v3.0.2

[ywarnier]

v3.0.2 is a large security-focused release on top of 3.0.1. It ships a hardening campaign across the whole platform: course-scoped authorization for learning paths, assignments, the gradebook, forums, links, blogs, glossary, dropbox and exercises; output escaping in user, course, skill and ticket screens; fixes for a two-factor authentication bypass through the JWT login endpoint, account takeover paths through LTI, SSO and SCIM provisioning, an OAuth consent flow that could be redirected, a SQL injection in learning path progress saving, and several request-forgery paths (link checker, xAPI LRS URLs, OnlyOffice callbacks); password reset links built from the configured access URL; and the retirement of legacy announcement, forum and link pages in favor of their Vue tools. It also brings the security fixes of the 1.11.x and 2.0 branches to 3.0 (student boss reports, gradebook ownership, survey invitations, OnlyOffice editing rights), a PCRE JIT diagnosis in the installer, a health check for an empty migration history, calendar group fixes and updated vendor libraries.

---

This discussion was created from the release v3.0.2.

[Coursenligne]

Very good version!!!
3.0.1 didn't install at all.
Here, same conditions (windows11 // Wamp server) and install straight forwrd.
A bit of fear at first startup as English instead of french was selected. First login with a 404 not foud error.
I just restarted Wamp and everything is OK.
I now have to perform tests to see how it works.
The first benefit is that 3.0.2 is faster than 1.11.42.

Braov to the dev;team...