L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-61742 messaging: Do not send messages from inactive providers

Browse Source 
Before this patch, we only checked that the given provider has been
configured in the user or system preferences. However, if the provider's
component is disabled, it does not even appear in these preferences.
Additionally, there was no check that the message / notification
provider is among providers allowed to be consumed by the recipient.

The patch checks that the message origin is among providers returned by
the message_get_providers_for_user() so disabled plugins can't act as
sources of messages and users can't receive messages from providers they
do not have capability for. This mitigates the risk of abusing a plugin
as a source of spam, for example.

Unit test is fixed and extended. When the $CFG->messaging is disabled,
no messages between users should be sent (I can't understand why the
unit test was written in an opposite way). Added assertions for the
raised debugging message.
This commit is contained in:
David Mudrák
2018-08-31 12:15:30 +02:00
parent 175b3708c9
commit 39d2c68856
4 changed files with 53 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/phpunit/tests/advanced_test.php
+7 -12
View File
@@ -516,21 +516,16 @@ class core_phpunit_advanced_testcase extends advanced_testcase {
$message3->smallmessage = 'small message';
$message3->notification = 0;
try {
message_send($message3);
$this->fail('coding expcetion expected if invalid component specified');
} catch (moodle_exception $e) {
$this->assertInstanceOf('coding_exception', $e);
}
$this->assertFalse(message_send($message3));
$this->assertDebuggingCalled('Attempt to send msg from a provider xxxx_yyyyy/instantmessage '.
'that is inactive or not allowed for the user id='.$user1->id);
$message3->component = 'moodle';
$message3->name = 'yyyyyy';
try {
message_send($message3);
$this->fail('coding expcetion expected if invalid name specified');
} catch (moodle_exception $e) {
$this->assertInstanceOf('coding_exception', $e);
}
$this->assertFalse(message_send($message3));
$this->assertDebuggingCalled('Attempt to send msg from a provider moodle/yyyyyy '.
'that is inactive or not allowed for the user id='.$user1->id);
message_send($message1);
$this->assertEquals(1, $sink->count());