v0.9.2:

The speed menu appears too far to the left from the button. I am seeing this issue on: Mac OS 10.11 Chrome 62, Win 10 Chrome 61, Win 10 FF56, Win 10 IE11.

Vulnerabilities

DepShield reports that this application's usage of deep-extend:0.4.2 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-3750] Improper Input Validation
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

deep-extend:0.4.2 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ rc:1.2.1
                                └─ deep-extend:0.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of parsejson:0.0.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

parsejson:0.0.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ parsejson:0.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of sshpk:1.13.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

sshpk:1.13.1 is a transitive dependency introduced by the following direct dependency(s):

• karma-coveralls:1.1.2
        └─ coveralls:2.11.16
              └─ request:2.79.0
                    └─ http-signature:1.1.1
                          └─ sshpk:1.13.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• eslint:2.13.1
        └─ debug:2.6.9

• eslint-config-edx-es5:2.0.0
        └─ eslint:3.19.0
              └─ debug:2.6.9

• eslint-plugin-import:1.16.0
        └─ debug:2.6.9
        └─ eslint-import-resolver-node:0.2.3
              └─ debug:2.6.9

• karma:1.7.1
        └─ body-parser:1.18.2
              └─ debug:2.6.9
        └─ connect:3.6.5
              └─ debug:2.6.9
              └─ finalhandler:1.0.6
                    └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Steps to Repro:

1. Log in to LMS as Staff user
2. Browse to Video XBlock instance
3. Click Staff Debug Info
4. Click "Delete Student State"

Expected result:
Student state successfully deleted

Actual result:
"Failed to delete student state for selected user. Unknown error occurred." and a 400 error in the Network Pane. Test server has * in ALLOWED_HOSTS.

Vulnerabilities

DepShield reports that this application's usage of stringstream:0.0.5 results in the following vulnerability(s):

• (CVSS 7.4) CWE-125: Out-of-bounds Read
• (CVSS 5.2) CWE-125: Out-of-bounds Read

Occurrences

stringstream:0.0.5 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ request:2.81.0
                                └─ stringstream:0.0.5

• karma-coveralls:1.1.2
        └─ coveralls:2.11.16
              └─ request:2.79.0
                    └─ stringstream:0.0.5

• karma-phantomjs-launcher:1.0.4
        └─ phantomjs-prebuilt:2.1.15
              └─ request:2.81.0
                    └─ stringstream:0.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Steps to reproduce:

1. Browse to video with captions and transcripts
2. Click caption button
3. Click transcript button
4. Navigate away from the page
5. Return to the page

Expected: Transcript button is highlighted/blue. Transcripts pane displays. Caption button highlighted/blue. Captions display on video after clicking play button.

Actual: Transcript and caption buttons gray. Transcript pane displays. Captions display on video after clicking play button.

Vulnerabilities

DepShield reports that this application's usage of engine.io-client:1.8.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

engine.io-client:1.8.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.3.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.3.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ engine.io:1.8.3
                    └─ debug:2.3.3
              └─ socket.io-adapter:0.5.0
                    └─ debug:2.3.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ debug:2.3.3
                    └─ debug:2.3.3
              └─ debug:2.3.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.4 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash:4.17.4 is a transitive dependency introduced by the following direct dependency(s):

• eslint:2.13.1
        └─ inquirer:0.12.0
              └─ lodash:4.17.4
        └─ lodash:4.17.4
        └─ table:3.8.3
              └─ lodash:4.17.4

• eslint-config-edx-es5:2.0.0
        └─ eslint:3.19.0
              └─ lodash:4.17.4

• karma:1.7.1
        └─ combine-lists:1.0.1
              └─ lodash:4.17.4

• karma-phantomjs-launcher:1.0.4
        └─ lodash:4.17.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Since 0.9.0 it looks like auto-populating the 3PM API key field value from the XBlock settings dictionary is no longer working. Account Id population from settings still works. I've Xed out the real values.

cms.env.json setting:

Account id is set on new BCove video:

...but not for 3PM API key:

Mobile device model: Iphone 7
OS version: iOS 12.1.4
Edx: Hawthorn
commit 03ec58b

Tested with Mac OS High Sierra Safari 11 and Mac OS El Capitan Safari 10, same results.
JS errors in console and Captions, Transcripts don't work (no captions appear, interactive transcript column doesn't appear. Languages do appear in menu)

@wowkalucky

Introduced in 0.9.4

This happens on every browser I tested.

