Hi,

I found that this module is simple and great.
But I have some problems with Moodle "bakery" plugin.

When I click login link on Moodle I have been redirected to Drupal login page with GET arg return_dest, and after successful login I still placed on Drupal side.

There is no any redirects back to Moodle in this case, but if I go to the Moodle manually, I will be logged in.

CommentFileSizeAuthor
#6 bakery-moodle_integration-2535628-6.patch998 byteskala4ek
#5 bakery-moodle_integration-2535628-5.patch953 byteskala4ek
#1 bakery-moodle_integration-2535628-1.patch635 byteskala4ek
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
CreditAttribution: kala4ek as a volunteer and at DrupalJedi commented
Status: Needs work » Needs review
FileSize
bakery-moodle_integration-2535628-1.patch635 bytes

I've created simple patch, that fix it for me.
Please, review it, I think it'll help to smb else.

eugene.ilyin’s picture

eugene.ilyin CreditAttribution: eugene.ilyin commented
Status: Needs review » Reviewed & tested by the community

This patch works well for me! Thank you

drumm’s picture

drumm
he/him
Location NY, US
CreditAttribution: drumm at Drupal Association commented
Status: Reviewed & tested by the community » Needs work 
      drupal_add_http_header('Location', urldecode($_GET['return_dest']));

This looks like a security issue. At best, arbitrary redirection. Maybe arbitrary header injection if newlines can get through urldecode().

For Drupal.org we have similar functionality in custom code, http://cgit.drupalcode.org/drupalorg_crosssite/tree/drupalorg_crosssite..... This checks that the redirection is in a whitelist of expected domains.

kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
CreditAttribution: kala4ek as a volunteer and at DrupalJedi commented
Assigned: Unassigned » kala4ek

Will update patch soon

kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
CreditAttribution: kala4ek as a volunteer and at DrupalJedi commented
Status: Needs work » Needs review
FileSize
bakery-moodle_integration-2535628-5.patch953 bytes

Updated patch, now redirect can be done only to one of slaves.

kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
CreditAttribution: kala4ek as a volunteer and at DrupalJedi commented
FileSize
bakery-moodle_integration-2535628-6.patch998 bytes

Wrong one, this is right patch.

kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
CreditAttribution: kala4ek as a volunteer and at DrupalJedi commented
Assigned: kala4ek » Unassigned