From cc3828c85a09bce1ea990f98cacc410a43c00d4f Mon Sep 17 00:00:00 2001 From: David Woloszyn Date: Fri, 14 Apr 2023 16:47:41 +1000 Subject: [PATCH] MDL-77840 mnet: Avoid passing nulls to base64_encode --- lang/en/error.php | 2 ++ mnet/lib.php | 13 ++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/lang/en/error.php b/lang/en/error.php index 4d7cde810cc..2faf5302ead 100644 --- a/lang/en/error.php +++ b/lang/en/error.php @@ -495,6 +495,8 @@ $string['onlyadmins'] = 'Only administrators can do that'; $string['onlyeditingteachers'] = 'Only editing teachers can do that'; $string['onlyeditown'] = 'You can only edit your own information'; $string['orderidnotfound'] = 'Order ID {$a} not found'; +$string['opensslsignerror'] = 'OpenSSL unable to sign data'; +$string['opensslsealerror'] = 'OpenSSL unable to seal data'; $string['pagenotexisttitle'] = '404 Error: File not found'; $string['pagenotexist'] = '

An unusual error occurred trying to view a page that does not exist:

{$a}'; $string['pathdoesnotstartslash'] = 'No valid arguments supplied, path does not start with slash!'; diff --git a/mnet/lib.php b/mnet/lib.php index d106ce18418..c5f106ea786 100644 --- a/mnet/lib.php +++ b/mnet/lib.php @@ -216,7 +216,12 @@ function mnet_sign_message($message, $privatekey = null) { // The '$sig' value below is returned by reference. // We initialize it first to stop my IDE from complaining. $sig = ''; - $bool = openssl_sign($message, $sig, $privatekey); // TODO: On failure? + $bool = openssl_sign($message, $sig, $privatekey); + + // Avoid passing null values to base64_encode. + if ($bool === false) { + throw new \moodle_exception('opensslsignerror'); + } $message = ' @@ -283,6 +288,12 @@ function mnet_encrypt_message($message, $remote_certificate) { // passed by ref -> &$encryptedstring &$symmetric_keys $bool = openssl_seal($message, $encryptedstring, $symmetric_keys, array($publickey), 'RC4'); + + // Avoid passing null values to base64_encode. + if ($bool === false) { + throw new \moodle_exception('opensslsealerror'); + } + $message = $encryptedstring; $symmetrickey = array_pop($symmetric_keys);