L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

portfolio: MDL-19358 and MDL-19354 added sesskey() protection when first initating a portfolio export; verify callback class is part of the portfolio_caller_base hierarchy; re-check permissions in the caller when waking up the portfolio exporter object (between requests)

Browse Source
This commit is contained in:
mjollnir_
2009-06-01 17:06:28 +00:00
parent 0d1bd00d48
commit 766d61cbb8
3 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/portfolio/exporter.php
+4
View File
@@ -676,6 +676,10 @@ class portfolio_exporter {
if (!$readonly && !confirm_sesskey($this->get('sesskey'))) {
throw new portfolio_exception('confirmsesskeybad');
}
if (!$this->caller->check_permissions()) {
throw new portfolio_caller_exception('nopermissions', 'portfolio', $this->caller->get_return_url());
}
error_log("checking permissions after waking");
}
/**
* copies a file from somewhere else in moodle
lib/portfoliolib.php
+2
View File
@@ -224,6 +224,8 @@ class portfolio_add_button {
$linkoutput .= 'ca_' . $key . '=' . $value . '&';
$formoutput .= "\n" . '<input type="hidden" name="ca_' . $key . '" value="' . $value . '" />';
}
$formoutput .= "\n" . '<input type="hidden" name="sesskey" value="' . sesskey() . '" />';
$linkoutput .= 'sesskey=' . sesskey() . '&amp;';
$formoutput .= "\n" . '<input type="hidden" name="callbackfile" value="' . $this->callbackfile . '" />';
$formoutput .= "\n" . '<input type="hidden" name="callbackclass" value="' . $this->callbackclass . '" />';
$formoutput .= "\n" . '<input type="hidden" name="course" value="' . (!empty($COURSE) ? $COURSE->id : 0) . '" />';
portfolio/add.php
+6
View File
@@ -139,10 +139,16 @@ if (!empty($dataid)) {
$callbackargs[substr($key, 3)] = $value;
}
}
if (!confirm_sesskey()) {
throw new portfolio_caller_exception('confirmsesskeybad', 'error');
}
// righto, now we have the callback args set up
// load up the caller file and class and tell it to set up all the data
// it needs
require_once($CFG->dirroot . $callbackfile);
if (!class_exists($callbackclass) || !is_subclass_of($callbackclass, 'portfolio_caller_base')) {
throw new portfolio_caller_exception('callbackclassinvalid', 'portfolio');
}
$caller = new $callbackclass($callbackargs);
$caller->set('user', $USER);
$caller->load_data();