Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-64930

LTI OAuth signature fails when params contains a single \n newline character

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.6.2
    • Fix Version/s: None
    • Labels:
    • Affected Branches:
      MOODLE_36_STABLE

      Description

      When LTI param contains single \n character the OAuth signature Moodle generates as LTI consumer doesn't match the signature the LTI provider generates. Probably because the browser replaces single \n character with \r\n when submitting the LTI HTML form.

      I've run into a case where a user has \n character at the end of his last_name in Moodle and LTI fail to launch.

      Instead of manually fixing a single param (fist_name, last_name, username...), I'm suggesting to loop over all LTI params and replace single \n characters with \r\n for all of them.

      https://github.com/moodle/moodle/blob/master/mod/lti/locallib.php

      $param = str_replace("\n", "\r\n", $param);

       

      Similar issues:

      https://tracker.moodle.org/browse/MDL-46536

      https://tracker.moodle.org/browse/MDL-59490

       

       

       

       

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              ofirdev ofirdev
              Participants:
              Component watchers:
              Adrian Greeve, Mihail Geshoski, Peter Dias
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated: