mirror/moodle-auth_outage
1
0
Fork 0
mirror of https://github.com/catalyst/moodle-auth_outage.git synced 2026-09-07 00:06:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

WR #490867 auth_outage Review changes - add capability check to preview.php and escape outage title/description output in info page and renderer, validate access key parameter before use

Browse Source
This commit is contained in:
Waleed Hassan
2026-07-12 22:15:41 +01:00
parent 40fccef237
commit 675ec899f4
4 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classes/local/outagelib.php
+2 -2
View File
@@ -284,7 +284,7 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
require_once($CFG->dirroot.'/lib/classes/ip_utils.php');
}
// Put access key as a cookie if given. This stops the need to put it as a url param on every request.
$urlaccesskey = optional_param('accesskey', null, PARAM_TEXT);
$urlaccesskey = optional_param('accesskey', null, PARAM_ALPHANUM);
$isphpunit = defined('PHPUNIT_TEST');
if (!empty($urlaccesskey) && !$isphpunit) {
@@ -328,7 +328,7 @@ if ((time() >= {{STARTTIME}}) && (time() < {{STOPTIME}})) {
}
if ({{USEACCESSKEY}} && $accesskeyblocked) {
echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: '. $useraccesskey .' -->';
echo '<!-- auth_outage blocked by missing or incorrect access key, access key given: ' . htmlspecialchars($useraccesskey ?? '', ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
}
if (!$isphpunit) {
classes/output/renderer.php
+2 -2
View File
@@ -187,8 +187,8 @@ class renderer extends plugin_renderer_base {
$outagehtml = html_writer::div(
html_writer::tag(
'blockquote',
html_writer::div(html_writer::tag('b', $outage->get_title(), ['data-id' => $outage->id])) .
html_writer::div(html_writer::tag('i', $outage->get_description())) .
html_writer::div(html_writer::tag('b', format_string($outage->get_title()), ['data-id' => $outage->id])) .
html_writer::div(html_writer::tag('i', format_text($outage->get_description(), FORMAT_HTML))) .
html_writer::div(
html_writer::tag('b', get_string('tableheaderwarnbefore', 'auth_outage') . ': ') .
format_time($outage->get_warning_duration())
preview.php
+2
View File
@@ -31,6 +31,8 @@ use auth_outage\local\controllers\maintenance_static_page;
// @codingStandardsIgnoreStart
require_once(__DIR__.'/../../config.php');
// @codingStandardsIgnoreEnd
require_once($CFG->libdir . '/adminlib.php');
admin_externalpage_setup('auth_outage_manage');
$id = optional_param('id', null, PARAM_INT);
$outage = is_null($id) ? outagedb::get_next_starting() : outagedb::get_by_id($id);
if (is_null($outage)) {
views/info/content.php
+1 -1
View File
@@ -39,7 +39,7 @@ defined('MOODLE_INTERNAL') || die();
<b><?php echo get_string('infountil', 'auth_outage'); ?></b>
<?php echo userdate($viewbag['outage']->stoptime, get_string('datetimeformat', 'auth_outage')); ?>
</div>
<div class="auth_outage_info_description"><?php echo $viewbag['outage']->get_description(); ?></div>
<div class="auth_outage_info_description"><?php echo format_text($viewbag['outage']->get_description(), FORMAT_HTML); ?></div>
<?php if ($viewbag['admin']) : ?>
<?php