moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-09 10:56:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-82365 mod_lesson: stricter equality checks of activity password.

Browse source
This commit is contained in:
Paul Holden 2024-07-03 09:40:36 +01:00 • committed by Ilya Tregubov
parent 8ec84f43cb
commit 3fc1073d30
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
mod/lesson/locallib.php
View file

@ -2864,15 +2864,17 @@ class lesson extends lesson_base {
if ($this->properties->usepassword && empty($USER->lessonloggedin[$this->id])) { if ($this->properties->usepassword && empty($USER->lessonloggedin[$this->id])) {
$correctpass = false; $correctpass = false;
if (!empty($userpassword) &&
(($this->properties->password == md5(trim($userpassword))) || ($this->properties->password == trim($userpassword)))) { $userpassword = trim((string) $userpassword);
if ($userpassword !== '' &&
($this->properties->password === md5($userpassword) || $this->properties->password === $userpassword)) {
// With or without md5 for backward compatibility (MDL-11090). // With or without md5 for backward compatibility (MDL-11090).
$correctpass = true; $correctpass = true;
$USER->lessonloggedin[$this->id] = true; $USER->lessonloggedin[$this->id] = true;
} else if (isset($this->properties->extrapasswords)) { } else if (isset($this->properties->extrapasswords)) {
// Group overrides may have additional passwords. // Group overrides may have additional passwords.
foreach ($this->properties->extrapasswords as $password) { foreach ($this->properties->extrapasswords as $password) {
if (strcmp($password, md5(trim($userpassword))) === 0 || strcmp($password, trim($userpassword)) === 0) { if ($password === md5($userpassword) || $password === $userpassword) {
$correctpass = true; $correctpass = true;
$USER->lessonloggedin[$this->id] = true; $USER->lessonloggedin[$this->id] = true;
} }