[MDL-58439] Admin pages login as guest and then throw Access denied error (should prompt for login) require_admin() - Moodle Tracker

XML

Word

Printable

Details

Type: Improvement
Status: Closed
Priority: Minor
Resolution: Fixed
Affects Version/s: 3.1.5, 3.2, 3.3, 3.7
Fix Version/s: 3.8
Component/s: Administration, Roles / Access
Labels:
- CatalystIT
- ci
- partner
- release_notes
- triaged

Affected Branches:
MOODLE_31_STABLE, MOODLE_32_STABLE, MOODLE_33_STABLE, MOODLE_37_STABLE
Fixed Branches:
MOODLE_38_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull Master Branch:
~~MDL-58439~~-admin-no-guest
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/f3507273e9f...brendanheywood:MDL-58439-admin-no-guest
Testing Instructions:
Hide

Enable auto-login guest (Site administration > Users > Permissions > User policies - Auto-login guests).

Now visit each of these admin pages. You should be prompted to login and not get an access issue:

admin/search.php

admin/plugins.php

admin/qbehaviours.php

admin/qtypes.php

admin/roles/manage.php

admin/roles/usersroles.php?userid=2&courseid=2 (This will redirect you to enrol in the course and not to login) You will also be logged in as a guest and will need to log in as a user and then log out to get back to the original logged out state)

admin/tasklogs.php

admin/timezone.php

admin/tool/monitor/managerules.php

admin/tool/oauth2/issuers.php

admin/tool/task/scheduledtasks.php
Show
Enable auto-login guest (Site administration > Users > Permissions > User policies - Auto-login guests). Now visit each of these admin pages. You should be prompted to login and not get an access issue: admin/search.php admin/plugins.php admin/qbehaviours.php admin/qtypes.php admin/roles/manage.php admin/roles/usersroles.php?userid=2&courseid=2 (This will redirect you to enrol in the course and not to login) You will also be logged in as a guest and will need to log in as a user and then log out to get back to the original logged out state) admin/tasklogs.php admin/timezone.php admin/tool/monitor/managerules.php admin/tool/oauth2/issuers.php admin/tool/task/scheduledtasks.php

Description

If you are not logged in and you deep link to almost any admin page, then instead of getting prompted to login, you instead get automatically logged in as a guest and then get an error. With debugging on it looks like this:

Access denied

More information about this error
×Debug info:
Error code: accessdenied
×Stack trace: * line 496 of /lib/setuplib.php: moodle_exception thrown

line 7655 of /lib/adminlib.php: call to print_error()
line 12 of /admin/auth_config.php: call to admin_externalpage_setup()

These should instead just send you directly to the login page as everyone would expect.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

MDL-58439.jpg
68 kB
13/Jun/19 1:57 PM

Issue Links

caused a regression

MDL-67523 For non-admin user the site administration categories are displayed as links that show errors

Closed

has been marked as being related by

MDL-66172 Add require_recent_login() for higher security pages

Development in progress

Activity

People

Assignee:: Brendan Heywood

Reporter:: Brendan Heywood

Peer reviewer:: Dmitrii Metelkin

Integrator:: Adrian Greeve

Tester:: Anna Carissa Sadia

Participants:: Adrian Greeve, Ankit Agarwal, Anna Carissa Sadia, Brendan Heywood, CiBoT, David Mudrák (@mudrd8mz), Dmitrii Metelkin, Marina Glancy

Component watchers:: Andrew Lyons, Huong Nguyen, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze, Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Sara Arjona (@sarjona)

Votes:: 1 Vote for this issue

Watchers:: 9 Start watching this issue

Dates

Created:: 30/Mar/17 5:31 PM

Updated:: 14/Dec/19 5:52 AM

Resolved:: 14/Jun/19 12:35 AM

Fix Release Date:: 18/Nov/19

Time Tracking

Estimated:

Remaining:

Logged:

1h 45m