From e404da07d41ed8de6dfa7e5ba3d3f65b692a57e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= Date: Fri, 27 Sep 2013 10:51:13 +0200 Subject: [PATCH] MDL-41999 do not use $USER->password directly --- calendar/export.php | 2 +- calendar/view.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/calendar/export.php b/calendar/export.php index 14262717aa9..462f35eae26 100644 --- a/calendar/export.php +++ b/calendar/export.php @@ -125,7 +125,7 @@ switch($action) { $weekend = intval($CFG->calendar_weekend); } - $authtoken = sha1($USER->id . $USER->password . $CFG->calendar_exportsalt); + $authtoken = sha1($USER->id . $DB->get_field('user', 'password', array('id'=>$USER->id)). $CFG->calendar_exportsalt); // Let's populate some vars to let "common tasks" be somewhat smart... // If today it's weekend, give the "next week" option $allownextweek = $weekend & (1 << $now['wday']); diff --git a/calendar/view.php b/calendar/view.php index 40a2d82a135..73e5924e89d 100644 --- a/calendar/view.php +++ b/calendar/view.php @@ -153,7 +153,7 @@ if (!empty($CFG->enablecalendarexport)) { echo $OUTPUT->single_button(new moodle_url('/calendar/managesubscriptions.php', array('course'=>$courseid)), get_string('managesubscriptions', 'calendar')); } if (isloggedin()) { - $authtoken = sha1($USER->id . $USER->password . $CFG->calendar_exportsalt); + $authtoken = sha1($USER->id . $DB->get_field('user', 'password', array('id'=>$USER->id)) . $CFG->calendar_exportsalt); $link = new moodle_url('/calendar/export_execute.php', array('preset_what'=>'all', 'preset_time'=>'recentupcoming', 'userid' => $USER->id, 'authtoken'=>$authtoken)); $icon = html_writer::empty_tag('img', array('src'=>$OUTPUT->pix_url('i/ical'), 'height'=>'14', 'width'=>'36', 'alt'=>get_string('ical', 'calendar'), 'title'=>get_string('quickdownloadcalendar', 'calendar'))); echo html_writer::tag('a', $icon, array('href'=>$link));