Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-64930

LTI OAuth signature fails when params contains a single \n newline character

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.6.2
    • Fix Version/s: None
    • Labels:
    • Affected Branches:
      MOODLE_36_STABLE

      Description

      When LTI param contains single \n character the OAuth signature Moodle generates as LTI consumer doesn't match the signature the LTI provider generates. Probably because the browser replaces single \n character with \r\n when submitting the LTI HTML form.

      I've run into a case where a user has \n character at the end of his last_name in Moodle and LTI fail to launch.

      Instead of manually fixing a single param (fist_name, last_name, username...), I'm suggesting to loop over all LTI params and replace single \n characters with \r\n for all of them.

      https://github.com/moodle/moodle/blob/master/mod/lti/locallib.php

      $param = str_replace("\n", "\r\n", $param);

       

      Similar issues:

      https://tracker.moodle.org/browse/MDL-46536

      https://tracker.moodle.org/browse/MDL-59490

       

       

       

       

        Attachments

          Activity

            People

            Assignee:
            Unassigned
            Reporter:
            ofirdev ofirdev
            Participants:
            Component watchers:
            Adrian Greeve, Jake Dallimore, Mathew May, Mihail Geshoski, Peter Dias
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated: