L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-70668 auth: Fix secret validation during user confirmation

Browse Source 
Co-authored-by: Michael Hawkins <[email protected]>
This commit is contained in:
Sander Wind
2021-03-02 23:37:35 +01:00
committed by Jenkins
co-authored by Michael Hawkins
parent 71f444e82d
commit 299fb2f158
4 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/email/auth.php
+2 -4
View File
@@ -178,10 +178,10 @@ class auth_plugin_email extends auth_plugin_base {
if ($user->auth != $this->authtype) {
return AUTH_CONFIRM_ERROR;
} else if ($user->secret == $confirmsecret && $user->confirmed) {
} else if ($user->secret === $confirmsecret && $user->confirmed) {
return AUTH_CONFIRM_ALREADY;
} else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in
} else if ($user->secret === $confirmsecret) { // They have provided the secret key to get in
$DB->set_field("user", "confirmed", 1, array("id"=>$user->id));
if ($wantsurl = get_user_preferences('auth_email_wantsurl', false, $user)) {
@@ -257,5 +257,3 @@ class auth_plugin_email extends auth_plugin_base {
}
}
auth/ldap/auth.php
+2 -2
View File
@@ -598,10 +598,10 @@ class auth_plugin_ldap extends auth_plugin_base {
if ($user->auth != $this->authtype) {
return AUTH_CONFIRM_ERROR;
} else if ($user->secret == $confirmsecret && $user->confirmed) {
} else if ($user->secret === $confirmsecret && $user->confirmed) {
return AUTH_CONFIRM_ALREADY;
} else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in
} else if ($user->secret === $confirmsecret) { // They have provided the secret key to get in
if (!$this->user_activate($username)) {
return AUTH_CONFIRM_FAIL;
}
auth/oauth2/classes/auth.php
+2 -2
View File
@@ -372,10 +372,10 @@ class auth extends \auth_plugin_base {
if ($user->auth != $this->authtype) {
return AUTH_CONFIRM_ERROR;
} else if ($user->secret == $confirmsecret && $user->confirmed) {
} else if ($user->secret === $confirmsecret && $user->confirmed) {
return AUTH_CONFIRM_ALREADY;
} else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in.
} else if ($user->secret === $confirmsecret) { // They have provided the secret key to get in.
$DB->set_field("user", "confirmed", 1, array("id" => $user->id));
return AUTH_CONFIRM_OK;
}
lib/classes/user.php
+1 -1
View File
@@ -709,7 +709,7 @@ class core_user {
$fields['lastlogin'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED);
$fields['currentlogin'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED);
$fields['lastip'] = array('type' => PARAM_NOTAGS, 'null' => NULL_NOT_ALLOWED);
$fields['secret'] = array('type' => PARAM_RAW, 'null' => NULL_NOT_ALLOWED);
$fields['secret'] = array('type' => PARAM_ALPHANUM, 'null' => NULL_NOT_ALLOWED);
$fields['picture'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED);
$fields['url'] = array('type' => PARAM_URL, 'null' => NULL_NOT_ALLOWED);
$fields['description'] = array('type' => PARAM_RAW, 'null' => NULL_ALLOWED);