-
Improvement
-
Resolution: Fixed
-
Critical
-
3.9.19, 3.11.12, 4.0.6, 4.1
-
MOODLE_311_STABLE, MOODLE_39_STABLE, MOODLE_400_STABLE, MOODLE_401_STABLE
-
MOODLE_311_STABLE, MOODLE_39_STABLE, MOODLE_400_STABLE, MOODLE_401_STABLE
-
MDL-76680/401 -
MDL-76680/master -
This should not break anything, if it did we would have big problems.
Setup
- A freshly installed moodle instance.
Testing 1
- Download 76680_1.php
to your moodle root folder. - Open the script in the browser
- CONFIRM it outputs 'bool(false) bool(true)' on first access
- Reload the page
- CONFIRM it outputs 'bool(false) bool(true)' on page reload
Testing 2
- Download and apply the patch 76680.diff to your moodle instance
git apply /path/to/76680.diff - Login and add or update some calendar entry
- Download 76680_2.php to your moodle root folder and open it on the browser.
- CONFIRM that you get the error: "A required parameter (sesskey) was missing"
Testing 3
- Login as admin and create a lesson activity with one page
- Download 76680_3.php to your moodle root folder and open it on your browser.
- Rerun 76680_2.php on your browser.
- CONFIRM that the "A required parameter (sesskey) was missing" error is shown
This should not break anything, if it did we would have big problems. Setup A freshly installed moodle instance. Testing 1 Download 76680_1.php to your moodle root folder. Open the script in the browser CONFIRM it outputs 'bool(false) bool(true)' on first access Reload the page CONFIRM it outputs 'bool(false) bool(true)' on page reload Testing 2 Download and apply the patch 76680.diff to your moodle instance git apply /path/to/76680.diff Login and add or update some calendar entry Download 76680_2.php to your moodle root folder and open it on the browser. CONFIRM that you get the error: "A required parameter (sesskey) was missing" Testing 3 Login as admin and create a lesson activity with one page Download 76680_3.php to your moodle root folder and open it on your browser. Rerun 76680_2.php on your browser. CONFIRM that the "A required parameter (sesskey) was missing" error is shown
If by any chance some developer used an externallib method that does not wrap
$USER->ignoresesskey=true with if (WS_SERVER) in normal code then it could be carried over to normal user session completely disabling CSRF protection.
I guess it would be better to at least limit it only to current request by removing it in session manger at the beginning of next page request.
Disaster scenarios:
- There is a web service that allows both ajax and WS server access - developer forgets to use if (WS_SERVER) around the $USER->ignoresesskey=true. Then every ajax request for this method disables CSRF for the rest of user session.
- There is a web service that is allowed in mobile and WS only, it does not have "if (WS_SERVER)" around $USER->ignoresesskey=true. Another developer calls the external method directly in normal code. Then CSRF is disabled for the rest of user session.
