[MDL-74417] Links from Manage authentication to Test settings expose the sesskey in a GET url - Moodle Tracker

XML

Word

Printable

Details

Type: Bug
Status: Reopened
Priority: Minor
Resolution: Unresolved
Affects Version/s: 3.11.6
Fix Version/s: None
Component/s: Authentication
Labels:

Affected Branches:
MOODLE_311_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull 3.11 Branch:
MDL-74417-auth-sesskey-MOODLE_311_STABLE
Pull 3.11 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_311_STABLE...brendanheywood:MDL-74417-auth-sesskey-MOODLE_311_STABLE
Pull Master Branch:
MDL-74417-auth-sesskey
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/master...brendanheywood:MDL-74417-auth-sesskey
Difficulty:
Easy
Testing Instructions:

Hide

1. Visit /admin/settings.php?section=manageauths
(Site Administration->Plugins->Authentication/Manage authentication)
2. Hover over any 'Test settings' button. Confirm you do not see a sesskey paramter in the url
3. Clicking the button performs an http post request.
4. Confirm you do not see the sesskey parameter in the browser url bar.

Show
1. Visit /admin/settings.php?section=manageauths (Site Administration->Plugins->Authentication/Manage authentication) 2. Hover over any 'Test settings' button. Confirm you do not see a sesskey paramter in the url 3. Clicking the button performs an http post request. 4. Confirm you do not see the sesskey parameter in the browser url bar.

Description

eg:

/auth/test_settings.php?auth=saml2&sesskey=2wFyBAgdYZ

These should not be needed, or if they are turn them into a post.

https://docs.moodle.org/dev/Security:Cross-site_request_forgery#Ensure_your_code_does_not_expose_the_sesskey_inadvertently

Attachments

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

unaligned.png
16 kB
06/Apr/22 9:43 AM

Activity

People

Assignee:: Brendan Heywood

Reporter:: Brendan Heywood

Peer reviewer:: Peter Burnett

Integrator:: Jake Dallimore

Participants:: Brendan Heywood, CiBoT, Jake Dallimore, Jun Pataleta, Peter Burnett

Component watchers:: David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo

Votes:: 0 Vote for this issue

Watchers:: 8 Start watching this issue

Dates

Created:: 04/Apr/22 8:45 AM

Updated:: 22/Jun/22 4:40 PM

Time Tracking

Estimated:

0m

Remaining:

0m

Logged:

10m