What's Changed
- fix: keep students off assignment list pages after redirect (backport #2774) by @mergify[bot] in #2842
- fix(security): require quiz access to check an answer (backport #2818) by @mergify[bot] in #2866
- fix: sanitise JSON-shaped rich text on save (backport #2816) by @mergify[bot] in #2868
- fix(permissions)!: scope LMS Coupon to the courses and batches it discounts (backport #2815) by @mergify[bot] in #2867
- fix(quiz): render schedule badges as the true instant (backport #2835) by @mergify[bot] in #2869
- fix(security): cap how far an uploaded archive may expand (backport #2830) by @mergify[bot] in #2870
- fix(security): lock enrollment course, member and batch after insert (backport #2832) by @mergify[bot] in #2871
- fix(security): serve only the statistics charts from get_chart_data (backport #2828) by @mergify[bot] in #2872
- fix(security): check progress against the lesson's own course (backport #2833) by @mergify[bot] in #2873
- fix(security): scope batch authoring and lesson moves to the owning resource (backport #2831) by @mergify[bot] in #2874
- fix(perms): vouch lesson media on the lesson its owner created (backport #2827) by @mergify[bot] in #2875
- fix(security): only attach files the user uploaded for the document (backport #2834) by @mergify[bot] in #2876
- fix: let evaluators and creators save batch/course meta tags (backport #2836) by @mergify[bot] in #2877
- fix: secure send_confirmation_email against untrusted payload (backport #2642) by @mergify[bot] in #2881
- fix(signup): make the user category placeholder read as a prompt (backport #2810) by @mergify[bot] in #2878
- fix: put the cursor in Title when adding a chapter (backport #2851) by @mergify[bot] in #2880
- fix(batch): scope who can enroll without payment (backport #2847) by @raizasafeel in #2882
- fix: keep public and private course assets apart on import (backport #2825) by @mergify[bot] in #2884
- fix(security): keep scorm package deletion inside the chapter's own package (backport #2829) by @mergify[bot] in #2885
- fix(raven): migrate Raven conditions stored against the old rule vocabulary (backport #2837) by @mergify[bot] in #2886
- fix(badges): restrict who can assign a badge (backport #2846) by @mergify[bot] in #2890
- fix: scope batch evaluator writes on LMS Certificate (backport #2817) by @mergify[bot] in #2889
- fix(perms): put a question's explanation fields behind permlevel 1 (backport #2844) by @mergify[bot] in #2888
- feat(permissions)!: register the assessment permission pair (backport #2826) by @mergify[bot] in #2887
- fix(settings): link self-hosted sites to the Payments repo, not the marketplace (backport #2704) by @mergify[bot] in #2892
- perf: index the columns permission query conditions filter on (backport #2843) by @mergify[bot] in #2893
- feat(batch): let Course Creators manage the batches they are tagged on (backport #2845) by @mergify[bot] in #2894
- fix(import): limit what a course archive can create (backport #2895) by @mergify[bot] in #2901
- Fix 'User Category' select styling on signup form (backport #2906) by @mergify[bot] in #2908
Full Changelog: v2.64.0...v2.65.0