Permalink
Browse files

MDL-36838 moodle->mahara mnet SSO failure in FF17

In MDL-36838 Firefox 17 users are unable to sso from moodle to mahara.

Firefox 17 uses a different user agent (UA) string for Moodle sites than it
does for Mahara or other sites.
This patch relaxes the check which previously required that the UA string
being presented to the SP on landing matched the UA string presented to the IP
when jumping.
Likewise, checks associated with logout calls have been relaxed
  • Loading branch information...
peterbulmer committed Nov 27, 2012
1 parent e4592b2 commit b5a0e3befb0c3a5f1fa7311b5b6a095c5ab5cfc5
Showing with 6 additions and 6 deletions.
  1. +6 −6 auth/mnet/auth.php
View
@@ -46,18 +46,18 @@ function user_login($username, $password) {
}
/**
- * Return user data for the provided token, compare with user_agent string.
+ * Return user data for the provided token
*
* @param string $token The unique ID provided by remotehost.
- * @param string $UA User Agent string.
+ * @param string $UA User Agent string (as seen by SP) - ignored
* @return array $userdata Array of user info for remote host
*/
function user_authorise($token, $useragent) {
global $CFG, $SITE, $DB;
$remoteclient = get_mnet_remote_client();
require_once $CFG->dirroot . '/mnet/xmlrpc/serverlib.php';
- $mnet_session = $DB->get_record('mnet_session', array('token'=>$token, 'useragent'=>$useragent));
+ $mnet_session = $DB->get_record('mnet_session', array('token'=>$token));
if (empty($mnet_session)) {
throw new mnet_server_exception(1, 'authfail_nosessionexists');
}
@@ -1082,14 +1082,14 @@ function kill_children($username, $useragent) {
* calls the function (over xmlrpc) provides us with the mnethostid we need.
*
* @param string $username Username for session to kill
- * @param string $useragent SHA1 hash of user agent to look for
+ * @param string $useragent SHA1 hash of user agent as seen by IdP - ignored
* @return bool True on success
*/
function kill_child($username, $useragent) {
global $CFG, $DB;
$remoteclient = get_mnet_remote_client();
- $session = $DB->get_record('mnet_session', array('username'=>$username, 'mnethostid'=>$remoteclient->id, 'useragent'=>$useragent));
- $DB->delete_records('mnet_session', array('username'=>$username, 'mnethostid'=>$remoteclient->id, 'useragent'=>$useragent));
+ $session = $DB->get_record('mnet_session', array('username'=>$username, 'mnethostid'=>$remoteclient->id));
+ $DB->delete_records('mnet_session', array('username'=>$username, 'mnethostid'=>$remoteclient->id));
if (false != $session) {
session_kill($session->session_id);
return true;

0 comments on commit b5a0e3b

Please sign in to comment.