L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth/cas MDL-23645 CAS single sign-on module needs updating due to security issues

Browse Source 
Upgraded phpCAS to 1.1.2 and fixed https://issues.jasig.org/browse/PHPCAS-73 ,
as reported by Fred Woolard in MDL-23126 (the fix will be in upstream in the
next release)

Credit goes to Johan Reinalda.
This commit is contained in:
Inaki
2010-08-06 21:22:54 +00:00
parent d39ba35c34
commit 6328442a73
6 changed files with 1239 additions and 1092 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/cas/CAS/CAS.php
+692 -699
View File
File diff suppressed because it is too large Load Diff
auth/cas/CAS/CAS/PGTStorage/pgt-db.php
+28
View File
@@ -1,4 +1,32 @@
<?php
/*
* Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of the ESUP-Portail consortium & the JA-SIG
* Collaborative nor the names of its contributors may be used to endorse or
* promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* @file CAS/PGTStorage/pgt-db.php
auth/cas/CAS/CAS/PGTStorage/pgt-file.php
+27
View File
@@ -1,5 +1,32 @@
<?php
/*
* Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of the ESUP-Portail consortium & the JA-SIG
* Collaborative nor the names of its contributors may be used to endorse or
* promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* @file CAS/PGTStorage/pgt-file.php
* Basic class for PGT file storage
auth/cas/CAS/CAS/PGTStorage/pgt-main.php
+27
View File
@@ -1,5 +1,32 @@
<?php
/*
* Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of the ESUP-Portail consortium & the JA-SIG
* Collaborative nor the names of its contributors may be used to endorse or
* promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* @file CAS/PGTStorage/pgt-main.php
* Basic class for PGT storage
auth/cas/CAS/CAS/client.php
+462 -390
View File
File diff suppressed because it is too large Load Diff
auth/cas/CAS/CAS/domxml-php4-to-php5.php
+3 -3
View File
@@ -263,7 +263,7 @@ class php4DOMNode
return false;
}
}
function add_child($newnode) {return append_child($newnode);}
function add_child($newnode) {return $this->append_child($newnode);}
function add_namespace($uri,$prefix) {return false;}
function append_child($newnode) {return self::_newDOMElement($this->myDOMNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
function append_sibling($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
@@ -350,7 +350,7 @@ class php4DOMNode
foreach ($this->myDOMNode->childNodes as $n) $NewNode->appendChild($n->cloneNode(true));
$xpath=new DOMXPath($this->myDOMNode->ownerDocument);
$myDOMNodeList=$xpath->query('namespace::*[name()!="xml"]',$this->myDOMNode); //Add old namespaces
foreach ($myDOMNodeList as $n) $NewNode->setAttributeNS('http://www.w3.org/2000/xmlns/',$n->nodeName,$n->nodeValue);
foreach ($myDOMNodeList as $n) $NewNode->setAttributeNS('http://www.w3.org/2000/xmlns/',$n->nodeName,$n->nodeValue);
$this->myDOMNode->parentNode->replaceChild($NewNode,$this->myDOMNode);
$this->myDOMNode=$NewNode;
}
@@ -417,7 +417,7 @@ class php4DOMNodelist
public $value;
function php4DOMNodelist($aDOMNodelist,$aOwnerDocument)
{
if (!isset($aDOMNodelist)) return;
if (!isset($aDOMNodelist)) return;
elseif (is_object($aDOMNodelist)||is_array($aDOMNodelist))
{
if ($aDOMNodelist->length>0)