Merge pull request #8309 from surlabs/ilias9_LTI_001

Fix 0041372 - LTIConsumer: Modified URL sending from GET to POST
ILIAS-eLearning · Oct 31, 2024 · 93b5244 · 93b5244
2 parents e9d2401 + 3d3c0e0
commit 93b5244
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 5 deletions.
diff --git a/Modules/LTIConsumer/classes/class.ilLTIConsumeProviderFormGUI.php b/Modules/LTIConsumer/classes/class.ilLTIConsumeProviderFormGUI.php
@@ -1,7 +1,5 @@
 <?php
 
-declare(strict_types=1);
-
 /**
  * This file is part of ILIAS, a powerful learning management system
  * published by ILIAS open source e-Learning e.V.
@@ -18,6 +16,8 @@
  *
  *********************************************************************/
 
+declare(strict_types=1);
+
 /**
  * Class ilLTIConsumeProviderFormGUI
  *
@@ -972,6 +972,7 @@ public function getDynRegRequest(): string
         $template = new ilTemplate('tpl.lti_dyn_reg_request.html', true, true, "Modules/LTIConsumer");
         $template->setVariable('LTI_TOOL_REG_URL', $toolRegUrl);
         $template->setVariable('LTI_DYN_REG_URL', $regUrl);
+        $template->setVariable('LTI_DYN_REG_URL_BY_POST', $toolRegUrl);
         $template->setVariable('LTI_REG_END_URL', ilObjLTIConsumer::getRegistrationEndUrl());
         $template->setVariable('LTI_SHOW_TOOL_CONFIG_URL', $showToolConfigUrl);
         $template->setVariable('LTI_REG_ERROR_URL', $regErrorUrl);

diff --git a/Modules/LTIConsumer/ltiregstart.php b/Modules/LTIConsumer/ltiregstart.php
@@ -1,7 +1,5 @@
 <?php
 
-declare(strict_types=1);
-
 /**
  * This file is part of ILIAS, a powerful learning management system
  * published by ILIAS open source e-Learning e.V.
@@ -18,6 +16,8 @@
  *
  *********************************************************************/
 
+declare(strict_types=1);
+
 /** @noRector */
 chdir("../../");
 
@@ -40,6 +40,10 @@
 
 if ($params->has('url')) {
     $url = $params->retrieve('url', $DIC->refinery()->kindlyTo()->string());
+
+    if (empty($_POST["url"]) || $_POST["url"] != $url) {
+        ilObjLTIConsumer::sendResponseError(400, "url parameter in request does not match url parameter in post");
+    }
 } else {
     ilObjLTIConsumer::sendResponseError(400, "missing required url parameter in request");
 }

diff --git a/Modules/LTIConsumer/templates/default/tpl.lti_dyn_reg_request.html b/Modules/LTIConsumer/templates/default/tpl.lti_dyn_reg_request.html
@@ -1,4 +1,8 @@
-<iframe height="500" width="100%" scrolling="yes" id="lti_dyn_reg_iframe" name="lti_dyn_reg_iframe" src="{LTI_DYN_REG_URL}" width="0" height="0" style="visibility: visible"></iframe>
+<iframe height="500" width="100%" scrolling="yes" id="lti_dyn_reg_iframe" name="lti_dyn_reg_iframe" width="0" height="0" style="visibility: visible"></iframe>
+<form style="display: none" id="post_iframe" action="{LTI_DYN_REG_URL}" target="lti_dyn_reg_iframe" method="post">
+    <input type="text" name="url" value="{LTI_DYN_REG_URL_BY_POST}">
+    <input type="submit" value="post">
+</form>
 <script>
   let toolRegUrl = "{LTI_TOOL_REG_URL}";
   let regEndUrl = "{LTI_REG_END_URL}";
@@ -38,4 +42,7 @@
     location.assign(errorUrl+"&new_type=lti&error="+btoa('timeout'));
   },100000);
   */
+  window.onload = function() {
+    document.getElementById('post_iframe').submit();
+  };
 </script>