From f779e204acfb4e546d4ef2f995c4839badbdae1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Mudr=C3=A1k?= Date: Thu, 15 Nov 2018 20:35:46 +0100 Subject: [PATCH] MDL-63994 login: Improve the logintoken param input The logintoken is supposed to arrive as a part of the login form ($frm) together with the username and password. So it should be handled the same way - including the opportunity for the auth plugins to provide the form data via the loginpage_hook(). This also implies that only logintoken coming as a part of the POST request are taken into account, which is a good thing and another thin layer in this security mechanism. --- login/index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/login/index.php b/login/index.php index 995fa98bed4..b502ede141d 100644 --- a/login/index.php +++ b/login/index.php @@ -31,7 +31,6 @@ redirect_if_major_upgrade_required(); $testsession = optional_param('testsession', 0, PARAM_INT); // test session works properly $anchor = optional_param('anchor', '', PARAM_RAW); // Used to restore hash anchor to wantsurl. -$logintoken = optional_param('logintoken', '', PARAM_RAW); // Used to validate the request. $context = context_system::instance(); $PAGE->set_url("$CFG->wwwroot/login/index.php"); @@ -138,6 +137,7 @@ if ($frm and isset($frm->username)) { // Login WITH $frm = false; } else { if (empty($errormsg)) { + $logintoken = isset($frm->logintoken) ? $frm->logintoken : ''; $user = authenticate_user_login($frm->username, $frm->password, false, $errorcode, $logintoken); } }