MDL-77846 core: Make endpoint revision number checks stricter

In some places we prevented cache poisoning, in others we did not. We
also did not place any restriction on the minimum value for a revision.

This change introduces a new set of functions for configonly endpoints
which validates the revision numbers passed in. If the revision is
either too old, or too new, it is rejected and the file content is not
cached. The content is still served, but caching headers are not sent,
and any local storage caching is prevented.

The current time is used as the maximum version, with 60 seconds added
to allow for any clock skew between cluster nodes. Previously some
locations used one hour, but there should never be such a large clock
skew on a correctly configured system.

Co-authored-by: Andrew Nicols <[email protected]>

lib/javascript.php

@@ -47,6 +47,11 @@ if ($slashargument = min_get_slash_argument()) {
     $file = min_optional_param('jsfile', '', 'RAW'); // 'file' would collide with URL rewriting!
 }
 
+if (!min_is_revision_valid_and_current($rev)) {
+    // If the rev is invalid, normalise it to -1 to disable all caching.
+    $rev = -1;
+}
+
 // some security first - pick only files with .js extension in dirroot
 $jsfiles = array();
 $files = explode(',', $file);
@@ -79,8 +84,7 @@ if (!$jsfiles) {
 
 $etag = sha1($rev.implode(',', $jsfiles));
 
-// Use the caching only for meaningful revision numbers which prevents future cache poisoning.
-if ($rev > 0 and $rev < (time() + 60*60)) {
+if ($rev > 0) {
     $candidate = $CFG->localcachedir.'/js/'.$etag;
 
     if (file_exists($candidate)) {