Revert "Fix URL is blocked message when not behind a proxy/load balancer"

This reverts commit 51db933862.

README.md

@@ -1,4 +1,4 @@
-[![ci](https://github.com/catalyst/moodle-auth_outage/actions/workflows/ci.yml/badge.svg?branch=MOODLE_39_STABLE)](https://github.com/catalyst/moodle-auth_outage/actions/workflows/ci.yml?branch=MOODLE_39_STABLE)
+[![ci](https://github.com/catalyst/moodle-auth_outage/actions/workflows/ci.yml/badge.svg?branch=MOODLE_501_STABLE)](https://github.com/catalyst/moodle-auth_outage/actions/workflows/ci.yml?branch=MOODLE_501_STABLE)
 
 # Moodle Outage manager plugin
 - [Moodle Outage manager plugin](#moodle-outage-manager-plugin)
@@ -42,9 +42,10 @@ need to manually add one extra plugin, please check:
 
 Moodle supported branches
 --------
-| Version     | Branch            | PHP  |
-|-------------|-------------------|------|
-| Moodle 3.9+ | MOODLE_39_STABLE  | 7.2+ |
+| Version        | Branch              | PHP  |
+|----------------|---------------------|------|
+| Moodle 5.1     | MOODLE_501_STABLE   | 8.2  |
+| Moodle 3.9-5.0 | MOODLE_39_STABLE    | 7.2+ |
 
 Totara supported branches
 --------

classes/local/controllers/infopage.php

@@ -53,14 +53,10 @@ class infopage {
         $CFG->svgicons = true;
 
         if (is_null($params)) {
-            $id = optional_param('id', null, PARAM_INT);
             $params = [
-                'id' => $id,
+                'id' => optional_param('id', null, PARAM_INT),
                 'outage' => null,
-                'static' => !is_null($id) && hash_equals(
-                    self::statickey($id),
-                    optional_param('statickey', '', PARAM_ALPHANUM)
-                ),
+                'static' => optional_param('static', false, PARAM_BOOL),
             ];
         } else {
             $defaults = [
@@ -156,21 +152,4 @@ class infopage {
         $this->outage = $params['outage'];
         $this->static = $params['static'];
     }
-
-    /**
-     * Computes the secret token that proves a request to view an outage's static
-     * rendering came from this plugin's own static-page generator, not an external
-     * client forging the request. Used to gate the 'static' flag (see constructor).
-     *
-     * @param int $outageid
-     * @return string
-     */
-    public static function statickey($outageid) {
-        $secret = get_config('auth_outage', 'staticsecret');
-        if (empty($secret)) {
-            $secret = random_string(64);
-            set_config('staticsecret', $secret, 'auth_outage');
-        }
-        return hash_hmac('sha256', (string)$outageid, $secret);
-    }
 }

classes/local/controllers/maintenance_static_page.php

@@ -56,8 +56,7 @@ class maintenance_static_page {
                 header('X-Outage-EndTime: ' . $outage->stoptime);
             }
             $data = maintenance_static_page_io::file_get_data(
-                $CFG->wwwroot . '/auth/outage/info.php?auth_outage_hide_warning=1&id=' . $outage->id
-                    . '&statickey=' . infopage::statickey($outage->id)
+                $CFG->wwwroot . '/auth/outage/info.php?auth_outage_hide_warning=1&static=1&id=' . $outage->id
             );
             $html = $data['contents'];
         }

classes/local/outagelib.php

@@ -253,7 +253,7 @@ class outagelib {
      * @param int    $stoptime   Outage stop time.
      * @param string $allowedips List of IPs allowed.
      * @param string|null $accesskey access key, or null if no access key set.
-     * @param string|null $metadata metadata to be added to the outage headers, or null if none.
+     * @param string|null $metadata Metadata to set in headers, or null if none.
      *
      * @return string
      * @throws invalid_parameter_exception
@@ -267,10 +267,6 @@ class outagelib {
         // single-quotes (and double for the sake of it) are present otherwise it would break the code.
         $allowedips = addslashes($allowedips);
 
-        // Escape the access key before substitution into the PHP literal to prevent
-        // code injection via a maliciously crafted access key value.
-        $accesskey = addslashes((string)$accesskey);
-
         $cookiesecure = is_moodle_cookie_secure();
 
         // Since Moodle 4.3 cookiehttponly is default to true and this CFG is not set.
@@ -349,9 +345,17 @@ EOT;
         $search = ['{{STARTTIME}}', '{{STOPTIME}}', '{{USEALLOWEDIPS}}', '{{ALLOWEDIPS}}', '{{USEACCESSKEY}}', '{{ACCESSKEY}}',
             '{{YOURIP}}', '{{COOKIESECURE}}', '{{COOKIEHTTPONLY}}', '{{METADATA}}'];
         // Note that var_export is required because (string) false == '', not 'false'.
-        $replace = [$starttime, $stoptime, var_export(!empty($allowedips), true), $allowedips, var_export(!empty($accesskey), true),
-            $accesskey, getremoteaddr('n/a'), var_export($cookiesecure, true),
-            var_export($cookiehttponly, true), var_export($metadata, true)];
+        $replace = [
+            $starttime,
+            $stoptime,
+            var_export(!empty($allowedips), true),
+            $allowedips,
+            var_export(!empty($accesskey), true),
+            $accesskey,
+            getremoteaddr('n/a'),
+            var_export($cookiesecure, true),
+            var_export($cookiehttponly, true),
+            var_export($metadata, true)];
         return str_replace($search, $replace, $code);
     }
 

classes/output/manage/base_table.php

@@ -64,41 +64,6 @@ class base_table extends flexible_table {
         $this->set_attribute('class', 'generaltable admintable');
     }
 
-    /**
-     * Displays a user by their fullname with a link to a profile.
-     * @param int $userid
-     * @return string HTML link to user profile
-     */
-    private function format_user(int $userid): string {
-        if ($userid == 0 || !$user = \core_user::get_user($userid)) {
-            return get_string('na', 'auth_outage');
-        }
-        $url = new moodle_url('/user/profile.php', ['id' => $userid]);
-        return html_writer::link($url, fullname($user));
-    }
-
-    /**
-     * Formats created by column.
-     * @param outage $outage
-     * @return string The user who created the outage.
-     */
-    protected function format_created(outage $outage): string {
-        return $this->format_user($outage->createdby);
-    }
-
-    /**
-     * Formats modified by column.
-     * @param outage $outage
-     * @return string The user who last modiifed the outage and the last modified time.
-     */
-    protected function format_modified(outage $outage): string {
-        $timestamp = html_writer::div(
-            userdate($outage->lastmodified, get_string('datetimeformat', 'auth_outage')),
-            'small text-muted'
-        );
-        return $this->format_user($outage->modifiedby) . $timestamp;
-    }
-
     /**
      * Create the action buttons HTML code for a specific outage.
      * @param outage $outage The outage to generate the buttons.

classes/output/manage/history_table.php

@@ -36,7 +36,7 @@ class history_table extends base_table {
     public function __construct() {
         parent::__construct();
 
-        $this->define_columns(['warning', 'starts', 'duration', 'durationactual', 'title', 'created', 'modified', 'actions']);
+        $this->define_columns(['warning', 'starts', 'durationplanned', 'durationactual', 'title', 'actions']);
 
         $this->define_headers([
                 get_string('tableheaderwarnbefore', 'auth_outage'),
@@ -44,8 +44,6 @@ class history_table extends base_table {
                 get_string('tableheaderdurationplanned', 'auth_outage'),
                 get_string('tableheaderdurationactual', 'auth_outage'),
                 get_string('tableheadertitle', 'auth_outage'),
-                get_string('tableheadercreatedby', 'auth_outage'),
-                get_string('tableheadermodifiedby', 'auth_outage'),
                 get_string('actions'),
             ]);
 
@@ -66,8 +64,6 @@ class history_table extends base_table {
                 format_time($outage->get_duration_planned()),
                 $finished,
                 $outage->get_title(),
-                $this->format_created($outage),
-                $this->format_modified($outage),
                 $this->create_data_buttons($outage, false),
             ]);
         }

classes/output/manage/planned_table.php

@@ -38,15 +38,13 @@ class planned_table extends base_table {
     public function __construct() {
         parent::__construct();
 
-        $this->define_columns(['warning', 'starts', 'duration', 'title', 'created', 'modified', 'actions']);
+        $this->define_columns(['warning', 'starts', 'duration', 'title', 'actions']);
 