@wowkalucky

In static/vendor/css/video-js.min.css

@font-face{font-family:VideoJS;src:url(font/VideoJS.eot?#iefix) 

font/ should be fonts/

Vulnerabilities

DepShield reports that this application's usage of sshpk:1.13.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

sshpk:1.13.0 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ request:2.81.0
                                └─ http-signature:1.1.1
                                      └─ sshpk:1.13.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of hoek:2.16.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3728] Improper Access Control

Occurrences

hoek:2.16.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ request:2.81.0
                                └─ hawk:3.1.3
                                      └─ boom:2.10.1
                                            └─ hoek:2.16.3
                                      └─ hoek:2.16.3
                                      └─ sntp:1.0.9
                                            └─ hoek:2.16.3

• karma-coveralls:1.1.2
        └─ coveralls:2.11.16
              └─ request:2.79.0
                    └─ hawk:3.1.3
                          └─ boom:2.10.1
                                └─ hoek:2.16.3
                          └─ hoek:2.16.3
                          └─ sntp:1.0.9
                                └─ hoek:2.16.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

• Add a new video xblock instance
• Click edit
• Enter a BrightCove video URL
• Click save
• click edit again
• go to advanced settings tab
• open 3PlayMedia transcripts accordion

You won't see the HTML elements for the token field, though the help text is correct for the BrightCove backend.

The current XBlock version (as of writing this issue) breaks the Hawthorn edxapp when installed. Mainly because it requires installing pycaptions.

pycaptions isn't maintained anymore and depends on and and conflicting requirements such as:

• lxml
• beautifulsoup4
• and others

I tried to upgrade pycaptions but stopped after realizing that it's not maintained anymore:

• pbs/pycaption#178

I also found that webvtt-py could be used, but it turns out that it only support Python 3+. I tried to support that as well:

• glut23/webvtt-py#15

Oh, I didn't also mention that this XBlock needs a couple of updates to the XBlock to make it render:

• appsembler#29

Needless to say it was a rabbit hole. I surrender with honor. I would appreciate it if you can take a look.

Vulnerabilities

DepShield reports that this application's usage of d:1.0.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Occurrences

d:1.0.0 is a transitive dependency introduced by the following direct dependency(s):

• eslint:2.13.1
        └─ es6-map:0.1.5
              └─ d:1.0.0
              └─ es6-iterator:2.0.1
                    └─ d:1.0.0
              └─ es6-symbol:3.1.1
                    └─ d:1.0.0
              └─ event-emitter:0.3.5
                    └─ d:1.0.0
        └─ escope:3.6.0
              └─ es6-weak-map:2.0.2
                    └─ d:1.0.0

• eslint-plugin-import:1.16.0
        └─ es6-set:0.1.5
              └─ d:1.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.cond:4.5.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.cond:4.5.2 is a transitive dependency introduced by the following direct dependency(s):

• eslint-plugin-import:1.16.0
        └─ lodash.cond:4.5.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Run

./manage.py cms collectstatic --settings=aws

or

./manage.py lms collectstatic --settings=aws

Post-processed 'js/student-view/video-xblock.js' as 'js/student-view/video-xblock.4fa3aa72ab58.js'
Post-processing 'vendor/css/video-js.min.css' failed!

Traceback (most recent call last):
  File "./manage.py", line 116, in <module>
    execute_from_command_line([sys.argv[0]] + django_args)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/management/__init__.py", line 354, in execute_from_command_line
    utility.execute()
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/management/__init__.py", line 346, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/management/base.py", line 394, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/management/base.py", line 445, in execute
    output = self.handle(*args, **options)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 168, in handle
    collected = self.collect()
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 120, in collect
    raise processed
ValueError: The file 'vendor/css/font/VideoJS.eot' could not be found with <openedx.core.storage.ProductionStorage object at 0x7f278c03e990>.

