Loading...

XML

Word

Printable

Type: Improvement
Resolution: Fixed
Priority: Minor
Fix Version/s: 3.8
Affects Version/s: 3.1.5, 3.2, 3.3, 3.7
Component/s: Administration, Roles / Access
Labels:
- CatalystIT
- ci
- partner
- release_notes
- triaged

Affected Branches:
MOODLE_31_STABLE, MOODLE_32_STABLE, MOODLE_33_STABLE, MOODLE_37_STABLE
Fixed Branches:
MOODLE_38_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull Main Branch:
~~MDL-58439~~-admin-no-guest
Pull Main Diff URL:
https://github.com/moodle/moodle/compare/f3507273e9f...brendanheywood:MDL-58439-admin-no-guest
Testing Instructions:
Hide

Enable auto-login guest (Site administration > Users > Permissions > User policies - Auto-login guests).

Now visit each of these admin pages. You should be prompted to login and not get an access issue:

admin/search.php

admin/plugins.php

admin/qbehaviours.php

admin/qtypes.php

admin/roles/manage.php

admin/roles/usersroles.php?userid=2&courseid=2 (This will redirect you to enrol in the course and not to login) You will also be logged in as a guest and will need to log in as a user and then log out to get back to the original logged out state)

admin/tasklogs.php

admin/timezone.php

admin/tool/monitor/managerules.php

admin/tool/oauth2/issuers.php

admin/tool/task/scheduledtasks.php
Show
Enable auto-login guest (Site administration > Users > Permissions > User policies - Auto-login guests). Now visit each of these admin pages. You should be prompted to login and not get an access issue: admin/search.php admin/plugins.php admin/qbehaviours.php admin/qtypes.php admin/roles/manage.php admin/roles/usersroles.php?userid=2&courseid=2 (This will redirect you to enrol in the course and not to login) You will also be logged in as a guest and will need to log in as a user and then log out to get back to the original logged out state) admin/tasklogs.php admin/timezone.php admin/tool/monitor/managerules.php admin/tool/oauth2/issuers.php admin/tool/task/scheduledtasks.php

If you are not logged in and you deep link to almost any admin page, then instead of getting prompted to login, you instead get automatically logged in as a guest and then get an error. With debugging on it looks like this:

Access denied

More information about this error
×Debug info:
Error code: accessdenied
×Stack trace: * line 496 of /lib/setuplib.php: moodle_exception thrown

line 7655 of /lib/adminlib.php: call to print_error()
line 12 of /admin/auth_config.php: call to admin_externalpage_setup()

These should instead just send you directly to the login page as everyone would expect.

- - Sort By Name
  - Sort By Date
  - Ascending
  - Descending
  - Thumbnails
  - List
  - Download All

MDL-58439.jpg
68 kB
13/Jun/19 1:57 PM

caused a regression

MDL-67523 For non-admin user the site administration categories are displayed as links that show errors

Closed

has been marked as being related by

MDL-66172 Add require_recent_login() for higher security pages

Development in progress

Assignee:: Brendan Heywood

Reporter:: Brendan Heywood

Peer reviewer:: Dmitrii Metelkin

Integrator:: Adrian Greeve

Tester:: Anna Carissa Sadia

Participants:: Adrian Greeve, Ankit Agarwal, Anna Carissa Sadia, Brendan Heywood, CiBoT, David Mudrák (@mudrd8mz), Dmitrii Metelkin, Marina Glancy

Votes:: 1 Vote for this issue

Watchers:: 9 Start watching this issue

Created:: 30/Mar/17 5:31 PM

Updated:: 14/Dec/19 5:52 AM

Resolved:: 14/Jun/19 12:35 AM

Estimated:

Remaining:

Logged:

1h 45m

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Time Tracking

Clockify