230 Commits

Author SHA1 Message Date
Paul Holden
d663d92357 MDL-71976 auth_shibboleth: consistent session parsing during logout. 2021-09-07 09:04:23 +02:00
Paul Holden
5bc561ee7a MDL-71957 auth_shibboleth: safer session retrieval during logout. 2021-07-08 23:30:34 +02:00
Eloy Lafuente (stronk7)
9d6aa39985 MDL-71583 versions: Add all the missing full-stops to version/requires
It seems that the new phpcs3 checker is now controlling those
line comments that previously were ignored.

This commit just looks for all the cases and bulk-add
them when needed. The bash script (mac) used to add all them is:

while read -r line; do
    arr=(${line//:/ })
    if [[ -n ${arr[0]} ]] && [[ -n ${arr[1]} ]]; then
        echo "  file ${arr[0]}, line ${arr[1]}"
        sed -i "${arr[1]}s/\$/\./" ${arr[0]}
    fi
done < <(find . -name version.php | xargs ag --nomultiline '>(version|requires) *=.*//.*[^;\.]$')
2021-05-11 20:11:07 +02:00
Sara Arjona
7d24686e59 Merge branch 'MDL-69308' of https://github.com/stronk7/moodle 2021-01-14 12:03:30 +01:00
Eloy Lafuente (stronk7)
77342b96fc MDL-69308 upgrade: remove all the < 3.6.0 upgrade steps
This just deletes all the upgrade steps previous to 3.6.0. Some
small adjustments, like tweaking globals can also be applied
when needed.

Also includes an upgrade step to prevent upgrading from any
version < 2018120300 (v3.6.0) as anti-cheating measure.

Note that in this case, there wasn't any case of upgradelib
functions being used, hence we haven't to deprecate/remove
anything in codebase. When there is such a need, that is done
in separate commits (one for each function) and documented here.

See MDL-65809 commits for an example removing/deprecating a
good number of functions.
2021-01-13 19:11:19 +01:00
Mihail Geshoski
06a338f00b MDL-68486 auth_shibboleth: Reset convert_data if it uses dataroot file
Upgrade step that resets the 'Data modification API' (convert_data)
setting to its default value if this setting is currently configured
to use a file located within the $CFG->dataroot directory.
2021-01-13 12:34:24 +08:00
Mihail Geshoski
6c51299e30 MDL-68486 auth_shibboleth: Prevent using dataroot files in convert_data
Prevents configuring the 'Data modification API' (convert_data) setting
to use files located within the $CFG->dataroot directory as it exposes
the site to security risks.
2021-01-13 12:34:24 +08:00
Eloy Lafuente (stronk7)
fbb0767536 MDL-69475 versions: bump all versions and requires in master
version = 2021052500 release version
requires= 2021052500 same than version

Why 20210525? (25th May 2021) ?

Because master is going to be Moodle 4.0, to be released
on November 2021. And, until then, we are going to have
a couple of "intermediate" releases:

- Moodle 3.10 to be released 9th November 2020. (2020110900)

  This version will be using versions from today to 2020110900
  (once it's released the YYYYMMDD part stops advancing).

- Moodle 3.11 to be released 10th May 2021. (2021051000)

  This version will be using versions from 3.10 release to 2021051000
  (once it's released the YYYYMMDD part stops advancing).

That means that all versions from today to 2021051000 are going
to be used by those 2 "intermediate" releases (3.10 and 3.11).

And we cannot use them in master, because it's forbidden to have
any overlapping of versions between branches (or different upgrade
paths will fail).

