Repository navigation
v3.0.2 is a large security-focused release on top of 3.0.1. It ships a hardening campaign across the whole platform: course-scoped authorization for learning paths, assignments, the gradebook, forums, links, blogs, glossary, dropbox and exercises; output escaping in user, course, skill and ticket screens; fixes for a two-factor authentication bypass through the JWT login endpoint, account takeover paths through LTI, SSO and SCIM provisioning, an OAuth consent flow that could be redirected, a SQL injection in learning path progress saving, and several request-forgery paths (link checker, xAPI LRS URLs, OnlyOffice callbacks); password reset links built from the configured access URL; and the retirement of legacy announcement, forum and link pages in favor of their Vue tools. It also brings the security fixes of the 1.11.x and 2.0 branches to 3.0 (student boss reports, gradebook ownership, survey invitations, OnlyOffice editing rights), a PCRE JIT diagnosis in the installer, a health check for an empty migration history, calendar group fixes and updated vendor libraries.