From de7ec71ca4d206aa897d0e411057d40af48dcdb2 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Tue, 27 Feb 2024 20:21:37 +0000
Subject: [PATCH] MDL-80877 tool_mfa: protect logout process with sesskey
 check.

---
 admin/tool/mfa/auth.php                             | 13 +++++++++++++
 admin/tool/mfa/classes/output/renderer.php          |  1 +
 admin/tool/mfa/templates/verification_form.mustache |  1 +
 3 files changed, 15 insertions(+)

diff --git a/admin/tool/mfa/auth.php b/admin/tool/mfa/auth.php
index 52c64de1b62..5f439a4b044 100644
--- a/admin/tool/mfa/auth.php
+++ b/admin/tool/mfa/auth.php
@@ -42,7 +42,20 @@ $PAGE->set_title($pagetitle);
 
 // Logout if it was requested.
 $logout = optional_param('logout', false, PARAM_BOOL);
+$sesskey = optional_param('sesskey', '_none_', PARAM_RAW);
+
 if ($logout) {
+    if (!confirm_sesskey($sesskey)) {
+        echo $OUTPUT->header();
+        echo $OUTPUT->confirm(
+            get_string('logoutconfirm'),
+            new moodle_url($PAGE->url, ['logout' => 1, 'sesskey' => sesskey()]),
+            new moodle_url('/'),
+        );
+        echo $OUTPUT->footer();
+        die;
+    }
+
     if (!empty($SESSION->wantsurl)) {
         // If we have the wantsurl, we should redirect there, to keep it intact.
         $wantsurl = $SESSION->wantsurl;
diff --git a/admin/tool/mfa/classes/output/renderer.php b/admin/tool/mfa/classes/output/renderer.php
index 7b9e63d7555..90f9344835f 100644
--- a/admin/tool/mfa/classes/output/renderer.php
+++ b/admin/tool/mfa/classes/output/renderer.php
@@ -637,6 +637,7 @@ class renderer extends \plugin_renderer_base {
                 'hasadditionalfactors' => $hasadditionalfactors,
                 'additionalfactors' => $alladitionalfactors,
                 'authurl' => $authurl->out(),
+                'sesskey' => sesskey(),
                 'supportlink' => $this->get_support_link(),
                 'disablefactor' => $disablefactor
         ];
diff --git a/admin/tool/mfa/templates/verification_form.mustache b/admin/tool/mfa/templates/verification_form.mustache
index 53f76595bc6..09679115a0c 100644
--- a/admin/tool/mfa/templates/verification_form.mustache
+++ b/admin/tool/mfa/templates/verification_form.mustache
@@ -83,6 +83,7 @@
     <div class="d-flex justify-content-center">
         <form id="cancelmfa" method="POST" action="{{{authurl}}}">
             <input type="hidden" id="{{uniqid}}-logout" name="logout" value="true">
+            <input type="hidden" name="sesskey" value="{{sesskey}}">
             <input type="submit" class="btn btn-secondary"
                    name="cancelmfa" id="cancelmfa_button"
                    value="{{#str}} cancellogin, tool_mfa {{/str}}">