From 2aaf332bb1cffc2f0cc38855272bf1828246cbc1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Fri, 27 Sep 2013 10:51:13 +0200 Subject: [PATCH 1/3] MDL-41999 do not use $USER->password directly --- calendar/export.php | 2 +- calendar/view.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calendar/export.php b/calendar/export.php index 14262717aa9..462f35eae26 100644 --- a/calendar/export.php +++ b/calendar/export.php @@ -125,7 +125,7 @@ switch($action) { $weekend = intval($CFG->calendar_weekend); } - $authtoken = sha1($USER->id . $USER->password . $CFG->calendar_exportsalt); + $authtoken = sha1($USER->id . $DB->get_field('user', 'password', array('id'=>$USER->id)). $CFG->calendar_exportsalt); // Let's populate some vars to let "common tasks" be somewhat smart... // If today it's weekend, give the "next week" option $allownextweek = $weekend & (1 << $now['wday']); diff --git a/calendar/view.php b/calendar/view.php index 40a2d82a135..73e5924e89d 100644 --- a/calendar/view.php +++ b/calendar/view.php @@ -153,7 +153,7 @@ if (!empty($CFG->enablecalendarexport)) { echo $OUTPUT->single_button(new moodle_url('/calendar/managesubscriptions.php', array('course'=>$courseid)), get_string('managesubscriptions', 'calendar')); } if (isloggedin()) { - $authtoken = sha1($USER->id . $USER->password . $CFG->calendar_exportsalt); + $authtoken = sha1($USER->id . $DB->get_field('user', 'password', array('id'=>$USER->id)) . $CFG->calendar_exportsalt); $link = new moodle_url('/calendar/export_execute.php', array('preset_what'=>'all', 'preset_time'=>'recentupcoming', 'userid' => $USER->id, 'authtoken'=>$authtoken)); $icon = html_writer::empty_tag('img', array('src'=>$OUTPUT->pix_url('i/ical'), 'height'=>'14', 'width'=>'36', 'alt'=>get_string('ical', 'calendar'), 'title'=>get_string('quickdownloadcalendar', 'calendar'))); echo html_writer::tag('a', $icon, array('href'=>$link)); From 5fed843324e73da6c3648736dfe948e8e8bf6a58 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Fri, 27 Sep 2013 10:51:38 +0200 Subject: [PATCH 2/3] MDL-41999 warn developers to not use $USER->password directly --- lib/upgrade.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/upgrade.txt b/lib/upgrade.txt index 9f4809dea06..68e12387be9 100644 --- a/lib/upgrade.txt +++ b/lib/upgrade.txt @@ -40,6 +40,7 @@ information provided here is intended especially for developers. * Implement new method get_enabled_plugins() method in subplugin info classes. * Each plugin should include version information in version.php. * Module and block tables do not contain version column any more, use get_config('xx_yy', 'version') instead. +* $USER->password field is intentionally unset so that session data does not contain password hashes. DEPRECATIONS: Various previously deprecated functions have now been altered to throw DEBUG_DEVELOPER debugging notices From 92911ef1b8bdb5d5e3e9eca7f36bec279cbfe3a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Tue, 1 Oct 2013 09:23:42 +0200 Subject: [PATCH 3/3] MDL-41999 fix setting of USER in chat --- mod/chat/gui_header_js/jsupdate.php | 4 ++-- mod/chat/gui_header_js/jsupdated.php | 4 ++-- mod/chat/gui_header_js/users.php | 5 ++--- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/mod/chat/gui_header_js/jsupdate.php b/mod/chat/gui_header_js/jsupdate.php index cbff8409f35..a278120b60c 100644 --- a/mod/chat/gui_header_js/jsupdate.php +++ b/mod/chat/gui_header_js/jsupdate.php @@ -29,10 +29,10 @@ if (!$course = $DB->get_record('course', array('id'=>$chatuser->course))) { } //Get the user theme and enough info to be used in chat_format_message() which passes it along to -if (!$USER = $DB->get_record('user', array('id'=>$chatuser->userid))) { // no optimisation here, it would break again in future! +if (!$user = $DB->get_record('user', array('id'=>$chatuser->userid, 'deleted'=>0, 'suspended'=>0))) { // no optimisation here, it would break again in future! print_error('invaliduser'); } -$USER->description = ''; +\core\session\manager::set_user($user); //Setup course, lang and theme $PAGE->set_course($course); diff --git a/mod/chat/gui_header_js/jsupdated.php b/mod/chat/gui_header_js/jsupdated.php index 9a98185f970..22bdb5852a0 100644 --- a/mod/chat/gui_header_js/jsupdated.php +++ b/mod/chat/gui_header_js/jsupdated.php @@ -55,10 +55,10 @@ if (!$course = $DB->get_record('course', array('id'=>$chatuser->course))) { //Get the user theme and enough info to be used in chat_format_message() which passes it along to // chat_format_message_manually() -- and only id and timezone are used. -if (!$USER = $DB->get_record('user', array('id'=>$chatuser->userid))) { // no optimisation here, it would break again in future! +if (!$user = $DB->get_record('user', array('id'=>$chatuser->userid, 'deleted'=>0, 'suspended'=>0))) { // no optimisation here, it would break again in future! print_error('invaliduser'); } -$USER->description = ''; +\core\session\manager::set_user($user); //Setup course, lang and theme $PAGE->set_course($course); diff --git a/mod/chat/gui_header_js/users.php b/mod/chat/gui_header_js/users.php index 35fff5deda9..e523de8cd57 100644 --- a/mod/chat/gui_header_js/users.php +++ b/mod/chat/gui_header_js/users.php @@ -21,14 +21,13 @@ if (!$course = $DB->get_record('course', array('id'=>$chatuser->course))) { } //Get the user theme and enough info to be used in chat_format_message() which passes it along to -if (!$USER = $DB->get_record('user', array('id'=>$chatuser->userid))) { // no optimisation here, it would break again in future! +if (!$user = $DB->get_record('user', array('id'=>$chatuser->userid, 'deleted'=>0, 'suspended'=>0))) { // no optimisation here, it would break again in future! print_error('invaliduser'); } +\core\session\manager::set_user($user); $PAGE->set_pagelayout('embedded'); -$USER->description = ''; - //Setup course, lang and theme $PAGE->set_course($course);