The video player that appears in the LMS seems to be missing elements or the elements are mispositioned. See attached screenshot.

Introduced in 0.9.4

Not a major issue, but whichever language is last selected from either the caption hover menu or transcript hover menu will determine the language of both captions and transcript. But the selected value may still show a different value from what actually appears in the captions and transcript.

In this, the menu shows Spanish selected while the captions and transcript are in French.

@wowkalucky

Vulnerabilities

DepShield reports that this application's usage of lodash:3.10.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash:3.10.1 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ lodash:3.10.1

• karma-coverage:1.1.1
        └─ lodash:3.10.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Chrome (Mac OS X , Chrome 57.0.2987.133) message:

Text Track parsing errors for /preview/xblock/block-v1:Appsembler+APPTEST01+2016+type@video_xblock+block@461f4da4b1ed4aa99f81b38e6d776e91/handler/srt_to_vtt/?/asset-v1:Appsembler+APPTEST01+2016+type@asset+block@setting_up_alerts.srt
index.min.js:9 VIDEOJS: ERROR: b {name: "ParsingError", code: 0, message: "Malformed WebVTT signature."}

Here is the .srt, I just added a .txt extension to be able to upload here.
setting_up_alerts.srt.txt

Vulnerabilities

DepShield reports that this application's usage of cryptiles:2.0.5 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-1000620] Insufficient Entropy

Occurrences

cryptiles:2.0.5 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ request:2.81.0
                                └─ hawk:3.1.3
                                      └─ cryptiles:2.0.5

• karma-coveralls:1.1.2
        └─ coveralls:2.11.16
              └─ request:2.79.0
                    └─ hawk:3.1.3
                          └─ cryptiles:2.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

To reproduce:

1. Browse to Studio on a domain other than 127.0.0.1 or localhost
2. Create a Video XBlock instance
3. Upload SRT caption files
4. Preview instance in Studio
5. AJAX calls to /preview/xblock/block-v1:.../handler/srt_to_vtt/?/asset-v1:XXX+type@[email protected]... will time out after 1 min with a 504 error
6. Subsequent requests to Studio will also return 504

This occurs when browsing directly to Studio port or via Nginx.

It is resolved with the changes in this diff.

diff --git a/video_xblock/mixins.py b/video_xblock/mixins.py
index 14588e2..fea15d3 100644
--- a/video_xblock/mixins.py
+++ b/video_xblock/mixins.py
@@ -325,7 +325,7 @@ class TranscriptsMixin(XBlock):
             webob.Response: WebVTT transcripts wrapped in Response object.
         """
         caps_path = request.query_string
-        caps = requests.get(request.host_url + caps_path).text
+        caps = requests.get(request.scheme+'://127.0.0.1' + caps_path).text
         return Response(self.convert_caps_to_vtt(caps))
 
     @XBlock.handler

Honestly, I'm not really sure why it is a problem. We have an XHR request sent to the handler_url for srt_to_vtt, which then makes a Python requests requests.get to the same domain.

(I suspect that this other change would also need to be made... )

diff --git a/video_xblock/mixins.py b/video_xblock/mixins.py
index 14588e2..0245683 100644
--- a/video_xblock/mixins.py
+++ b/video_xblock/mixins.py
@@ -302,7 +302,7 @@ class TranscriptsMixin(XBlock):
         """
         trans_path = self.get_path_for(request.query_string)
         filename = self.get_file_name_from_path(trans_path)
-        transcript = requests.get(request.host_url + request.query_string).text
+        transcript = requests.get(request.scheme + '://127.0.0.1' + request.query_string).text
         response = Response(transcript)
         headerlist = [
             ('Content-Type', 'text/plain'),

@wowkalucky @z4y4ts

Safari 10.0.2 giving message "Cross-origin text track load denied by Cross-Origin Resource Sharing policy" loading this URL

/preview/xblock/block-v1:Appsembler+APPTEST01+2016+type@video_xblock+block@461f4da4b1ed4aa99f81b38e6d776e91/handler/srt_to_vtt/?/asset-v1:Appsembler+APPTEST01+2016+type@asset+block@setting_up_alerts.srt

but not this one, which plays correctly:

/asset-v1:Appsembler+APPTEST01+2016+type@asset+block@Getting_Started_with_HL7_Settings_in_EnsembleRU.vtt

from the render_player IFRAME in Studio.
Both have the same domain and schema as the host page and iframe.

In Studio edit > Advanced, click Fetch Transcripts from ThreePlay. Transcripts will appear in the list above. Click Fetch Transcripts again. Duplicate transcripts appear above.

However, the player will only show one copy of each. So for end-user, it's no problem, but for Studio user it may be confusing.

The arrow icon toggles, but no language menu appears when hovering over the CC button. I believe this used to work.

Vulnerabilities

DepShield reports that this application's usage of lodash.find:4.6.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.find:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• eslint-plugin-import:1.16.0
        └─ lodash.find:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.2.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.2.0 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-parser:2.3.1
                    └─ debug:2.2.0

• karma-phantomjs-launcher:1.0.4
        └─ phantomjs-prebuilt:2.1.15
              └─ extract-zip:1.6.5
                    └─ debug:2.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

To reproduce:

1. Set new default account id in the XBLOCK_SETTINGS; e.g.,

XBLOCK_SETTINGS:
  "video_xblock": {
    "account_id": "610060920001"
  ...
}

2. Add a new video xblock component
3. Enter a BrightCove video URL
4. Save
5. Edit
6. Notice that the Account Id is set to 610060920001
7. Save again
8. You will get an error message "Account id can not be empty. Please enter a valid BrightCove account id"

It's a bit strange, since the lines of code that seem to be involved don't look like they have changed for a while, but this is new.

https://github.com/raccoongang/xblock-video/blob/dev/video_xblock/video_xblock.py#L227-L229

The error makes sense looking at the code—the logic seems wrong. It will throw an exception any time the default account_id is not changed, but if we use the XBLOCK_SETTINGS to set a good default account_id then it should not have to be changed.

Are you able to reproduce this?

Vulnerabilities

DepShield reports that this application's usage of lodash.endswith:4.2.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.endswith:4.2.1 is a transitive dependency introduced by the following direct dependency(s):

• eslint-plugin-import:1.16.0
        └─ lodash.endswith:4.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.8 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.8 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ tar-pack:3.4.0
                                └─ debug:2.6.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of fstream:1.0.11 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2019-13173] Improper Input Validation
• (CVSS 7.5) CWE-62: UNIX Hard Link

Occurrences

fstream:1.0.11 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ tar:2.2.1
                                └─ fstream:1.0.11
                          └─ tar-pack:3.4.0
                                └─ fstream:1.0.11
                                └─ fstream-ignore:1.0.5
                                      └─ fstream:1.0.11

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

in v0.9.2 (was an issue in 0.9.1 also)

Whether or not the interactive transcript displays, it is easy to make more than one, overlapping language menu appear. The rollover appear/disappear behavior seems a little buggy, too--sometimes the little arrow shows closed while the language menu is still open.

Same issue in Mac 10.11 Chrome 62, Win10 Chrome 61, Win10 FF56, Win 10 IE11

Vulnerabilities

DepShield reports that this application's usage of tunnel-agent:0.4.3 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation

Occurrences

tunnel-agent:0.4.3 is a transitive dependency introduced by the following direct dependency(s):

• karma-coveralls:1.1.2
        └─ coveralls:2.11.16
              └─ request:2.79.0
                    └─ tunnel-agent:0.4.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of ws:1.1.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-20: Improper Input Validation

Occurrences

ws:1.1.2 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ engine.io:1.8.3
                    └─ ws:1.1.2
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ ws:1.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of is-my-json-valid:2.16.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

is-my-json-valid:2.16.1 is a transitive dependency introduced by the following direct dependency(s):

