mirror of
https://github.com/catalyst/moodle-auth_outage.git
synced 2026-09-07 00:06:01 +02:00
vlad.kidanov
a093165caf
WR492688: Issue #32 Fix: the 'static' flag can no longer be set from a raw client value. It is now only true if the request presents a 'statickey' matching an HMAC-SHA256 of the outage id keyed with a per-site secret (infopage::statickey(), lazily generated via set_config()/get_config()). maintenance_static_page::create_from_outage() now sends that computed statickey instead of static=1 when it internally fetches info.php, so the legitimate static-generation path keeps working while external forgery of the flag is no longer possible. WR492688: Issue #33 WR492688: Version bump Bug fixes and improvements WR492688: Issue #32 Fix: the 'static' flag can no longer be set from a raw client value. It is now only true if the request presents a 'statickey' matching an HMAC-SHA256 of the outage id keyed with a per-site secret (infopage::statickey(), lazily generated via set_config()/get_config()). maintenance_static_page::create_from_outage() now sends that computed statickey instead of static=1 when it internally fetches info.php, so the legitimate static-generation path keeps working while external forgery of the flag is no longer possible. WR492688: Issue #33 WR492688: Version bump fix