L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-47924 mod_lti: Fixing missing sesskey checkings

Browse Source 
Also fixing a missing capability checking.
This commit is contained in:
David Monllao
2014-11-04 11:00:51 +13:00
committed by Sam Hemelryk
parent d0053d29ed
commit babaf596e1
3 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/lti/instructor_edit_tool_type.php
+2
View File
@@ -36,6 +36,8 @@ $PAGE->set_pagelayout('popup');
$action = optional_param('action', null, PARAM_TEXT);
$typeid = optional_param('typeid', null, PARAM_INT);
require_sesskey();
require_capability('mod/lti:addcoursetool', context_course::instance($courseid));
if (!empty($typeid)) {
mod/lti/request_tool.php
+2
View File
@@ -36,6 +36,8 @@ $context = context_module::instance($cm->id);
require_login($course);
require_sesskey();
require_capability('mod/lti:requesttooladd', context_course::instance($lti->course));
$baseurl = lti_get_domain_from_url($lti->toolurl);
mod/lti/return.php
+12 -9
View File
@@ -74,21 +74,24 @@ if (!empty($errormsg)) {
echo htmlspecialchars($errormsg);
$canaddtools = has_capability('mod/lti:addcoursetool', context_course::instance($courseid));
if ($unsigned == 1) {
if ($unsigned == 1 && $canaddtools) {
$contextcourse = context_course::instance($courseid);
echo '<br /><br />';
$links = new stdClass();
$coursetooleditor = new moodle_url('/mod/lti/instructor_edit_tool_type.php',
array('course' => $courseid, 'action' => 'add'));
$links->course_tool_editor = $coursetooleditor->out(false);
echo get_string('lti_launch_error_unsigned_help', 'lti', $links);
if (has_capability('mod/lti:addcoursetool', $contextcourse)) {
$coursetooleditor = new moodle_url('/mod/lti/instructor_edit_tool_type.php',
array('course' => $courseid, 'action' => 'add', 'sesskey' => sesskey()));
$links->course_tool_editor = $coursetooleditor->out(false);
if (!empty($lti)) {
$adminrequesturl = new moodle_url('/mod/lti/request_tool.php', array('instanceid' => $lti->id));
echo get_string('lti_launch_error_unsigned_help', 'lti', $links);
}
if (!empty($lti) && has_capability('mod/lti:requesttooladd', $contextcourse)) {
$adminrequesturl = new moodle_url('/mod/lti/request_tool.php', array('instanceid' => $lti->id, 'sesskey' => sesskey()));
$links->admin_request_url = $adminrequesturl->out(false);
echo get_string('lti_launch_error_tool_request', 'lti', $links);
}
}