From bd83aa0cd6c85f00d0215d67e868994f241e21ee Mon Sep 17 00:00:00 2001
From: Simey Lameze <simey@moodle.com>
Date: Thu, 6 Jul 2017 10:37:59 +0800
Subject: [PATCH] MDL-59456 auth_cas: patch phpCAS auth bypass vulnerability

---
 auth/cas/CAS/CAS/Client.php    | 24 ++++++++++++------------
 auth/cas/CAS/moodle_readme.txt |  1 +
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/auth/cas/CAS/CAS/Client.php b/auth/cas/CAS/CAS/Client.php
index 7282e2883d0..9965a706ee4 100644
--- a/auth/cas/CAS/CAS/Client.php
+++ b/auth/cas/CAS/CAS/Client.php
@@ -3187,6 +3187,18 @@ class CAS_Client
                 false/*$no_response*/, true/*$bad_response*/, $text_response
             );
             $result = false;
+        } else if ( $tree_response->getElementsByTagName("authenticationFailure")->length != 0) {
+            // authentication failed, extract the error code and message and throw exception
+            $auth_fail_list = $tree_response
+                ->getElementsByTagName("authenticationFailure");
+            throw new CAS_AuthenticationException(
+                $this, 'Ticket not validated', $validate_url,
+                false/*$no_response*/, false/*$bad_response*/,
+                $text_response,
+                $auth_fail_list->item(0)->getAttribute('code')/*$err_code*/,
+                trim($auth_fail_list->item(0)->nodeValue)/*$err_msg*/
+            );
+            $result = false;
         } else if ($tree_response->getElementsByTagName("authenticationSuccess")->length != 0) {
             // authentication succeded, extract the user name
             $success_elements = $tree_response
@@ -3227,18 +3239,6 @@ class CAS_Client
                     $result = true;
                 }
             }
-        } else if ( $tree_response->getElementsByTagName("authenticationFailure")->length != 0) {
-            // authentication succeded, extract the error code and message
-            $auth_fail_list = $tree_response
-                ->getElementsByTagName("authenticationFailure");
-            throw new CAS_AuthenticationException(
-                $this, 'Ticket not validated', $validate_url,
-                false/*$no_response*/, false/*$bad_response*/,
-                $text_response,
-                $auth_fail_list->item(0)->getAttribute('code')/*$err_code*/,
-                trim($auth_fail_list->item(0)->nodeValue)/*$err_msg*/
-            );
-            $result = false;
         } else {
             throw new CAS_AuthenticationException(
                 $this, 'Ticket not validated', $validate_url,
diff --git a/auth/cas/CAS/moodle_readme.txt b/auth/cas/CAS/moodle_readme.txt
index e0d726dda7b..39fe6eaa3d8 100644
--- a/auth/cas/CAS/moodle_readme.txt
+++ b/auth/cas/CAS/moodle_readme.txt
@@ -2,3 +2,4 @@ Description of phpCAS 1.3.4 library import
 
 * downloaded from http://downloads.jasig.org/cas-clients/php/current/
 
+* MDL-59456 phpCAS library has been patched because of an authentication bypass security vulnerability.