diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 892a9f167545944d4b1354b6271336ba046cd5f9..bda54186ba6b8a0da1b13ea53c47475d5ab5bdd7 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -16,6 +16,11 @@ Please See the [releases tab](https://github.com/openedx/xblock-lti-consumer/rel Unreleased ~~~~~~~~~~ +7.1.0 - 2022-12-09 +------------------ +* Add support for platform setting `LTI_NRPS_DISALLOW_PII` to prevent sharing of pii over the names and roles + provisioning service. + 7.0.3 - 2022-12-02 ------------------ * Removed check against LMS specific `database_config_enabled` in LtiConfiguration model. diff --git a/lti_consumer/__init__.py b/lti_consumer/__init__.py index fbc8e914e1118bee6202af8b4cfe39a742e322fa..564229846033e0656995329bc63a9570828be7e2 100644 --- a/lti_consumer/__init__.py +++ b/lti_consumer/__init__.py @@ -4,4 +4,4 @@ Runtime will load the XBlock class from here. from .apps import LTIConsumerApp from .lti_xblock import LtiConsumerXBlock -__version__ = '7.0.3' +__version__ = '7.1.0' diff --git a/lti_consumer/plugin/compat.py b/lti_consumer/plugin/compat.py index a15dae65a28c631d8435c4ad42a15a0ce1240aef..f8195e6f0cdd7d44164b6d2c78f65c7a19f36fe8 100644 --- a/lti_consumer/plugin/compat.py +++ b/lti_consumer/plugin/compat.py @@ -4,6 +4,7 @@ Compatibility layer to isolate core-platform method calls from implementation. import logging from typing import Callable +from django.conf import settings from django.core.exceptions import ValidationError from django.forms import ModelForm from opaque_keys.edx.keys import CourseKey @@ -303,3 +304,11 @@ def get_event_tracker(): # pragma: nocover return tracker except ModuleNotFoundError: return None + + +def nrps_pii_disallowed(): + """ + Check if platform disallows sharing pii over NRPS + """ + return (hasattr(settings, 'LTI_NRPS_DISALLOW_PII') and + settings.LTI_NRPS_DISALLOW_PII is True) diff --git a/lti_consumer/plugin/views.py b/lti_consumer/plugin/views.py index d1f971dc3ce286431927dabc4b0ac48812251fa8..4e7428dadfaa9de72220253d2b41b86e5f408b6d 100644 --- a/lti_consumer/plugin/views.py +++ b/lti_consumer/plugin/views.py @@ -682,7 +682,8 @@ class LtiNrpsContextMembershipViewSet(viewsets.ReadOnlyModelViewSet): Overrides ModelViewSet's `get_serializer_class` method. Checks if PII fields can be exposed and returns appropiate serializer. """ - if get_lti_pii_sharing_state_for_course(self.request.lti_configuration.location.course_key): + if (not compat.nrps_pii_disallowed() and + get_lti_pii_sharing_state_for_course(self.request.lti_configuration.location.course_key)): return LtiNrpsContextMembershipPIISerializer else: return LtiNrpsContextMembershipBasicSerializer