From b3424d620d0a5bef7aade9e037ae7ad4a80fbdb0 Mon Sep 17 00:00:00 2001
From: David Woloszyn <david.woloszyn@moodle.com>
Date: Tue, 2 May 2023 11:34:13 +1000
Subject: [PATCH] MDL-77840 enrol_lti: Avoid passing nulls to base64_encode

---
 enrol/lti/ims-blti/OAuth.php         | 5 +++++
 enrol/lti/ims-blti/readme_moodle.txt | 1 +
 2 files changed, 6 insertions(+)

diff --git a/enrol/lti/ims-blti/OAuth.php b/enrol/lti/ims-blti/OAuth.php
index c1d00f594a0..abfe8434a59 100644
--- a/enrol/lti/ims-blti/OAuth.php
+++ b/enrol/lti/ims-blti/OAuth.php
@@ -148,6 +148,11 @@ class OAuthSignatureMethod_RSA_SHA1 extends OAuthSignatureMethod {
     // Sign using the key
     $ok = openssl_sign($base_string, $signature, $privatekeyid);
 
+    // Avoid passing null values to base64_encode.
+    if (!$ok) {
+      throw new OAuthException("OpenSSL unable to sign data");
+    }
+
     // TODO: Remove this block once PHP 8.0 becomes required.
     if (PHP_MAJOR_VERSION < 8) {
       // Release the key resource
diff --git a/enrol/lti/ims-blti/readme_moodle.txt b/enrol/lti/ims-blti/readme_moodle.txt
index c39dccfe599..fcd298b6d3b 100644
--- a/enrol/lti/ims-blti/readme_moodle.txt
+++ b/enrol/lti/ims-blti/readme_moodle.txt
@@ -6,3 +6,4 @@ In future releases we should look into using a supported library.
 2022-01-05 - MDL-73502 - Removed get_magic_quotes_gpc() use, was returning false since ages ago.
 2022-01-20 - MDL-73523 - Conditional openssl_free_key() use, deprecated by PHP 8.0
 2022-03-05 - MDL-73520 - replace deprecated php_errormsg with error_get_last(), deprecated by PHP 8.0
+2023-05-03 - MDL-77840 - Throw exception on openssl_sign to avoid null reaching base64_encode, deprecated by PHP 8.1