L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-86326 auth: Enhance validation logic in resend_confirmation_email

Browse Source
This commit is contained in:
yusufwib01
2025-12-03 03:14:20 +00:00
committed by Jenkins
parent 545f94bbbc
commit 6d2eefe372
2 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/classes/external.php
+13 -6
View File
@@ -370,7 +370,7 @@ class core_auth_external extends external_api {
* @throws moodle_exception
*/
public static function resend_confirmation_email($username, $password, $redirect = '') {
global $PAGE;
global $PAGE, $CFG;
$warnings = array();
$params = self::validate_parameters(
@@ -387,20 +387,27 @@ class core_auth_external extends external_api {
$username = trim(core_text::strtolower($params['username']));
$password = $params['password'];
$user = core_user::get_user_by_username($username);
if (!empty($user) && $user->confirmed) {
if (!empty($CFG->protectusernames)) {
throw new moodle_exception('invalidlogin');
}
throw new moodle_exception('alreadyconfirmed');
}
if (is_restored_user($username)) {
if (!empty($CFG->protectusernames)) {
throw new moodle_exception('invalidlogin');
}
throw new moodle_exception('restoredaccountresetpassword', 'webservice');
}
$user = authenticate_user_login($username, $password);
if (empty($user)) {
throw new moodle_exception('invalidlogin');
}
if ($user->confirmed) {
throw new moodle_exception('alreadyconfirmed');
}
// Check if we should redirect the user once the user is confirmed.
$confirmationurl = null;
if (!empty($params['redirect'])) {
auth/tests/external/external_test.php
Vendored
+9
View File
@@ -182,6 +182,7 @@ final class external_test extends externallib_advanced_testcase {
$this->assertTrue($result['success']);
$this->assertEmpty($result['warnings']);
set_config('protectusernames', 0);
$_SERVER['HTTP_USER_AGENT'] = 'no browser'; // Hack around missing user agent in CLI scripts.
$this->expectException('\moodle_exception');
$this->expectExceptionMessage('error/invalidlogin');
@@ -205,6 +206,7 @@ final class external_test extends externallib_advanced_testcase {
$this->assertTrue($result['success']);
$this->assertEmpty($result['warnings']);
set_config('protectusernames', 0);
$_SERVER['HTTP_USER_AGENT'] = 'no browser'; // Hack around missing user agent in CLI scripts.
$this->expectException('\moodle_exception');
$this->expectExceptionMessage('error/invalidlogin');
@@ -235,6 +237,13 @@ final class external_test extends externallib_advanced_testcase {
$result = external_api::clean_returnvalue(core_auth_external::confirm_user_returns(), $result);
$this->assertTrue($result['success']);
// Keep protectusernames enabled so the call returns invalidlogin exception.
$this->expectException('\moodle_exception');
$this->expectExceptionMessage('error/invalidlogin');
core_auth_external::resend_confirmation_email($username, $password);
// Now disable protectusernames and expect an exception.
set_config('protectusernames', 0);
$this->expectException('\moodle_exception');
$this->expectExceptionMessage('error/alreadyconfirmed');
core_auth_external::resend_confirmation_email($username, $password);