mirror/moodle-auth_outage
1
0
Fork 0
mirror of https://github.com/catalyst/moodle-auth_outage.git synced 2026-09-07 08:11:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bug fixes and improvements

Browse Source 
WR492688: Issue #32

Fix: the 'static' flag can no longer be set from a raw client value. It
is now only true if the request presents a 'statickey' matching an
HMAC-SHA256 of the outage id keyed with a per-site secret
(infopage::statickey(), lazily generated via set_config()/get_config()).
maintenance_static_page::create_from_outage() now sends that computed
statickey instead of static=1 when it internally fetches info.php, so
the legitimate static-generation path keeps working while external
forgery of the flag is no longer possible.

WR492688: Issue #33

WR492688: Version bump

Bug fixes and improvements

WR492688: Issue #32

Fix: the 'static' flag can no longer be set from a raw client value. It
is now only true if the request presents a 'statickey' matching an
HMAC-SHA256 of the outage id keyed with a per-site secret
(infopage::statickey(), lazily generated via set_config()/get_config()).
maintenance_static_page::create_from_outage() now sends that computed
statickey instead of static=1 when it internally fetches info.php, so
the legitimate static-generation path keeps working while external
forgery of the flag is no longer possible.

WR492688: Issue #33

WR492688: Version bump

fix
This commit is contained in:
vlad.kidanov
2026-07-20 14:51:01 +01:00
parent 85d0657563
commit a093165caf
5 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
views/info/content.php
+9 -1
View File
@@ -39,7 +39,15 @@ defined('MOODLE_INTERNAL') || die();
<b><?php echo get_string('infountil', 'auth_outage'); ?></b>
<?php echo userdate($viewbag['outage']->stoptime, get_string('datetimeformat', 'auth_outage')); ?>
</div>
<div class="auth_outage_info_description"><?php echo $viewbag['outage']->get_description(); ?></div>
<div class="auth_outage_info_description">
<?php
echo format_text(
$viewbag['outage']->get_description(),
FORMAT_HTML,
['context' => context_system::instance()]
);
?>
</div>
<?php if ($viewbag['admin']) : ?>
<?php