Skip to content
Browse files

MDL-28126 webservices : should not able to create token if user is de…

…leted,unconfirmed,suspended or guest.
  • Loading branch information...
1 parent 6508da4 commit 711c2728f526c048b5fb80ed282fbc5fba60f777 @mouneyrac mouneyrac committed with nebgor Nov 14, 2011
Showing with 11 additions and 2 deletions.
  1. +4 −2 admin/webservice/forms.php
  2. +6 −0 admin/webservice/tokens.php
  3. +1 −0 lang/en/webservice.php
View
6 admin/webservice/forms.php
@@ -174,7 +174,7 @@ function definition() {
class web_service_token_form extends moodleform {
function definition() {
- global $USER, $DB;
+ global $USER, $DB, $CFG;
$mform = $this->_form;
$data = $this->_customdata;
@@ -183,10 +183,12 @@ function definition() {
if (empty($data->nouserselection)) {
//user searchable selector - get all users (admin and guest included)
+ //user must be confirmed, not deleted, not suspended, not guest
$sql = "SELECT u.id, u.firstname, u.lastname
FROM {user} u
+ WHERE u.deleted = 0 AND u.confirmed = 1 AND u.suspended = 0 AND u.id != ?
ORDER BY u.lastname";
- $users = $DB->get_records_sql($sql, array());
+ $users = $DB->get_records_sql($sql, array($CFG->siteguest));
$options = array();
foreach ($users as $userid => $user) {
$options[$userid] = $user->firstname . " " . $user->lastname;
View
6 admin/webservice/tokens.php
@@ -71,6 +71,12 @@
}
}
+ //check if the user is deleted. unconfirmed, suspended or guest
+ $user = $DB->get_record('user', array('id' => $data->user));
+ if ($user->id == $CFG->siteguest or $user->deleted or !$user->confirmed or $user->suspended) {
+ throw new moodle_exception('forbiddenwsuser', 'webservice');
+ }
+
//process the creation
if (empty($errormsg)) {
//TODO improvement: either move this function from externallib.php to webservice/lib.php
View
1 lang/en/webservice.php
@@ -97,6 +97,7 @@
$string['externalserviceusers'] = 'External service users';
$string['failedtolog'] = 'Failed to log';
$string['filenameexist'] = 'File name already exists: {$a}';
+$string['forbiddenwsuser'] = 'Can not create token for a unconfirmed, deleted, suspended or guest user.';
$string['function'] = 'Function';
$string['functions'] = 'Functions';
$string['generalstructure'] = 'General structure';

0 comments on commit 711c272

Please sign in to comment.
Something went wrong with that request. Please try again.