As the OTPHP library now utilizes a PSR-20: clock we can make use of it.
Also the the parameter '' will become mandatory in 12.0.0. So we are
asked to set a valid PSR Clock implementation instead of 'null'.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
With the OTPHP upgrade from v10.x to v11.x, the behaviour of the window
feature changed substantially. With version 10, the window of timestamps
goes from `timestamp - window * period` to `timestamp + window *
period`. For example, if the window is 5, the period 30 and the
timestamp 1476822000, the OTP tested are within 1476821850 (`1476822000
- 5 * 30`) and 1476822150 (`1476822000 + 5 * 30`). In other words, this
validated the 5 OTP before and after the current timestamp. With version
11, the TOTP window acts as a time drift. If the window is 15, the
period 30, and the current timestamp is 147682209, the OTP tested are
within 147682194 (`147682209 - 15`), 147682209 and 147682224 (`147682209
+ 15`). The window shall be lower than the period. Therefore, this test
includes the previous OTP but not the next one.
This change required an adaption to align our implementation with OTPHP.
The window of valid TOTP tokens is now much narrower. This change in
functionality is a security improvement, but it also means that the time
on the device generating the TOTP token must be more accurate. As OTPHP
restricts the window to be strictly lower than the period, our admin
setting now has a maximum allowed value of 29. To ensure we only have
valid window values, we need to update the admin setting to a value
lower than 30; therefore, we include an upgrade step.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
Integrates a submissions page link into the assignment's secondary
navigation, eliminates the redundant 'View all submissions' button
from the assignment's homepage and updates the existing behat tests.
Create entity definitions for competencies, frameworks and users
for new report source to provide data for report editor.
AMOS BEGIN
CPY [competencyframework,tool_lp],[competencyframework,core_competency]
CPY [proficient,tool_lp],[proficient,core_competency]
CPY [rating,tool_lp],[rating,core_competency]
CPY [taxonomy_competency,core_competency],[competency,core_competency]
AMOS END
Unfortunately PHP does not provide any means to autoload the files that
a functions is located in, even if they are in an namespace.
To work around this, Composer makes use of an `autoload.files` section
in the `composer.json` file. Shortly after the Composer autoloader is
registered with the `spl_autoload_register` call it also includes any
files listed in this section.
Moodle does not do this and really we should be doing so.
This change adds a section to the autoloader registration method which
loads all of the files defined in any third-party library included in
our `lib` directory which contains any `composer.json` file with such a
stanza.
This commit removes the dependency Assert that once was required by
OTPHP, but is no longer needed as of version 11.2.0.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
Notable changes:
- The OTPHP library requires now at least PHP 8.1.
- The OTPHP library now relies on the MBString extension. This extension
is now a required dependency.
- The OTPHP library now utilizes a PSR-20: clock.
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
