From 3daeecd3d2a2a6054de7325655599bb32ef8a7ee Mon Sep 17 00:00:00 2001 From: Sara Arjona Date: Wed, 9 Feb 2022 19:21:54 +0100 Subject: [PATCH] MDL-73827 lib: Fix URL blocked error for userinfo endpoint When the oAuth2 issuer hasn't any userinfo endpoint, a call to $this->get(false) was done, which was returning "The URL is blocked". This is a regression from MDL-70649, which added some cURL security checks. --- lib/classes/oauth2/client.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/classes/oauth2/client.php b/lib/classes/oauth2/client.php index bc2cd05a803..08661b9275b 100644 --- a/lib/classes/oauth2/client.php +++ b/lib/classes/oauth2/client.php @@ -487,9 +487,14 @@ class client extends \oauth2_client { * the fields back into moodle fields. * * @return array|false Moodle user fields for the logged in user (or false if request failed) + * @throws moodle_exception if the response is empty after decoding it. */ public function get_userinfo() { $url = $this->get_issuer()->get_endpoint_url('userinfo'); + if (empty($url)) { + return false; + } + $response = $this->get($url); if (!$response) { return false; @@ -501,6 +506,11 @@ class client extends \oauth2_client { return false; } + if (is_null($userinfo)) { + // Throw an exception displaying the original response, because, at this point, $userinfo shouldn't be empty. + throw new moodle_exception($response); + } + return $this->map_userinfo_to_fields($userinfo); }