With the OTPHP upgrade from v10.x to v11.x, the behaviour of the window
feature changed substantially. With version 10, the window of timestamps
goes from `timestamp - window * period` to `timestamp + window *
period`. For example, if the window is 5, the period 30 and the
timestamp 1476822000, the OTP tested are within 1476821850 (`1476822000
- 5 * 30`) and 1476822150 (`1476822000 + 5 * 30`). In other words, this
validated the 5 OTP before and after the current timestamp. With version
11, the TOTP window acts as a time drift. If the window is 15, the
period 30, and the current timestamp is 147682209, the OTP tested are
within 147682194 (`147682209 - 15`), 147682209 and 147682224 (`147682209
+ 15`). The window shall be lower than the period. Therefore, this test
includes the previous OTP but not the next one.
This change required an adaption to align our implementation with OTPHP.
The window of valid TOTP tokens is now much narrower. This change in
functionality is a security improvement, but it also means that the time
on the device generating the TOTP token must be more accurate. As OTPHP
restricts the window to be strictly lower than the period, our admin
setting now has a maximum allowed value of 29. To ensure we only have
valid window values, we need to update the admin setting to a value
lower than 30; therefore, we include an upgrade step.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
This commit removes the dependency Assert that once was required by
OTPHP, but is no longer needed as of version 11.2.0.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
Notable changes:
- The OTPHP library requires now at least PHP 8.1.
- The OTPHP library now relies on the MBString extension. This extension
is now a required dependency.
- The OTPHP library now utilizes a PSR-20: clock.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
Removes the default null value from the deprecated parameter $course,
which was introduced as part of its deprecation. Since PHP 8.0, it
is deprecated to declare functions where an optional parameter is
followed by a required parameter, as is the case here. Therefore,
the default value needs to be removed.
Deprecates the $course parameter in the constructor of the
core_course\output\actionbar\group_selector class. This parameter is no
longer used, as the $course object can now be obtained through the
$context class property. Additionaly, the $course class property has
been removed in accordance with this change.
The group selector renderable class should extend the comboboxsearch
renderable class to eliminate the need for initializing the
comboboxsearch object within the export_for_template() method and to
prevent duplicating the get_template() method.
This change ensures that the group selector correctly appears on the
submission page, adhering to the assignment's group mode settings or
the enforced group mode set by the course.
The group selector component should be sensitive to the current context
to ensure accurate validation and retrieval of group settings
(e.g. group mode).
