moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-05 08:56:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-28126 webservices : should not able to create token if user is deleted,unconfirmed,suspended or guest.

Browse source
This commit is contained in:
Jerome Mouneyrac 2011-11-14 12:09:40 +08:00 • committed by Aparup Banerjee
parent f89a83b87b
commit 94b9dad79d
3 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
admin/webservice/forms.php
View file

@ -179,7 +179,7 @@ class external_service_functions_form extends moodleform {
class web_service_token_form extends moodleform { class web_service_token_form extends moodleform {
function definition() { function definition() {
global $USER, $DB; global $USER, $DB, $CFG;
$mform = $this->_form; $mform = $this->_form;
$data = $this->_customdata; $data = $this->_customdata;
@ -188,10 +188,12 @@ class web_service_token_form extends moodleform {
if (empty($data->nouserselection)) { if (empty($data->nouserselection)) {
//user searchable selector - get all users (admin and guest included) //user searchable selector - get all users (admin and guest included)
//user must be confirmed, not deleted, not suspended, not guest
$sql = "SELECT u.id, u.firstname, u.lastname $sql = "SELECT u.id, u.firstname, u.lastname
FROM {user} u FROM {user} u
WHERE u.deleted = 0 AND u.confirmed = 1 AND u.suspended = 0 AND u.id != ?
ORDER BY u.lastname"; ORDER BY u.lastname";
$users = $DB->get_records_sql($sql, array()); $users = $DB->get_records_sql($sql, array($CFG->siteguest));
$options = array(); $options = array();
foreach ($users as $userid => $user) { foreach ($users as $userid => $user) {
$options[$userid] = $user->firstname . " " . $user->lastname; $options[$userid] = $user->firstname . " " . $user->lastname;

6
admin/webservice/tokens.php
View file

@ -71,6 +71,12 @@ switch ($action) {
} }
} }
//check if the user is deleted. unconfirmed, suspended or guest
$user = $DB->get_record('user', array('id' => $data->user));
if ($user->id == $CFG->siteguest or $user->deleted or !$user->confirmed or $user->suspended) {
throw new moodle_exception('forbiddenwsuser', 'webservice');
}
//process the creation //process the creation
if (empty($errormsg)) { if (empty($errormsg)) {
//TODO improvement: either move this function from externallib.php to webservice/lib.php //TODO improvement: either move this function from externallib.php to webservice/lib.php

1
lang/en/webservice.php
View file

@ -92,6 +92,7 @@ $string['externalservices'] = 'External services';
$string['externalserviceusers'] = 'External service users'; $string['externalserviceusers'] = 'External service users';
$string['failedtolog'] = 'Failed to log'; $string['failedtolog'] = 'Failed to log';
$string['filenameexist'] = 'File name already exists: {$a}'; $string['filenameexist'] = 'File name already exists: {$a}';
$string['forbiddenwsuser'] = 'Can not create token for a unconfirmed, deleted, suspended or guest user.';
$string['function'] = 'Function'; $string['function'] = 'Function';
$string['functions'] = 'Functions'; $string['functions'] = 'Functions';
$string['generalstructure'] = 'General structure'; $string['generalstructure'] = 'General structure';