MDL-53832 enrol_lti: Only allow certain consumers for each shared tool

Original subtask: MDL-55753.

enrol/lti/classes/tool_provider.php

@@ -40,13 +40,18 @@ require_once($CFG->dirroot . '/user/lib.php');
  */
 class tool_provider extends ToolProvider\ToolProvider {
 
+    /**
+     * @var stdClass $tool The object representing the enrol instance providing this LTI tool
+     */
+    protected $tool;
+
     /**
      * Remove $this->baseUrl (wwwroot) from a given url string and return it.
      *
      * @param string $url The url from which to remove the base url
      * @return string|null A string of the relative path to the url, or null if it couldn't be determined.
      */
-    private function strip_base_url($url) {
+    protected function strip_base_url($url) {
         if (substr($url, 0, strlen($this->baseUrl)) == $this->baseUrl) {
             return substr($url, strlen($this->baseUrl));
         }
@@ -172,6 +177,33 @@ class tool_provider extends ToolProvider\ToolProvider {
     protected function onLaunch() {
         global $DB, $SESSION, $CFG;
 
+        $url = helper::get_launch_url($this->tool->id);
+        // If a tool proxy has been stored for the current consumer trying to access a tool,
+        // check that the tool is being launched from the correct url.
+        $correctlaunchurl = false;
+        if (!empty($this->consumer->toolProxy)) {
+            $proxy = json_decode($this->consumer->toolProxy);
+            $handlers = $proxy->tool_profile->resource_handler;
+            foreach ($handlers as $handler) {
+                foreach ($handler->message as $message) {
+                    $handlerurl = new \moodle_url($message->path);
+                    $fullpath = $handlerurl->out(false);
+                    if ($message->message_type == "basic-lti-launch-request" && $fullpath == $url) {
+                        $correctlaunchurl = true;
+                        break 2;
+                    }
+                }
+            }
+        } else if ($this->tool->secret == $this->consumer->secret) {
+            // Test if the LTI1 secret for this tool is being used. Then we know the correct tool is being launched.
+            $correctlaunchurl = true;
+        }
+        if (!$correctlaunchurl) {
+            $this->ok = false;
+            $this->message = get_string('invalidrequest', 'enrol_lti');
+            return;
+        }
+
         // Before we do anything check that the context is valid.
         $tool = $this->tool;
         $context = \context::instance_by_id($tool->contextid);

enrol/lti/tool.php

@@ -27,7 +27,7 @@ require_once(__DIR__ . '/../../config.php');
 $toolid = required_param('id', PARAM_INT);
 
 $PAGE->set_context(context_system::instance());
-$url = new moodle_url('/enrol/lti/tp.php');
+$url = new moodle_url('/enrol/lti/tool.php');
 $PAGE->set_url($url);
 $PAGE->set_pagelayout('popup');
 $PAGE->set_title(get_string('opentool', 'enrol_lti'));