Merge branch 'MDL-77840-401' of https://github.com/davewoloszyn/moodle into MOODLE_401_STABLE

backup/moodle2/backup_custom_fields.php

@@ -93,6 +93,8 @@ class base64_encode_final_element extends backup_final_element {
      * @param string $value Original value coming from backup step source, usually db.
      */
     public function set_value($value) {
+        // Avoid null being passed to base64_encode.
+        $value = $value ?? '';
         parent::set_value(base64_encode($value));
     }
 }

enrol/lti/ims-blti/OAuth.php

@@ -148,6 +148,11 @@ class OAuthSignatureMethod_RSA_SHA1 extends OAuthSignatureMethod {
     // Sign using the key
     $ok = openssl_sign($base_string, $signature, $privatekeyid);
 
+    // Avoid passing null values to base64_encode.
+    if (!$ok) {
+      throw new OAuthException("OpenSSL unable to sign data");
+    }
+
     // TODO: Remove this block once PHP 8.0 becomes required.
     if (PHP_MAJOR_VERSION < 8) {
       // Release the key resource

enrol/lti/ims-blti/readme_moodle.txt

@@ -6,3 +6,4 @@ In future releases we should look into using a supported library.
 2022-01-05 - MDL-73502 - Removed get_magic_quotes_gpc() use, was returning false since ages ago.
 2022-01-20 - MDL-73523 - Conditional openssl_free_key() use, deprecated by PHP 8.0
 2022-03-05 - MDL-73520 - replace deprecated php_errormsg with error_get_last(), deprecated by PHP 8.0
+2023-05-03 - MDL-77840 - Throw exception on openssl_sign to avoid null reaching base64_encode, deprecated by PHP 8.1

lang/en/error.php

@@ -488,6 +488,8 @@ $string['onlyadmins'] = 'Only administrators can do that';
 $string['onlyeditingteachers'] = 'Only editing teachers can do that';
 $string['onlyeditown'] = 'You can only edit your own information';
 $string['orderidnotfound'] = 'Order ID {$a} not found';
+$string['opensslsignerror'] = 'OpenSSL unable to sign data';
+$string['opensslsealerror'] = 'OpenSSL unable to seal data';
 $string['pagenotexisttitle'] = '404 Error: File not found';
 $string['pagenotexist'] = '<p>An unusual error occurred trying to view a page that does not exist:</p>{$a}';
 $string['pathdoesnotstartslash'] = 'No valid arguments supplied, path does not start with slash!';

mnet/lib.php

@@ -216,7 +216,12 @@ function mnet_sign_message($message, $privatekey = null) {
     // The '$sig' value below is returned by reference.
     // We initialize it first to stop my IDE from complaining.
     $sig  = '';
-    $bool = openssl_sign($message, $sig, $privatekey); // TODO: On failure?
+    $bool = openssl_sign($message, $sig, $privatekey);
+
+    // Avoid passing null values to base64_encode.
+    if ($bool === false) {
+        throw new \moodle_exception('opensslsignerror');
+    }
 
     $message = '<?xml version="1.0" encoding="iso-8859-1"?>
     <signedMessage>
@@ -283,6 +288,12 @@ function mnet_encrypt_message($message, $remote_certificate) {
 
     //        passed by ref ->     &$encryptedstring &$symmetric_keys
     $bool = openssl_seal($message, $encryptedstring, $symmetric_keys, array($publickey), 'RC4');
+
+    // Avoid passing null values to base64_encode.
+    if ($bool === false) {
+        throw new \moodle_exception('opensslsealerror');
+    }
+
     $message = $encryptedstring;
     $symmetrickey = array_pop($symmetric_keys);
 

mod/lti/OAuth.php

@@ -262,6 +262,11 @@ class OAuthSignatureMethod_RSA_SHA1 extends OAuthSignatureMethod {
         // Sign using the key
         $ok = openssl_sign($base_string, $signature, $privatekeyid);
 
+        // Avoid passing null values to base64_encode.
+        if (!$ok) {
+            throw new OAuthException("OpenSSL unable to sign data");
+        }
+
         // TODO: Remove this block once PHP 8.0 becomes required.
         if (PHP_MAJOR_VERSION < 8) {
             // Release the key resource

mod/lti/classes/local/ltiopenid/jwks_helper.php

@@ -73,6 +73,11 @@ class jwks_helper {
         $res = openssl_pkey_get_private($privatekey['key']);
         $details = openssl_pkey_get_details($res);
 
+        // Avoid passing null values to base64_encode.
+        if (!isset($details['rsa']['e']) || !isset($details['rsa']['n'])) {
+            throw new \moodle_exception('Error: essential openssl keys not set');
+        }
+
         $jwk = array();
         $jwk['kty'] = 'RSA';
         $jwk['alg'] = 'RS256';