• eslint:2.13.1
        └─ is-my-json-valid:2.16.1

• eslint-config-edx-es5:2.0.0
        └─ eslint:3.19.0
              └─ is-my-json-valid:2.16.1

• karma-coveralls:1.1.2
        └─ coveralls:2.11.16
              └─ request:2.79.0
                    └─ har-validator:2.0.6
                          └─ is-my-json-valid:2.16.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Reported by @bryanlandia:

• README.md https://github.com/raccoongang/xblock-video/blob/dev/README.md#installation
  Refers to make deps and deps is not a valid target in the Makefile.

edxapp@precise64:~/venvs/edxapp/src/video-xblock$ make deps
make: *** No rule to make target `deps'.  Stop.

It is also missing a bower install to get the standard (non-test) dependencies. Am I missing something?

• There seems to be a version incompatibility issue with the dev dependencies in package.json.

edxapp@precise64:~/venvs/edxapp/src/video-xblock$ npm install
npm WARN package.json @ No repository field.
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=0.11.0","iojs":"*"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"iojs":">= 1.0.0","node":">= 0.12.0"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"node":">=4"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm WARN engine [email protected]: wanted: {"iojs":">= 1.0.0","node":">= 0.12.0"} (current: {"node":"0.10.37","npm":"1.4.28"})
npm ERR! peerinvalid The package eslint does not satisfy its siblings' peerDependencies requirements!
npm ERR! peerinvalid Peer [email protected] wants eslint@^2.9.0
npm ERR! peerinvalid Peer [email protected] wants eslint@>=1.0.0
npm ERR! peerinvalid Peer [email protected] wants [email protected] - 3.x

npm ERR! System Linux 3.2.0-23-generic
npm ERR! command "/usr/bin/node" "/usr/bin/npm" "install"
npm ERR! cwd /edx/app/edxapp/venvs/edxapp/src/video-xblock
npm ERR! node -v v0.10.37
npm ERR! npm -v 1.4.28
npm ERR! code EPEERINVALID
npm ERR! 
npm ERR! Additional logging details can be found in:
npm ERR!     /edx/app/edxapp/venvs/edxapp/src/video-xblock/npm-debug.log
npm ERR! not ok code 0

Vulnerabilities

DepShield reports that this application's usage of tar:2.2.1 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-20834] Improper Link Resolution Before File Access ("Link Following")
• (CVSS 7.5) CWE-62: UNIX Hard Link

Occurrences

tar:2.2.1 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ tar:2.2.1
                          └─ tar-pack:3.4.0
                                └─ tar:2.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of tough-cookie:2.3.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2017-15010] Uncontrolled Resource Consumption ("Resource Exhaustion")
• (CVSS 7.5) CWE-185: Incorrect Regular Expression
• (CVSS 7.5) CWE-185: Incorrect Regular Expression

Occurrences

tough-cookie:2.3.2 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ chokidar:1.7.0
              └─ fsevents:1.1.2
                    └─ node-pre-gyp:0.6.36
                          └─ request:2.81.0
                                └─ tough-cookie:2.3.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.findindex:4.6.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.findindex:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• eslint-plugin-import:1.16.0
        └─ lodash.findindex:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Two different users, one a developer, who have been regular users of Studio edit and the XBlock did not realize that the "3Play media transcripts" section could be opened for more settings. I think we improve the UX, make it more obvious that these are openable sections. Maybe by moving the +/- to the left of the section headers and making them larger this would be fixed. Also, it might help to have a stronger dividing line on the bottom of the group of accordion sections, so it is apparent that the next field, "Player Id" is not under the heading of "3Play media transcripts"

We have two significant pages that are rendered using django templates in our Ironwood environment, the logout page and the 'reset your password' reminder email. After a request for a page that includes a video-xblock from the ironwood-rg branch has been responded to, the responding process no longer renders other django templates correctly, because utils.py:render_template() modifies engine.dirs with the path to its own templates.

Help text reads: "Click below to specify a language and upload an .srt transcript file for that language."
I did not realize until today that you can also upload a .vtt file directly. Please clarify or correct the help text.