Skip to content

fix!: gate the forum HTTP API behind a toggle and require a staff caller #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
feanil merged 1 commit into from
Oct 14, 2026
Merged

fix!: gate the forum HTTP API behind a toggle and require a staff caller #298

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,11 @@ In edx-platform, forum v2 is not enabled by default and edx-platform will keep c

Note that Tutor enables this flag for all forum plugin users, such that you don't have to run this command yourself. If you wish to migrate your courses one by one to the new forum v2 app, you may create the corresponding "Waffle flag course override" objects in your LMS administration panel, at: ``http(s)://<LMS_HOST>/admin/waffle_utils/waffleflagcourseoverridemodel/``.

Forum HTTP API
--------------

The legacy forum HTTP API under ``/forum/api/v1/`` and ``/forum/api/v2/`` is not routed by default. edx-platform calls ``forum.api`` in process and does not need it. If you serve the forum as a separate HTTP service, set ``FORUM_ENABLE_HTTP_API = True``. Callers must then authenticate as a staff account, since the endpoints act on behalf of whichever user the request names. See `GHSA-c6fp-f54c-6cv4 <https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4>`__.

Migration from MongoDB to MySQL
-------------------------------

Expand Down
Loading