Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-53832 Upgrade enrol_lti to support LTI v2.0
  3. MDL-55752

enrol_lti: Don't use token in launch requests

    XMLWordPrintable

Details

    • Sub-task
    • Status: Closed
    • Minor
    • Resolution: Fixed
    • 3.2
    • None
    • Enrolments, LTI provider
    • MOODLE_32_STABLE
    • MDL-55752-master
    • Hide
      Proxy Tests
      1. Go to SITE A
      2. Go to your list of tools
      3. Copy the url in the Proxy URL column for one of the tools
      4. Go to SITE B
      5. Go to Site administration ► Plugins ► External tool ► Manage tools
      6. Paste the url you copied into the box, but don't click add
      7. Change the token part of the url to something else such as "ASDF123"
      8. Click add
      9. Make sure that there is an error displayed
      10. Click cancel
      11. Paste the URL and this time click add with the correct token
      12. Click continue
      13. Click save
      14. The tool should successfully be added.
      15. Go to a course
      16. Add an external tool
      17. Select the type as the tool you just added
      18. Save and display
      19. Verify it works as expected and you log into SITE A correctly
      20. Go to SITE A
      21. Go to your list of tools
      22. Copy the url in the Cartridge URL column for one of the tools
      23. Go to the cartridge
      24. Copy the launch url from the XML
      25. Go to SITE B
      26. Go to Site administration ► Plugins ► External tool ► Manage tools
      27. Paste the url you copied into the box and click add
      28. Make sure you get an error
      29. Go to SITE A
      30. Go to your list of tools
      31. Copy the url in the Proxy URL column for one of the tools
      32. Go to SITE B
      33. Go to a course
      34. Add an external tool
      35. Paste the proxy URL as the launch url
      Show
      Proxy Tests Go to SITE A Go to your list of tools Copy the url in the Proxy URL column for one of the tools Go to SITE B Go to Site administration ► Plugins ► External tool ► Manage tools Paste the url you copied into the box, but don't click add Change the token part of the url to something else such as "ASDF123" Click add Make sure that there is an error displayed Click cancel Paste the URL and this time click add with the correct token Click continue Click save The tool should successfully be added. Go to a course Add an external tool Select the type as the tool you just added Save and display Verify it works as expected and you log into SITE A correctly Go to SITE A Go to your list of tools Copy the url in the Cartridge URL column for one of the tools Go to the cartridge Copy the launch url from the XML Go to SITE B Go to Site administration ► Plugins ► External tool ► Manage tools Paste the url you copied into the box and click add Make sure you get an error Go to SITE A Go to your list of tools Copy the url in the Proxy URL column for one of the tools Go to SITE B Go to a course Add an external tool Paste the proxy URL as the launch url

    Description

      If you are a student on a site that uses a moodle shared LTI tool proxy, you can easily just copy that url and put it on your own LTI consumer and set up the proxy. We need to make sure this isn't possible

      During this issue we may want to look into combining tool.php and proxy.php so proxy.php only does the registration and tool.php only does launches. This may help us separate the launches and uses of the tool

      Attachments

        Issue Links

          has to be done before

          Sub-task - Issues are sometimes broken into multiple sub-tasks. MDL-55753 Only allow certain consumers for each shared tool in enrol_lti

          • Minor - Minor loss of function where workaround is possible
          • Closed

          Activity

            People

              johno John Okely
              johno John Okely
              Jun Pataleta Jun Pataleta
              David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: