From 667f564b4d09b37970a05cd805caa977e69027c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Mudr=C3=A1k?= <david@moodle.com>
Date: Thu, 15 Nov 2018 20:27:58 +0100
Subject: [PATCH 1/3] MDL-63994 login: Clarify inline comments on
 loginpage_hook() usage

While working on the issue, I found these inline comments outdated and
confusing. The auth plugin types can implement a loginpage_hook()
method, the purpose of which is to inject the $user and/or $frm into
this login/index.php script. The new comments should make it more clear.

Note the second comment mentioned a prelogin_hook() which was an old
name of what is now called loginpage_hook(). It had nothing to do with
the existing pre_loginpage_hook() and was only confusing.
---
 login/index.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/login/index.php b/login/index.php
index d62d7e114d8..335a65e42d1 100644
--- a/login/index.php
+++ b/login/index.php
@@ -69,13 +69,13 @@ if (!empty($SESSION->has_timed_out)) {
     $session_has_timed_out = false;
 }
 
-/// auth plugins may override these - SSO anyone?
 $frm  = false;
 $user = false;
 
 $authsequence = get_enabled_auth_plugins(true); // auths, in sequence
 foreach($authsequence as $authname) {
     $authplugin = get_auth_plugin($authname);
+    // The auth plugin's loginpage_hook() can eventually set $frm and/or $user.
     $authplugin->loginpage_hook();
 }
 
@@ -134,7 +134,7 @@ if ($frm and isset($frm->username)) {                             // Login WITH
     }
 
     if ($user) {
-        //user already supplied by aut plugin prelogin hook
+        // The auth plugin has already provided the user via the loginpage_hook() called above.
     } else if (($frm->username == 'guest') and empty($CFG->guestloginbutton)) {
         $user = false;    /// Can't log in as guest if guest button is disabled
         $frm = false;

From e4a97a7a0103b3fd5af1b1205d53082d9ede7531 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Mudr=C3=A1k?= <david@moodle.com>
Date: Thu, 15 Nov 2018 20:35:46 +0100
Subject: [PATCH 2/3] MDL-63994 login: Improve the logintoken param input

The logintoken is supposed to arrive as a part of the login form ($frm)
together with the username and password. So it should be handled the
same way - including the opportunity for the auth plugins to provide the
form data via the loginpage_hook().

This also implies that only logintoken coming as a part of the POST
request are taken into account, which is a good thing and another thin
layer in this security mechanism.
---
 login/index.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/login/index.php b/login/index.php
index 335a65e42d1..a04970acfff 100644
--- a/login/index.php
+++ b/login/index.php
@@ -31,7 +31,6 @@ redirect_if_major_upgrade_required();
 
 $testsession = optional_param('testsession', 0, PARAM_INT); // test session works properly
 $anchor      = optional_param('anchor', '', PARAM_RAW);      // Used to restore hash anchor to wantsurl.
-$logintoken  = optional_param('logintoken', '', PARAM_RAW);       // Used to validate the request.
 
 $resendconfirmemail = optional_param('resendconfirmemail', false, PARAM_BOOL);
 
@@ -140,6 +139,7 @@ if ($frm and isset($frm->username)) {                             // Login WITH
         $frm = false;
     } else {
         if (empty($errormsg)) {
+            $logintoken = isset($frm->logintoken) ? $frm->logintoken : '';
             $user = authenticate_user_login($frm->username, $frm->password, false, $errorcode, $logintoken);
         }
     }

From c7d33da3051d1d777287e5691f5db89f87ba6047 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Mudr=C3=A1k?= <david@moodle.com>
Date: Thu, 15 Nov 2018 20:44:03 +0100
Subject: [PATCH 3/3] MDL-63994 auth_cas: Include the login token in the
 simulated login form

The CAS login process relies on the standard authenticate_user_login()
call to set up the user. So we need to inject the login token to pass
the validation.
---
 auth/cas/auth.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/auth/cas/auth.php b/auth/cas/auth.php
index d94c3965ba6..5eb84340d74 100644
--- a/auth/cas/auth.php
+++ b/auth/cas/auth.php
@@ -154,6 +154,7 @@ class auth_plugin_cas extends auth_plugin_ldap {
             $frm = new stdClass();
             $frm->username = phpCAS::getUser();
             $frm->password = 'passwdCas';
+            $frm->logintoken = \core\session\manager::get_login_token();
 
             // Redirect to a course if multi-auth is activated, authCAS is set to CAS and the courseid is specified.
             if ($this->config->multiauth && !empty($courseid)) {
@@ -167,6 +168,7 @@ class auth_plugin_cas extends auth_plugin_ldap {
             $frm = new stdClass();
             $frm->username = 'guest';
             $frm->password = 'guest';
+            $frm->logintoken = \core\session\manager::get_login_token();
             return;
         }