Skip to content

Commit

Permalink
MDL-73827 lib: Fix URL blocked error for userinfo endpoint
Browse files Browse the repository at this point in the history
When the oAuth2 issuer hasn't any userinfo endpoint, a call to
$this->get(false) was done, which was returning "The URL is
blocked".
This is a regression from MDL-70649, which added some cURL security
checks.
  • Loading branch information
sarjona committed Feb 10, 2022
1 parent e91a143 commit 3bb11e2
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions lib/classes/oauth2/client.php
Expand Up @@ -487,9 +487,14 @@ public function upgrade_refresh_token(system_account $systemaccount) {
* the fields back into moodle fields.
*
* @return array|false Moodle user fields for the logged in user (or false if request failed)
* @throws moodle_exception if the response is empty after decoding it.
*/
public function get_userinfo() {
$url = $this->get_issuer()->get_endpoint_url('userinfo');
if (empty($url)) {
return false;
}

$response = $this->get($url);
if (!$response) {
return false;
Expand All @@ -501,6 +506,11 @@ public function get_userinfo() {
return false;
}

if (is_null($userinfo)) {
// Throw an exception displaying the original response, because, at this point, $userinfo shouldn't be empty.
throw new moodle_exception($response);
}

return $this->map_userinfo_to_fields($userinfo);
}

Expand Down

0 comments on commit 3bb11e2

Please sign in to comment.