         $this->define_headers([
             get_string('tableheaderwarnbefore', 'auth_outage'),
             get_string('tableheaderstarttime', 'auth_outage'),
             get_string('tableheaderduration', 'auth_outage'),
             get_string('tableheadertitle', 'auth_outage'),
-            get_string('tableheadercreatedby', 'auth_outage'),
-            get_string('tableheadermodifiedby', 'auth_outage'),
             get_string('actions'),
         ]);
 
@@ -70,8 +68,6 @@ class planned_table extends base_table {
                 self::create_starttime_string($outage->starttime),
                 format_time($outage->get_duration_planned()),
                 $title,
-                $this->format_created($outage),
-                $this->format_modified($outage),
                 $this->create_data_buttons($outage, true),
             ]);
         }

db/upgrade.php

@@ -61,7 +61,7 @@ function xmldb_auth_outage_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2024081900, 'auth', 'outage');
     }
 
-    if ($oldversion < 2024081901) {
+    if ($oldversion < 2026011301) {
         // Define field metadata to be added to auth_outage.
         $table = new xmldb_table('auth_outage');
         $field = new xmldb_field('metadata', XMLDB_TYPE_TEXT, null, null, null, null, null, 'accesskey');
@@ -72,10 +72,10 @@ function xmldb_auth_outage_upgrade($oldversion) {
         }
 
         // Outage savepoint reached.
-        upgrade_plugin_savepoint(true, 2024081901, 'auth', 'outage');
+        upgrade_plugin_savepoint(true, 2026011301, 'auth', 'outage');
     }
 
-    if ($oldversion < 2024081902) {
+    if ($oldversion < 2026011302) {
         // Getting the table auth_outage and target field to remove from the table.
         $table = new xmldb_table('auth_outage');
         $field = new xmldb_field('autostart');
@@ -89,7 +89,7 @@ function xmldb_auth_outage_upgrade($oldversion) {
         unset_config('default_autostart', 'auth_outage');
 
         // Outage savepoint reached.
-        upgrade_plugin_savepoint(true, 2024081902, 'auth', 'outage');
+        upgrade_plugin_savepoint(true, 2026011302, 'auth', 'outage');
     }
 
     return true;

edit.php

@@ -28,7 +28,6 @@ use auth_outage\form\outage\edit;
 use auth_outage\local\outage;
 use auth_outage\local\outagelib;
 
-
 require_once(__DIR__ . '/../../config.php');
 require_once($CFG->libdir . '/adminlib.php');
 require_once($CFG->libdir . '/formslib.php');

lang/en/auth_outage.php

@@ -141,6 +141,7 @@ $string['outagefinishwarning'] = 'You are about to mark this outage as finished.
 $string['outageslistfuture'] = 'Planned outages';
 $string['outageslistpast'] = 'Outage history';
 $string['pluginname'] = 'Outage manager';
+$string["privacy:no_data_reason"] = "The Outage authentication plugin does not store any personal data.";
 $string['removeselectors'] = 'Remove selectors';
 $string['removeselectorsdescription'] = 'CSS selectors to remove when rendering a static themed maintenance page. One selector per line.';
 $string['settingssectiondefaults'] = 'Default Outage Parameters';
@@ -149,11 +150,9 @@ $string['settingssectionplugin'] = 'Plugin Configuration';
 $string['settingssectionplugindescription'] = 'General outage management plugin settings.';
 $string['starttime'] = 'Start date and time';
 $string['starttime_help'] = 'At which date and time the outage starts, preventing general access to the system.';
-$string['tableheadercreatedby'] = 'Created by';
 $string['tableheaderduration'] = 'Duration';
 $string['tableheaderdurationactual'] = 'Actual duration';
 $string['tableheaderdurationplanned'] = 'Planned duration';
-$string['tableheadermodifiedby'] = 'Last modified by';
 $string['tableheaderstartedtime'] = 'Started on';
 $string['tableheaderstarttime'] = 'Starts on';
 $string['tableheadertitle'] = 'Title';
@@ -172,8 +171,3 @@ $string['warningduration'] = 'Warning duration';
 $string['warningduration_help'] = 'How long before the start of the outage should the warning be displayed.';
 $string['warningdurationerrorinvalid'] = 'Warning duration must be positive.';
 $string['warningreenablemaintenancemode'] = 'Please note that saving this outage will re-enable maintenance mode.<br />Untick "Auto start maintenance mode" if you want to prevent this.';
-
-/*
- * Privacy provider (GDPR)
- */
-$string["privacy:no_data_reason"] = "The Outage authentication plugin does not store any personal data.";

preview.php

@@ -30,11 +30,7 @@ use auth_outage\local\controllers\maintenance_static_page;
 
