From 299fb2f158134ae83a5a8f2e49c93baf7612ecc4 Mon Sep 17 00:00:00 2001 From: Sander Wind Date: Tue, 19 Jan 2021 16:05:41 +0800 Subject: [PATCH] MDL-70668 auth: Fix secret validation during user confirmation Co-authored-by: Michael Hawkins --- auth/email/auth.php | 6 ++---- auth/ldap/auth.php | 4 ++-- auth/oauth2/classes/auth.php | 4 ++-- lib/classes/user.php | 2 +- 4 files changed, 7 insertions(+), 9 deletions(-) diff --git a/auth/email/auth.php b/auth/email/auth.php index f207f030a22..1998ba0572f 100644 --- a/auth/email/auth.php +++ b/auth/email/auth.php @@ -178,10 +178,10 @@ class auth_plugin_email extends auth_plugin_base { if ($user->auth != $this->authtype) { return AUTH_CONFIRM_ERROR; - } else if ($user->secret == $confirmsecret && $user->confirmed) { + } else if ($user->secret === $confirmsecret && $user->confirmed) { return AUTH_CONFIRM_ALREADY; - } else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in + } else if ($user->secret === $confirmsecret) { // They have provided the secret key to get in $DB->set_field("user", "confirmed", 1, array("id"=>$user->id)); if ($wantsurl = get_user_preferences('auth_email_wantsurl', false, $user)) { @@ -257,5 +257,3 @@ class auth_plugin_email extends auth_plugin_base { } } - - diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php index f03372f3154..695bda7e31d 100644 --- a/auth/ldap/auth.php +++ b/auth/ldap/auth.php @@ -598,10 +598,10 @@ class auth_plugin_ldap extends auth_plugin_base { if ($user->auth != $this->authtype) { return AUTH_CONFIRM_ERROR; - } else if ($user->secret == $confirmsecret && $user->confirmed) { + } else if ($user->secret === $confirmsecret && $user->confirmed) { return AUTH_CONFIRM_ALREADY; - } else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in + } else if ($user->secret === $confirmsecret) { // They have provided the secret key to get in if (!$this->user_activate($username)) { return AUTH_CONFIRM_FAIL; } diff --git a/auth/oauth2/classes/auth.php b/auth/oauth2/classes/auth.php index cf6fcfdebcd..41527292b70 100644 --- a/auth/oauth2/classes/auth.php +++ b/auth/oauth2/classes/auth.php @@ -372,10 +372,10 @@ class auth extends \auth_plugin_base { if ($user->auth != $this->authtype) { return AUTH_CONFIRM_ERROR; - } else if ($user->secret == $confirmsecret && $user->confirmed) { + } else if ($user->secret === $confirmsecret && $user->confirmed) { return AUTH_CONFIRM_ALREADY; - } else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in. + } else if ($user->secret === $confirmsecret) { // They have provided the secret key to get in. $DB->set_field("user", "confirmed", 1, array("id" => $user->id)); return AUTH_CONFIRM_OK; } diff --git a/lib/classes/user.php b/lib/classes/user.php index d1c53e903be..4f821124286 100644 --- a/lib/classes/user.php +++ b/lib/classes/user.php @@ -709,7 +709,7 @@ class core_user { $fields['lastlogin'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED); $fields['currentlogin'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED); $fields['lastip'] = array('type' => PARAM_NOTAGS, 'null' => NULL_NOT_ALLOWED); - $fields['secret'] = array('type' => PARAM_RAW, 'null' => NULL_NOT_ALLOWED); + $fields['secret'] = array('type' => PARAM_ALPHANUM, 'null' => NULL_NOT_ALLOWED); $fields['picture'] = array('type' => PARAM_INT, 'null' => NULL_NOT_ALLOWED); $fields['url'] = array('type' => PARAM_URL, 'null' => NULL_NOT_ALLOWED); $fields['description'] = array('type' => PARAM_RAW, 'null' => NULL_ALLOWED);