MDL-84706 bigbluebuttonbn: improved authorization and mitigate CSRF risks

mod/bigbluebuttonbn/bbb_view.php

@@ -68,6 +68,8 @@ $context = $instance->get_context();
 
 require_login($course, true, $cm);
 
+require_sesskey();
+
 // Note : this uses the group optional_param as a value to decide which groupid.
 $groupid = groups_get_activity_group($cm, true) ?: null;
 if ($groupid) {
@@ -144,14 +146,18 @@ switch (strtolower($action)) {
         break;
 
     case 'play':
-        $recording = recording::get_record(['id' => $rid]);
-        if ($href = $recording->get_remote_playback_url($rtype)) {
-            logger::log_recording_played_event($instance, $rid);
-            redirect(urldecode($href));
-        } else {
+        $recordings = $instance->get_recordings();
+        if (!isset($recordings[$rid])) {
+            notification::add(get_string('recordingnotfound', 'mod_bigbluebuttonbn'), notification::ERROR);
+            redirect($instance->get_view_url());
+        }
+        $href = $recordings[$rid]->get_remote_playback_url($rtype);
+        if (!$href) {
             notification::add(get_string('recordingurlnotfound', 'mod_bigbluebuttonbn'), notification::ERROR);
             redirect($instance->get_view_url());
         }
+        logger::log_recording_played_event($instance, $rid);
+        redirect(urldecode($href));
         // We should never reach this point.
         break;
 }

mod/bigbluebuttonbn/classes/instance.php

@@ -1034,7 +1034,8 @@ EOF;
         return new moodle_url('/mod/bigbluebuttonbn/bbb_view.php', [
             'action' => 'logout',
             'id' => $this->cm->id,
-            'courseid' => $this->cm->course // Used to find the course if ever the activity is deleted
+            'courseid' => $this->cm->course, // Used to find the course if ever the activity is deleted
+            'sesskey' => sesskey(),
             // while the meeting is running.
         ]);
     }
@@ -1073,6 +1074,7 @@ EOF;
             'action' => 'join',
             'id' => $this->cm->id,
             'bn' => $this->instancedata->id,
+            'sesskey' => sesskey(),
         ]);
     }
 

mod/bigbluebuttonbn/classes/recording.php

@@ -577,6 +577,7 @@ class recording extends persistent {
                     'bn' => $this->raw_get('bigbluebuttonbnid'),
                     'rid' => $this->get('id'),
                     'rtype' => $clone['type'],
+                    'sesskey' => sesskey(),
                 ]);
 
                 return $clone;

mod/bigbluebuttonbn/lang/en/bigbluebuttonbn.php

@@ -648,4 +648,5 @@ $string['taskname:check_dismissed_recordings'] = 'Check for recordings that have
 $string['userlimitreached'] = 'The number of users allowed in a session has been reached.';
 $string['waitformoderator'] = 'Waiting for a moderator to join.';
 
+$string['recordingnotfound'] = 'The recording was not found.';
 $string['recordingurlnotfound'] = 'The recording URL is invalid.';

mod/bigbluebuttonbn/lib.php

@@ -529,7 +529,9 @@ function mod_bigbluebuttonbn_core_calendar_provide_event_action(
                 'action' => 'join',
                 'id' => $cm->id,
                 'bn' => $bigbluebuttonbn->id,
-                'timeline' => 1]
+                'timeline' => 1,
+                'sesskey' => sesskey(),
+                ]
         );
     }