L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-47924 mod_lti: Fixing missing sesskey checking

Browse Source 
Also fixing a missing capability checking.
This commit is contained in:
David Monllao
2014-11-04 10:54:06 +13:00
committed by Sam Hemelryk
parent 5a56067bb8
commit 48ea41c48f
3 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/lti/instructor_edit_tool_type.php
+2
View File
@@ -37,6 +37,8 @@ $PAGE->set_pagelayout('popup');
$action = optional_param('action', null, PARAM_TEXT);
$typeid = optional_param('typeid', null, PARAM_INT);
require_sesskey();
require_capability('mod/lti:addcoursetool', context_course::instance($courseid));
if (!empty($typeid)) {
mod/lti/request_tool.php
+2
View File
@@ -35,6 +35,8 @@ $course = $DB->get_record('course', array('id' => $lti->course));
require_login($course);
require_sesskey();
require_capability('mod/lti:requesttooladd', context_course::instance($lti->course));
$baseurl = lti_get_domain_from_url($lti->toolurl);
mod/lti/return.php
+15 -9
View File
@@ -61,21 +61,27 @@ if (!empty($errormsg)) {
echo htmlspecialchars($errormsg);
$canaddtools = has_capability('mod/lti:addcoursetool', context_course::instance($courseid));
if ($unsigned == 1) {
if ($unsigned == 1 && $canaddtools) {
echo '<br /><br />';
$links = new stdClass();
$coursetooleditor = new moodle_url('/mod/lti/instructor_edit_tool_type.php', array('course' => $courseid, 'action' => 'add'));
$links->course_tool_editor = $coursetooleditor->out(false);
$coursecontext = context_course::instance($courseid);
$adminrequesturl = new moodle_url('/mod/lti/request_tool.php', array('instanceid' => $instanceid));
$links->admin_request_url = $adminrequesturl->out(false);
if (has_capability('mod/lti:addcoursetool', $coursecontext)) {
$coursetooleditor = new moodle_url('/mod/lti/instructor_edit_tool_type.php',
array('course' => $courseid, 'action' => 'add', 'sesskey' => sesskey()));
$links->course_tool_editor = $coursetooleditor->out(false);
echo get_string('lti_launch_error_unsigned_help', 'lti', $links);
echo get_string('lti_launch_error_unsigned_help', 'lti', $links);
}
echo get_string('lti_launch_error_tool_request', 'lti', $links);
if (has_capability('mod/lti:requesttooladd', $coursecontext)) {
$adminrequesturl = new moodle_url('/mod/lti/request_tool.php',
array('instanceid' => $instanceid, 'sesskey' => sesskey()));
$links->admin_request_url = $adminrequesturl->out(false);
echo get_string('lti_launch_error_tool_request', 'lti', $links);
}
}
echo $OUTPUT->footer();