Fix 0041372 - LTIConsumer: Modified URL sending from GET to POST

Sending the URL by POST to the iframe in ltiregstart.php file.
ILIAS-eLearning · Oct 31, 2024 · d9b204f · d9b204f
1 parent e9d2401
commit d9b204f
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 1 deletion.
diff --git a/Modules/LTIConsumer/classes/class.ilLTIConsumeProviderFormGUI.php b/Modules/LTIConsumer/classes/class.ilLTIConsumeProviderFormGUI.php
@@ -972,6 +972,7 @@ public function getDynRegRequest(): string
         $template = new ilTemplate('tpl.lti_dyn_reg_request.html', true, true, "Modules/LTIConsumer");
         $template->setVariable('LTI_TOOL_REG_URL', $toolRegUrl);
         $template->setVariable('LTI_DYN_REG_URL', $regUrl);
+        $template->setVariable('LTI_DYN_REG_URL_BY_POST', $toolRegUrl);
         $template->setVariable('LTI_REG_END_URL', ilObjLTIConsumer::getRegistrationEndUrl());
         $template->setVariable('LTI_SHOW_TOOL_CONFIG_URL', $showToolConfigUrl);
         $template->setVariable('LTI_REG_ERROR_URL', $regErrorUrl);

diff --git a/Modules/LTIConsumer/ltiregstart.php b/Modules/LTIConsumer/ltiregstart.php
@@ -40,6 +40,10 @@
 
 if ($params->has('url')) {
     $url = $params->retrieve('url', $DIC->refinery()->kindlyTo()->string());
+
+    if (empty($_POST["url"]) || $_POST["url"] != $url) {
+        ilObjLTIConsumer::sendResponseError(400, "url parameter in request does not match url parameter in post");
+    }
 } else {
     ilObjLTIConsumer::sendResponseError(400, "missing required url parameter in request");
 }

diff --git a/Modules/LTIConsumer/templates/default/tpl.lti_dyn_reg_request.html b/Modules/LTIConsumer/templates/default/tpl.lti_dyn_reg_request.html
@@ -1,4 +1,8 @@
-<iframe height="500" width="100%" scrolling="yes" id="lti_dyn_reg_iframe" name="lti_dyn_reg_iframe" src="{LTI_DYN_REG_URL}" width="0" height="0" style="visibility: visible"></iframe>
+<iframe height="500" width="100%" scrolling="yes" id="lti_dyn_reg_iframe" name="lti_dyn_reg_iframe" width="0" height="0" style="visibility: visible"></iframe>
+<form style="display: none" id="post_iframe" action="{LTI_DYN_REG_URL}" target="lti_dyn_reg_iframe" method="post">
+    <input type="text" name="url" value="{LTI_DYN_REG_URL_BY_POST}">
+    <input type="submit" value="post">
+</form>
 <script>
   let toolRegUrl = "{LTI_TOOL_REG_URL}";
   let regEndUrl = "{LTI_REG_END_URL}";
@@ -38,4 +42,7 @@
     location.assign(errorUrl+"&new_type=lti&error="+btoa('timeout'));
   },100000);
   */
+  window.onload = function() {
+    document.getElementById('post_iframe').submit();
+  };
 </script>