From 1fdf3adf51ae5dc2b5bdb04b3ff104ce2dfd1a2e Mon Sep 17 00:00:00 2001
From: Sara Arjona <sara@moodle.com>
Date: Tue, 16 Mar 2021 12:43:39 +0100
Subject: [PATCH] MDL-71119 core_badges: Use basicauth and remove urlencode

Basic authorization header is required to get token. Besides, client
id and secret shouldn't call urlencode.
---
 badges/classes/oauth2/client.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/badges/classes/oauth2/client.php b/badges/classes/oauth2/client.php
index 575985b796d..e7bc270e481 100644
--- a/badges/classes/oauth2/client.php
+++ b/badges/classes/oauth2/client.php
@@ -222,6 +222,7 @@ class client extends \core\oauth2\client {
         $callbackurl = self::callback_url();
 
         if ($granttype == 'authorization_code') {
+            $this->basicauth = true;
             $params = array('code' => $code,
                 'grant_type' => $granttype,
                 'redirect_uri' => $callbackurl->out(false),
@@ -236,7 +237,7 @@ class client extends \core\oauth2\client {
             );
         }
         if ($this->basicauth) {
-            $idsecret = urlencode($this->clientid) . ':' . urlencode($this->clientsecret);
+            $idsecret = $this->clientid . ':' . $this->clientsecret;
             $this->setHeader('Authorization: Basic ' . base64_encode($idsecret));
         } else {
             $params['client_id'] = $this->clientid;