 // @codingStandardsIgnoreStart
 require_once(__DIR__.'/../../config.php');
-require_once($CFG->libdir . '/adminlib.php');
 // @codingStandardsIgnoreEnd
-
-admin_externalpage_setup('auth_outage_manage');
-
 $id = optional_param('id', null, PARAM_INT);
 $outage = is_null($id) ? outagedb::get_next_starting() : outagedb::get_by_id($id);
 if (is_null($outage)) {

tests/local/cli/waitforit_test.php

@@ -158,7 +158,7 @@ final class waitforit_test extends cli_testcase {
     /**
      * Tests the countdown.
      */
-    public function test_countdown() {
+    public function test_countdown(): void {
         self::setAdminUser();
         $now = time();
         outagedb::save(new outage([
@@ -186,7 +186,7 @@ final class waitforit_test extends cli_testcase {
     /**
      * Tests if the outage changed while waiting.
      */
-    public function test_outagechanged() {
+    public function test_outagechanged(): void {
         self::setAdminUser();
         $now = time();
         $id = outagedb::save(new outage([

tests/local/controllers/maintenance_static_page_test.php

@@ -550,7 +550,7 @@ final class maintenance_static_page_test extends \auth_outage\base_testcase {
     /**
      * Test meta refresh maximum 5 minutes.
      */
-    public function test_meta_refresh_maximum_5seconds() {
+    public function test_meta_refresh_maximum_5seconds(): void {
         $this->resetAfterTest(true);
         $html = "<!DOCTYPE html>\n" .
                 '<html><head><title>Title</title></head>' .
@@ -560,7 +560,6 @@ final class maintenance_static_page_test extends \auth_outage\base_testcase {
         $page->set_max_refresh_time(5);
         $page->generate();
         $generated = trim(file_get_contents($page->get_io()->get_template_file()));
-        return $generated;
 
         self::assertStringContainsString('<meta http-equiv="refresh" content="5">', $generated);
     }

version.php

@@ -28,9 +28,8 @@
 defined('MOODLE_INTERNAL') || die();
 
 $plugin->component = "auth_outage";
-$plugin->version = 2024081907;                  // The current plugin version (Date: YYYYMMDDXX).
-$plugin->release = 2024081907;                  // Human-readable release information.
-$plugin->requires = 2017111309;                 // 2017111309 = T13, but this really requires 3.9 and higher.
-$plugin->maturity = MATURITY_STABLE;            // Suitable for PRODUCTION environments!
-$plugin->supported = [39, 405];                 // A range of branch numbers of supported moodle versions.
-$plugin->incompatible = 501;
+$plugin->version = 2026011304;          // The current plugin version (Date: YYYYMMDDXX).
+$plugin->release = 2026011304;          // Human-readable release information.
+$plugin->requires = 2025100600;         // Moodle 5.1.
+$plugin->maturity = MATURITY_STABLE;    // Suitable for PRODUCTION environments!
+$plugin->supported = [501, 501];        // A range of branch numbers of supported moodle versions.

views/info/content.php

@@ -39,27 +39,18 @@ defined('MOODLE_INTERNAL') || die();
         <b><?php echo get_string('infountil', 'auth_outage'); ?></b>
         <?php echo userdate($viewbag['outage']->stoptime, get_string('datetimeformat', 'auth_outage')); ?>
     </div>
-    <div class="auth_outage_info_description">
-        <?php
-        echo format_text(
-            $viewbag['outage']->get_description(),
-            FORMAT_HTML,
-            ['context' => context_system::instance()]
-        );
-        ?>
-    </div>
+    <div class="auth_outage_info_description"><?php echo $viewbag['outage']->get_description(); ?></div>
 
     <?php if ($viewbag['admin']) : ?>
         <?php
         $adminlinks = [];
-        foreach (
-            [
+        $params = [
             'startofwarning' => -$viewbag['outage']->get_warning_duration(),
             '15secondsbefore' => -15,
             'start' => 0,
             'endofoutage' => $viewbag['outage']->get_duration_planned() - 1,
-            ] as $title => $delta
-        ) {
+        ];
+        foreach ($params as $title => $delta) {
             $adminlinks[] = html_writer::link(
                 new moodle_url(
                     '/auth/outage/info.php',