From 48ea41c48f3dcf28fb40fe0b0a1f0c4c0453d34d Mon Sep 17 00:00:00 2001 From: David Monllao Date: Wed, 29 Oct 2014 14:30:19 +0800 Subject: [PATCH] MDL-47924 mod_lti: Fixing missing sesskey checking Also fixing a missing capability checking. --- mod/lti/instructor_edit_tool_type.php | 2 ++ mod/lti/request_tool.php | 2 ++ mod/lti/return.php | 24 +++++++++++++++--------- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/mod/lti/instructor_edit_tool_type.php b/mod/lti/instructor_edit_tool_type.php index 3a700512f16..06a08ccc6f4 100644 --- a/mod/lti/instructor_edit_tool_type.php +++ b/mod/lti/instructor_edit_tool_type.php @@ -37,6 +37,8 @@ $PAGE->set_pagelayout('popup'); $action = optional_param('action', null, PARAM_TEXT); $typeid = optional_param('typeid', null, PARAM_INT); +require_sesskey(); + require_capability('mod/lti:addcoursetool', context_course::instance($courseid)); if (!empty($typeid)) { diff --git a/mod/lti/request_tool.php b/mod/lti/request_tool.php index daf664c596a..5dd77c2282c 100644 --- a/mod/lti/request_tool.php +++ b/mod/lti/request_tool.php @@ -35,6 +35,8 @@ $course = $DB->get_record('course', array('id' => $lti->course)); require_login($course); +require_sesskey(); + require_capability('mod/lti:requesttooladd', context_course::instance($lti->course)); $baseurl = lti_get_domain_from_url($lti->toolurl); diff --git a/mod/lti/return.php b/mod/lti/return.php index 1ad5b3c19a7..e896c7ee14c 100644 --- a/mod/lti/return.php +++ b/mod/lti/return.php @@ -61,21 +61,27 @@ if (!empty($errormsg)) { echo htmlspecialchars($errormsg); - $canaddtools = has_capability('mod/lti:addcoursetool', context_course::instance($courseid)); + if ($unsigned == 1) { - if ($unsigned == 1 && $canaddtools) { echo '

'; - $links = new stdClass(); - $coursetooleditor = new moodle_url('/mod/lti/instructor_edit_tool_type.php', array('course' => $courseid, 'action' => 'add')); - $links->course_tool_editor = $coursetooleditor->out(false); + $coursecontext = context_course::instance($courseid); - $adminrequesturl = new moodle_url('/mod/lti/request_tool.php', array('instanceid' => $instanceid)); - $links->admin_request_url = $adminrequesturl->out(false); + if (has_capability('mod/lti:addcoursetool', $coursecontext)) { + $coursetooleditor = new moodle_url('/mod/lti/instructor_edit_tool_type.php', + array('course' => $courseid, 'action' => 'add', 'sesskey' => sesskey())); + $links->course_tool_editor = $coursetooleditor->out(false); - echo get_string('lti_launch_error_unsigned_help', 'lti', $links); + echo get_string('lti_launch_error_unsigned_help', 'lti', $links); + } - echo get_string('lti_launch_error_tool_request', 'lti', $links); + if (has_capability('mod/lti:requesttooladd', $coursecontext)) { + $adminrequesturl = new moodle_url('/mod/lti/request_tool.php', + array('instanceid' => $instanceid, 'sesskey' => sesskey())); + $links->admin_request_url = $adminrequesturl->out(false); + + echo get_string('lti_launch_error_tool_request', 'lti', $links); + } } echo $OUTPUT->footer();