Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix 0041372 - LTIConsumer: Modified URL sending from GET to POST #8309

Merged
merged 5 commits into from
Oct 31, 2024
Merged

Fix 0041372 - LTIConsumer: Modified URL sending from GET to POST #8309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
55aa45e
Fix 0041372: LTIConsumer: Open redirect en el script ltiregstart.php
Saaweel Oct 30, 2024
68b49ec
Merge branch 'ILIAS-eLearning:release_9' into ilias9_LTI_001
ZallaxDev Oct 30, 2024
d9b204f
Fix 0041372 - LTIConsumer: Modified URL sending from GET to POST
Saaweel Oct 31, 2024
aebfc6f
Moved strict_types statement under copyright
ZallaxDev Oct 31, 2024
3d3c0e0
Merge branch 'ilias9_LTI_001' of https://github.com/surlabs/ILIAS int…
ZallaxDev Oct 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions Modules/LTIConsumer/classes/class.ilLTIConsumeProviderFormGUI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
<?php

declare(strict_types=1);

/**
* This file is part of ILIAS, a powerful learning management system
* published by ILIAS open source e-Learning e.V.
Expand All @@ -18,6 +16,8 @@
*
*********************************************************************/

declare(strict_types=1);

/**
* Class ilLTIConsumeProviderFormGUI
*
Expand Down Expand Up @@ -972,6 +972,7 @@ public function getDynRegRequest(): string
$template = new ilTemplate('tpl.lti_dyn_reg_request.html', true, true, "Modules/LTIConsumer");
$template->setVariable('LTI_TOOL_REG_URL', $toolRegUrl);
$template->setVariable('LTI_DYN_REG_URL', $regUrl);
$template->setVariable('LTI_DYN_REG_URL_BY_POST', $toolRegUrl);
$template->setVariable('LTI_REG_END_URL', ilObjLTIConsumer::getRegistrationEndUrl());
$template->setVariable('LTI_SHOW_TOOL_CONFIG_URL', $showToolConfigUrl);
$template->setVariable('LTI_REG_ERROR_URL', $regErrorUrl);
Expand Down
8 changes: 6 additions & 2 deletions Modules/LTIConsumer/ltiregstart.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
<?php

declare(strict_types=1);

/**
* This file is part of ILIAS, a powerful learning management system
* published by ILIAS open source e-Learning e.V.
Expand All @@ -18,6 +16,8 @@
*
*********************************************************************/

declare(strict_types=1);

/** @noRector */
chdir("../../");

Expand All @@ -40,6 +40,10 @@

if ($params->has('url')) {
$url = $params->retrieve('url', $DIC->refinery()->kindlyTo()->string());

if (empty($_POST["url"]) || $_POST["url"] != $url) {
ilObjLTIConsumer::sendResponseError(400, "url parameter in request does not match url parameter in post");
}
} else {
ilObjLTIConsumer::sendResponseError(400, "missing required url parameter in request");
}
Expand Down
9 changes: 8 additions & 1 deletion Modules/LTIConsumer/templates/default/tpl.lti_dyn_reg_request.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
<iframe height="500" width="100%" scrolling="yes" id="lti_dyn_reg_iframe" name="lti_dyn_reg_iframe" src="{LTI_DYN_REG_URL}" width="0" height="0" style="visibility: visible"></iframe>
<iframe height="500" width="100%" scrolling="yes" id="lti_dyn_reg_iframe" name="lti_dyn_reg_iframe" width="0" height="0" style="visibility: visible"></iframe>
<form style="display: none" id="post_iframe" action="{LTI_DYN_REG_URL}" target="lti_dyn_reg_iframe" method="post">
<input type="text" name="url" value="{LTI_DYN_REG_URL_BY_POST}">
<input type="submit" value="post">
</form>
<script>
let toolRegUrl = "{LTI_TOOL_REG_URL}";
let regEndUrl = "{LTI_REG_END_URL}";
Expand Down Expand Up @@ -38,4 +42,7 @@
location.assign(errorUrl+"&new_type=lti&error="+btoa('timeout'));
},100000);
*/
window.onload = function() {
document.getElementById('post_iframe').submit();
};
</script>
Loading