L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-70622 mod_lti: Prevent xss on lti 1.3 authentication script

Browse Source 
Without this, people can craft URLs that other users might use not realising
what they do - and as a XSS vulnerability, it could do any number of things the
clicking-user has access to do on the site.

Change-Id: I82adc71e8706d8929011b4b24523d5b62b8ccea1
This commit is contained in:
Adam Olley
2021-05-07 11:43:33 +08:00
committed by Jake Dallimore
parent 3482ce5f78
commit 752ad3d8eb
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/lti/auth.php
+7 -5
View File
@@ -68,12 +68,14 @@ if ($ok && ($loginhint !== $USER->id)) {
$ok = false;
$error = 'access_denied';
}
if ($ok) {
// If we're unable to load up config; we cannot trust the redirect uri for POSTing to.
if (empty($config)) {
throw new moodle_exception('invalidrequest', 'error');
} else {
$uris = array_map("trim", explode("\n", $config->lti_redirectionuris));
$ok = in_array($redirecturi, $uris);
if (!$ok) {
$error = 'invalid_request';
$desc = 'Unregistered redirect_uri ' . $redirecturi;
if (!in_array($redirecturi, $uris)) {
throw new moodle_exception('invalidrequest', 'error');
}
}
if ($ok) {