So, get that 2021051000, let's add it a couple of weeks to cover
the on-sync period (or a 2 weeks delay max!) and, the first version
that master can "own" in exclusive (without any overlap) is, exactly,
25th May 2021, hence our 20210525.
2020-08-18 00:47:15 +02:00
Eloy Lafuente (stronk7)
b764343e5a MDL-69044 upgrade: add 3.9.0 separation line to all upgrade scripts 2020-06-14 13:08:09 +02:00
Eloy Lafuente (stronk7)
115cc0214f MDL-68973 versions: bump all versions and requires near release
version = 2020061500 release version
requires= 2020060900 current rc1 (week7roll1) version
2020-06-09 16:23:09 +02:00
Paul Holden
1e89b1d686 MDL-59303 auth_shibboleth: consistent readme URL. 2020-02-07 14:25:15 +00:00
Sara Arjona
a26cfe71d3 MDL-65809 upgrade: clean < 3.5.0 upgrade steps
This just deletes all the upgrade steps previous to 3.5.0. Some
small adjustments, like tweaking globals can also be applied
when needed.

Also includes an upgrade step to prevent upgrading from any
version < 2018051700 (v3.5.0) as anti-cheating measure.

Previous commits have removed/deprecated all the upgradelib functions
not used anymore in codebase. Deletion has been documented in corresponding
upgrade.txt files:

- upgrade_fix_block_instance_configuration()
- upgrade_theme_is_from_family(), upgrade_find_theme_location()
and linkcoursesectionsupgradescriptwasrun setting
- upgrade_block_positions
- upgrade_fix_config_auth_plugin_names()
 and upgrade_fix_config_auth_plugin_defaults()
- format_xxx_upgrade_remove_numsections(), format_xxx_upgrade_hide_extra_sections()
and format_xxx_upgrade_add_empty_sections()
- filter_mathjaxloader_upgrade_cdn_cloudflare()
and filter_mathjaxloader_upgrade_mathjaxconfig_equal()
- get_assignments_with_rescaled_null_grades()

These have been kept because continue being used by restore:

- \core\task\refresh_mod_calendar_events_task
2019-12-20 12:20:43 +01:00
Sara Arjona
089e918033 MDL-65809 upgrade: remove upgrade_fix_config_auth_plugin_names
These functions were used only by deleted upgrade steps
so it's safe to proceed with straight deletion, considering
them internal. Deletion has been documented in corresponding
upgrade.txt files:

- upgrade_fix_config_auth_plugin_names()
- upgrade_fix_config_auth_plugin_defaults()
2019-12-20 12:20:43 +01:00
Eloy Lafuente (stronk7)
492d047d11 MDL-67284 upgrade: add 3.8.0 separation line to all upgrade scripts 2019-11-17 11:40:19 +01:00
Eloy Lafuente (stronk7)
d5be859063 MDL-67199 versions: bump all versions and requires near release
version = 2019111800 release version
requires= 2019111200 current beta (week7roll1) version
2019-11-12 17:57:08 +01:00
Johan Dobbelstein
5b39bf184d MDL-66582 auth: Fix empty auth_logo in CAS/Shibboleth auth plugins
* set $idp['iconurl'] = null if no auth_logo
* lib/templates/loginform.mustache will skip NULL iconurls
* lib/ajax/service?info=tool_mobile_get_public_config will validate the NULL values
2019-10-31 12:03:39 +01:00
Helen Foster
08a114cf40 MDL-66003 lang: Import fixed English strings (en_fix)
Significant string changes:

* moodleorghubname,core_admin and
  sitemustberegistered,message_airnotifier - 'Moodle.net' changed to
  'Moodle'

* registration_help,core_admin and registermoochtips,core_hub - removed
  erroneous 'access to Moodle.net our course sharing platform'

* trackingtype_help,mod_forum and formnotavailable,core_grading and
  showgrades_help,core and rolewarning_help,core_rating -
  'Administration block' changed to 'Actions menu or admin block',
  'navigation block' changed to 'navigation drawer or block'
2019-06-25 18:00:51 +02:00
Eloy Lafuente (stronk7)
3572a25cc3 MDL-65644 upgrade: add 3.7.0 separation line to all upgrade scripts 2019-05-20 19:35:05 +02:00
Eloy Lafuente (stronk7)
c9a1a6341c MDL-65571 versions: bump all versions and requires near release
version = 2019052000 release version
requires= 2019051100 current beta (week6roll2) version
2019-05-12 23:46:34 +02:00
Mathew May
5cac5fa428 MDL-64506 templates: BS2 m-x-x to BS4 mx-x 2019-04-03 19:47:11 +08:00
Helen Foster
38dc5b9677 MDL-64943 lang: Import fixed English strings (en_fix)
Significant string changes:

* importgroups_help,core_group - Correcting optional fieldnames
  (removing picture, hidepicture and adding groupidnumber, groupingname
  and enablemessaging)

* penaltyforeachincorrecttry_help,core_question - additional paragraph
  about scoring logic

* resultdownloadready,tool_dataprivacy - wording corrected (no need to
  go to a download page)

* auth_dbfielduser,auth_db - varchar data type requirement
2019-02-28 09:50:18 +01:00
Jun Pataleta
0cd5b1652d MDL-62973 auth_shibboleth: Delete unused print_idp_list() function
This is only being used by the now-deleted login_form.html. No point
keeping it.
2019-01-21 16:05:39 +08:00
Jun Pataleta
6e4985bf0f MDL-62973 auth_shibboleth: Make login form look nicer
* Convert login form to a mustache template
* Bring logic in auth/shibboleth/login.php
* Replace usage of $_POST variable with optional_param()
* Remove unused index_form.html
2019-01-21 16:05:39 +08:00
Eloy Lafuente (stronk7)
a12207be25 MDL-63276 upgrade: clean < 3.2.0 upgrade steps
3.7 (min PHP 7.1) requires 3.2 (first version supporting PHP 7.1)

This just deletes all the upgrade steps previous to 3.2.0. Some
small adjustments, like adding missing MOODLE_INTERNAL or tweaking
globals can also be applied when needed.

Also includes an upgrade step to prevent upgrading from any
version < 2016120500 (v3.2.0) as anti-cheating measure.

