Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-32545

If the LTI Launch URL contains an &, it doesn't get signed properly in the launch

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Won't Fix
    • Affects Version/s: 2.2, 2.2.1, 2.2.2
    • Fix Version/s: None
    • Labels:
      None

      Description

      LTI stores the launch URL with htmlspecialchars, which converts & to &. When launching, the URL is not htmlspecialchars_decode'd, so the parameter gets included with amp; prepended.

      This causes the OAuth signature to not match on the tool provider when launched, which causes the launch to fail with an invalid signature.

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: