Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-53832 Upgrade enrol_lti to support LTI v2.0
  3. MDL-55752

enrol_lti: Don't use token in launch requests

    XMLWordPrintable

    Details

    • Type: Sub-task
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.2
    • Fix Version/s: None
    • Component/s: Enrolments, LTI provider
    • Labels:
    • Testing Instructions:
      Hide
      Proxy Tests
      1. Go to SITE A
      2. Go to your list of tools
      3. Copy the url in the Proxy URL column for one of the tools
      4. Go to SITE B
      5. Go to Site administration ► Plugins ► External tool ► Manage tools
      6. Paste the url you copied into the box, but don't click add
      7. Change the token part of the url to something else such as "ASDF123"
      8. Click add
      9. Make sure that there is an error displayed
      10. Click cancel
      11. Paste the URL and this time click add with the correct token
      12. Click continue
      13. Click save
      14. The tool should successfully be added.
      15. Go to a course
      16. Add an external tool
      17. Select the type as the tool you just added
      18. Save and display
      19. Verify it works as expected and you log into SITE A correctly
      20. Go to SITE A
      21. Go to your list of tools
      22. Copy the url in the Cartridge URL column for one of the tools
      23. Go to the cartridge
      24. Copy the launch url from the XML
      25. Go to SITE B
      26. Go to Site administration ► Plugins ► External tool ► Manage tools
      27. Paste the url you copied into the box and click add
      28. Make sure you get an error
      29. Go to SITE A
      30. Go to your list of tools
      31. Copy the url in the Proxy URL column for one of the tools
      32. Go to SITE B
      33. Go to a course
      34. Add an external tool
      35. Paste the proxy URL as the launch url
      Show
      Proxy Tests Go to SITE A Go to your list of tools Copy the url in the Proxy URL column for one of the tools Go to SITE B Go to Site administration ► Plugins ► External tool ► Manage tools Paste the url you copied into the box, but don't click add Change the token part of the url to something else such as "ASDF123" Click add Make sure that there is an error displayed Click cancel Paste the URL and this time click add with the correct token Click continue Click save The tool should successfully be added. Go to a course Add an external tool Select the type as the tool you just added Save and display Verify it works as expected and you log into SITE A correctly Go to SITE A Go to your list of tools Copy the url in the Cartridge URL column for one of the tools Go to the cartridge Copy the launch url from the XML Go to SITE B Go to Site administration ► Plugins ► External tool ► Manage tools Paste the url you copied into the box and click add Make sure you get an error Go to SITE A Go to your list of tools Copy the url in the Proxy URL column for one of the tools Go to SITE B Go to a course Add an external tool Paste the proxy URL as the launch url
    • Affected Branches:
      MOODLE_32_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      MDL-55752-master

      Description

      If you are a student on a site that uses a moodle shared LTI tool proxy, you can easily just copy that url and put it on your own LTI consumer and set up the proxy. We need to make sure this isn't possible

      During this issue we may want to look into combining tool.php and proxy.php so proxy.php only does the registration and tool.php only does launches. This may help us separate the launches and uses of the tool

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                johno John Okely
                Reporter:
                johno John Okely
                Peer reviewer:
                Jun Pataleta
                Participants:
                Component watchers:
                Amaia Anabitarte, Bas Brands, Carlos Escobedo, Sara Arjona (@sarjona), Víctor Déniz Falcón, Adrian Greeve, Mihail Geshoski, Peter Dias
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: