documents the FORUM_ENABLE_HTTP_API setting in the README. https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4 BREAKING CHANGE: The forum HTTP API under /forum/api/v1/ and /forum/api/v2/ is no longer routed unless FORUM_ENABLE_HTTP_API is set to True, and when routed it rejects callers that are not authenticated as a staff account. Co-Authored-By: Claude Opus 5.5 --- README.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.rst b/README.rst index a5f5ee41..0f4c0286 100644 --- a/README.rst +++ b/README.rst @@ -67,6 +67,11 @@ In edx-platform, forum v2 is not enabled by default and edx-platform will keep c Note that Tutor enables this flag for all forum plugin users, such that you don't have to run this command yourself. If you wish to migrate your courses one by one to the new forum v2 app, you may create the corresponding "Waffle flag course override" objects in your LMS administration panel, at: ``http(s):///admin/waffle_utils/waffleflagcourseoverridemodel/``. +Forum HTTP API +-------------- + +The legacy forum HTTP API under ``/forum/api/v1/`` and ``/forum/api/v2/`` is not routed by default. edx-platform calls ``forum.api`` in process and does not need it. If you serve the forum as a separate HTTP service, set ``FORUM_ENABLE_HTTP_API = True``. Callers must then authenticate as a staff account, since the endpoints act on behalf of whichever user the request names. See `GHSA-c6fp-f54c-6cv4 `__. + Migration from MongoDB to MySQL -------------------------------