Bug fixes and improvements

WR492688: Issue #32

Fix: the 'static' flag can no longer be set from a raw client value. It
is now only true if the request presents a 'statickey' matching an
HMAC-SHA256 of the outage id keyed with a per-site secret
(infopage::statickey(), lazily generated via set_config()/get_config()).
maintenance_static_page::create_from_outage() now sends that computed
statickey instead of static=1 when it internally fetches info.php, so
the legitimate static-generation path keeps working while external
forgery of the flag is no longer possible.

WR492688: Issue #33

WR492688: Version bump
This commit is contained in:
vlad.kidanov
2026-07-20 11:56:43 +01:00
parent a55678d2cb
commit c95a35aae5
5 changed files with 40 additions and 6 deletions
+2 -2
View File
@@ -28,8 +28,8 @@
defined('MOODLE_INTERNAL') || die();
$plugin->component = "auth_outage";
$plugin->version = 2024081906; // The current plugin version (Date: YYYYMMDDXX).
$plugin->release = 2024081906; // Human-readable release information.
$plugin->version = 2024081907; // The current plugin version (Date: YYYYMMDDXX).
$plugin->release = 2024081907; // Human-readable release information.
$plugin->requires = 2017111309; // 2017111309 = T13, but this really requires 3.9 and higher.
$plugin->maturity = MATURITY_STABLE; // Suitable for PRODUCTION environments!
$plugin->supported = [39, 405]; // A range of branch numbers of supported moodle versions.