elan-ev/tobira v4.0

v4.0 🐘

on GitHub

We're happy to announce Tobira v4.0! This ships a few big user-facing features, lots of bug fixes, a more flexible "known groups" system, and more.

What's Changed

Breaking changes ⚠

While this section is quite long, updating isn't necessarily very difficult. Most installations can probably ignore most of these. Also see the "Migration" section at the bottom!

• Known groups: format of groups.json changed and ROLE_ANONYMOUS and ROLE_USER now disallow write assignment by default (in #1776)
• Remove auth headers in #1762
• Various breaking config changes
• Remove username claim from JWTs, only using sub now (in 7337e8a)
  • The sub claim has been supported since OC 18. If you are using older versions, you have to adjust your OC JWT config (in the security config file) to accept sub instead of username.
• Allow line breaks in markdown via \ (or ) in #1761
  • This is technically a breaking change, but it likely affects no one in practice. Tobira now allows newlines in markdown via a backslash \ or two whitespaces at the end of a line. This inserts a <br> element. If your text blocks had this beforehand, they are now rendered differently.
  • This change gives more formatting freedom to those writing text blocks.

User-facing changes

• Redesign "My videos/series/playlists" pages in #1515
  • It's now mobile friendly, prettier, offers filtering and some additional features
• Add bookmark system for series/playlists (with feed to see their latest videos) in #1742
  • This allows users to remember series/playlists, but also see the latest videos of all bookmarked video-lists. This is somewhat similar to YouTube subscription feature.
• Support basic markdown in footer in #1734
• Add pagination to video list blocks (36 per page, improving UI performance for huge series) in #1739
• Improve thumbnail image loading (they appear smoothly and don't show alt text anymore) in #1744
• Add part of series and playlists sections to video details in #1733
• Improve handling of missing and "unauthorized" playlist entries in #1715
  • Before, editing a playlist with these entries would incorrectly delete them from the playlist, for example.
• Improve uploader UX when there is no writable series but a series is required in #1740
• Add video count to series/playlist blocks in #1770
• Hide RSS sharing for private lists in #1775
• Fix misleading warning when editing ACL as tenant admin in #1774
• Small layout/design improvements to series/playlist blocks in #1737
• Improve video date detail view in #1743
• Fix minor visual bug with thumbnails in list view of series/playlist block in #1753

Changes primarily for admins

• Make "known groups" more flexible, allowing restrictions on who can see/assign them for which actions in #1776
  • Before, everyone could assign every group for any action. We only had large to show a warning for some groups.
  • With the new system, admins can specify exactly who can see/add which groups in the ACL UI. For example, most people can just be restricted from giving write access to large groups.
  • Note: also check the breaking changes/migration related to this. Also check the relevant documentation.
  • Note: groups that are not known to Tobira (which can be set by writing ROLE_ in the group search box) can still be set by anyone.
• Update Paella in #1777
  • This now includes the patch for GHSA-m6c8-jcw2-5r25. However, the security problem isn't that relevant for Tobira, as Tobira has a very restrictive content-security-policy that already prevents inline XSS attacks for example.
• Move the log section to the end of the config file (in 7a65ef1)
  • It's nice when you temporarily need to change log level on your server manually. Otherwise it doesn't matter, but you'll likely notice during your 3-way merge anyway.
• Various other dependency updates

Changes primarily for developers

• Fix API contract check by @JulianKniephoff in #1754

Full Changelog: v3.16...v4.0

Migration

Read the "Breaking changes" section above and deal with everything that is not further described below.

Configuration changes

As usual, do a 3-way merge with your old configuration file, and then also pay special attention to these changes:

• Change default JWT algorithm to ED25519 (in ed685c3)
  • This algorithm is better than the others in every way, but only supported since OC 19. If you are using an older OC, you have to pick another algorithm in the Tobira config. Also, if you have a fixed private key, you might need to adjust the config.
• Enable auth.auth_static_files by default (in 49c5f15)
  • With this, Opencast can have static file auth enabled and everything still works. We recommend using octoka though. This Tobira feature has been running in production at some universities for a while now, so we are confident in enabling it by default.
  • If you have static file auth disabled anyway, this feature shouldn't break anything, but you may disable it in Tobira.
• Remove general.allow_acl_edit, now always true (in 6c9f244)
  • This is a leftover from when we were very careful with these OC modifications as they can cause data inconsistencies. However, by now there are many similar features in Tobira, so hiding this particular one behind a feature flag makes no sense.
• Change default of auth.pre_auth_external_links to true (in 19bc75c)
• Change default of auth.roles.editor to ROLE_USER (in af5fb3d)
  • Obviously, users can still only open the editor with videos they have write access to.
• Merge general.allow_series_event_removal and upload.require_series into general.disallow_events_without_series (in f7b1080)

Removal of auth headers

You can check whether you're using auth headers by checking whether auth.source or auth.session.from_session_endpoint is set to "trust-auth-headers". If so, you have to switch to one of the other options, likely callbacks. See the documentation on auth for more details.

Also: if you were still using auth headers, you seem to have missed us reaching out multiple times to the community, asking about this. Consider making yourself more reachable that way, in order for us to consider your use cases.

Known groups

The system for known groups (in the ACL UI) has grown more powerful and flexible, but this comes with breaking changes.

The format of known-groups.json (for tobira known-groups upsert) has been changed. The field large has been removed (and is now silently ignored) and two fields have been added:

• safeActions: list of actions that do not cause a warning when assigning them to this group.
• assignableBy: definition of who can assign this group for which action.

See the documentation for more detail! But make sure you don't just upsert your existing known-groups.json, as that likely results in unintended behavior (which also differs from the behavior fresh after the migration).

Also, the behavior of built-in groups (ROLE_ANONYMOUS and ROLE_USER) changed, regardless of whether you have previously overridden them or not. Both of them now have assignableBy: { "read": ["ROLE_USER"] }, i.e. everyone can add them for read access, but no one (except admins) can give write access to them. If you want to change that behavior, you can still override those groups after upgrading.

The migration of all other known groups is as follows:

• safeActions is set to ["read"] for large groups, and ["read", "write"] otherwise. This preserves the old behavior.
• assignableBy is set to "write": ["ROLE_USER"], also preserving the old behavior.

However, you might want to change that to improve UX or prevent some semi-malicious behavior.

Finally, note that for the permission of pages (realms), the actions are tobira:realm:moderate and tobira:realm:admin, so be sure to also think of that when crafting your known groups.