L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flash detection MDL-20841 Added sesskey checking to the environment script to prevent DoS to users (Thanks for the catch Petr!)

Browse Source
This commit is contained in:
Martin Dougiamas
2009-11-24 09:10:48 +00:00
parent 182951c6ad
commit 5459e76dd1
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/weblib.php
+3 -4
View File
@@ -2480,8 +2480,8 @@ function print_header ($title='', $heading='', $navigation='', $focus='',
}
define('HEADER_PRINTED', 'true');
/// Perform some browser environment checks
if (!empty($CFG->excludeoldflashclients) && empty($SESSION->flashversion)) { // Do a single check per session for the flash version
/// Perform a browser environment check for the flash version. Should only run once per login session.
if (isloggedin() && !empty($CFG->excludeoldflashclients) && empty($SESSION->flashversion)) {
// Unfortunately we can't use require_js here and keep it all clean in 1.9 ...
// require_js(array('yui_yahoo', 'yui_event', 'yui_connection', $CFG->httpswwwroot."/lib/swfobject/swfobject.js"));
$meta .= '<script type="text/javascript" src="'.$CFG->wwwroot.'/lib/yui/yahoo/yahoo-min.js"></script>';
@@ -2491,9 +2491,8 @@ function print_header ($title='', $heading='', $navigation='', $focus='',
$meta .=
"<script type=\"text/javascript\">\n".
" var flashversion = swfobject.getFlashPlayerVersion();\n".
" YAHOO.util.Connect.asyncRequest('GET','".$CFG->wwwroot."/login/environment.php?flashversion='+flashversion.major+'.'+flashversion.minor+'.'+flashversion.release);\n".
" YAHOO.util.Connect.asyncRequest('GET','".$CFG->wwwroot."/login/environment.php?sesskey=".sesskey()."&flashversion='+flashversion.major+'.'+flashversion.minor+'.'+flashversion.release);\n".
"</script>";
}
login/environment.php
+2
View File
@@ -5,6 +5,8 @@
require('../config.php');
require_sesskey();
if (!empty($SESSION)) {
if ($flashversion = optional_param('flashversion', false, PARAM_TEXT)) { // eg 10.0.32
$SESSION->flashversion = $flashversion;