Next commit will get rid of/deprecate all the upgradelib functions
not used anymore in codebase. (note there isn't any this time).
2019-01-03 01:17:17 +01:00
Eloy Lafuente (stronk7)
f47c8f3525 MDL-64300 upgrade: add 3.6.0 separation line to all upgrade scripts 2018-12-02 18:36:40 +01:00
Eloy Lafuente (stronk7)
085353b315 MDL-64282 versions: bump all versions and requires near release
version = 2018120300 release version
requires= 2018112800 current rc2 (week7roll1) version
2018-11-29 18:24:08 +01:00
Jun Pataleta
e862985a69 MDL-63183 auth_shibboleth: Don't render page when already logged in 2018-11-07 00:14:48 +01:00
Jun Pataleta
5f9955b5a0 MDL-63183 auth_shibboleth: Add hidden login token in guest login form 2018-11-07 00:14:48 +01:00
Damyon Wiese
6dfe428363 MDL-63183 auth: Login protection
CSRF protection for the login form. The authenticate_user_login function was
extended to validate the token (in \core\session\manager) but by default it
does not perform the extra validation. Existing uses of this function from
auth plugins and features like "change password" will continue to work without
changes. New config value $CFG->disablelogintoken can bypass this check.
2018-11-07 00:14:48 +01:00
David Monllao
af0671c218 Merge branch 'MDL-60435_master' of git://github.com/markn86/moodle 2018-07-30 13:37:12 +02:00
Jun Pataleta
f7497ace8a Merge branch 'MDL-62919-master' of git://github.com/cescobedo/moodle 2018-07-24 16:24:39 +08:00
cescobedo
9de1a91532 MDL-62919 auth_shibboleth: Use the right shibboleth_auth_instructions
Change $CFG->auth_instructions by shibboleth/auth_instructions in the index_form.html
2018-07-17 21:06:44 +02:00
Tim Schroeder
0f1dffe6af MDL-61351 auth_shibboleth: removed redundant session handler class check 2018-07-17 16:45:20 +08:00
Mark Nelson
4beca90f3d MDL-61351 auth_shibboleth: move new functions to separate class
This reduces the amount of code to an already confusing logout.php
file and prevents conflicts if someone else happens to be using
the same function name in a file.
2018-07-17 16:45:20 +08:00
Tim Schroeder
1e737e38f9 MDL-61351 shibboleth: Logout: fix session handler class not being used
* use $CFG->session_handler_class to determine which type of session is
  used
* if not set, use $CFG->dbsession instead
2018-07-17 15:27:26 +08:00
Mark Nelson
c61a4a9d21 MDL-60435 auth_shibboleth: changed accepted image types 2018-07-16 18:31:57 +08:00
Mark Nelson
87647c07fb MDL-60435 auth_shibboleth: dont display button if not configured 2018-07-16 18:31:57 +08:00
Mark Nelson
4826b1e42b MDL-60435 auth_shibboleth: removed usage of deprecated loginhttps 2018-07-16 18:31:57 +08:00
fabmen
c637d96786 MDL-60435 auth_shibboleth: Display IDPs for Authentication Shibboleth.
Using Identity Providers for Authentication Shibboleth, instead of a manual link.
2018-07-16 18:31:52 +08:00
Didier 'OdyX' Raboud
90ae1b90f1
MDL-62753 shibboleth: Logout: fix DB sessions kill
* Use the Moodle 2+ {sessions} table, and decode the session
  correctly using session_decode (adodb_unserialize is deprecated).
* Kill all user sessions using \core\session\manager's
  kill_user_sessions.
2018-07-05 08:57:03 +02:00
Eloy Lafuente (stronk7)
00977e984e MDL-62478 upgrade: add 3.5.0 separation line to all upgrade scripts 2018-05-28 13:15:48 +02:00
Eloy Lafuente (stronk7)
57ea6753d3 MDL-62361 versions: bump all versions and requires near release
version = 2018051400 release version
requires= 2018050800 current beta+ (week4roll1) version
2018-05-09 02:46:30 +02:00
cescobedo
6291e67b11 MDL-61873 auth: Add privacy implementation for all auth plugins
None of the Auth plugins (except manual and oauth2) have any user preference or database table.
They all implement the null provider.
2018-04-07 11:24:17 +02:00
Eloy Lafuente (stronk7)
6499085f36 MDL-60784 upgrade: add 3.4.0 separation line to all upgrade scripts 2017-11-12 18:43:30 +01:00
Eloy Lafuente (stronk7)
ba854606e6 MDL-60764 versions: bump all versions and requires near release
version = 2017111300 release version
requires= 2017110800 current rc2 version
2017-11-10 02:52:53 +01:00
John Okely
672f483670 MDL-42834 admin: Removal of httpswwwroot 2017-10-23 12:25:36 +08:00
John Okely
4b501ec96b MDL-42834 admin: Deprecate https_required and verify_https_required 2017-10-23 12:25:35 +08:00
Eloy Lafuente (stronk7)
5e27228335 MDL-58933 upgrade: add 3.3.0 separation line to all upgrade scripts 2017-05-19 19:22:07 +02:00
Eloy Lafuente (stronk7)
d989ee1e03 MDL-58853 versions: bump all versions and requires near release
version = 2017051500 release version
requires= 2017050500 current rc1 version
2017-05-09 02:58:28 +02:00
David Mudrák
2b948c204a MDL-58793 auth: Do not report migrated settings as new ones on upgrade
As a result of fixing the auth plugins config storage in MDL-12689, many
settings would be falsely reported as new ones by
admin/upgradesettings.php. We do not want to confuse admins so we try to
reduce the bewilderment by pre-populating the config_plugins table with
default values. This should be done only for disabled auth methods. The
enabled methods have their settings already stored, so reporting actual
new settings for them is valid.
2017-05-08 11:51:55 +02:00