mirror/moodle-auth_outage
1
0
Fork 0
mirror of https://github.com/catalyst/moodle-auth_outage.git synced 2026-09-07 08:11:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bug fixes and improvements

Browse Source 
WR492688: Issue #32

Fix: the 'static' flag can no longer be set from a raw client value. It
is now only true if the request presents a 'statickey' matching an
HMAC-SHA256 of the outage id keyed with a per-site secret
(infopage::statickey(), lazily generated via set_config()/get_config()).
maintenance_static_page::create_from_outage() now sends that computed
statickey instead of static=1 when it internally fetches info.php, so
the legitimate static-generation path keeps working while external
forgery of the flag is no longer possible.

WR492688: Issue #33

WR492688: Version bump

fix
This commit is contained in:
vlad.kidanov
2026-07-20 14:58:28 +01:00
parent b5f02de0c5
commit a4ee55c83e
5 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classes/local/controllers/infopage.php
+23 -2
View File
@@ -53,10 +53,14 @@ class infopage {
$CFG->svgicons = true;
if (is_null($params)) {
$id = optional_param('id', null, PARAM_INT);
$params = [
'id' => optional_param('id', null, PARAM_INT),
'id' => $id,
'outage' => null,
'static' => optional_param('static', false, PARAM_BOOL),
'static' => !is_null($id) && hash_equals(
self::statickey($id),
optional_param('statickey', '', PARAM_ALPHANUM)
),
];
} else {
$defaults = [
@@ -145,4 +149,21 @@ class infopage {
$this->outage = $params['outage'];
$this->static = $params['static'];
}
/**
* Computes the secret token that proves a request to view an outage's static
* rendering came from this plugin's own static-page generator, not an external
* client forging the request. Used to gate the 'static' flag (see constructor).
*
* @param int $outageid
* @return string
*/
public static function statickey($outageid) {
$secret = get_config('auth_outage', 'staticsecret');
if (empty($secret)) {
$secret = random_string(64);
set_config('staticsecret', $secret, 'auth_outage');
}
return hash_hmac('sha256', (string)$outageid, $secret);
}
}
classes/local/controllers/maintenance_static_page.php
+2 -1
View File
@@ -50,7 +50,8 @@ class maintenance_static_page {
$html = '<html></html>';
} else {
$data = maintenance_static_page_io::file_get_data(
$CFG->wwwroot . '/auth/outage/info.php?auth_outage_hide_warning=1&static=1&id=' . $outage->id
$CFG->wwwroot . '/auth/outage/info.php?auth_outage_hide_warning=1&id=' . $outage->id
. '&statickey=' . infopage::statickey($outage->id)
);
$html = $data['contents'];
}