MDL-42097 auth: Auth plugins must check passwordurl before returning it

Mrmoodle · Dec 3, 2013 · 963cdce · 963cdce
1 parent 6513cc0
commit 963cdce
Show file tree

Hide file tree

Showing 6 changed files with 22 additions and 4 deletions.
diff --git a/auth/db/auth.php b/auth/db/auth.php
@@ -664,7 +664,7 @@ function can_change_password() {
      * @return moodle_url
      */
     function change_password_url() {
-        if ($this->is_internal()) {
+        if ($this->is_internal() || empty($this->config->changepasswordurl)) {
             // Standard form.
             return null;
         } else {

diff --git a/auth/imap/auth.php b/auth/imap/auth.php
@@ -120,7 +120,11 @@ function can_change_password() {
      * @return moodle_url
      */
     function change_password_url() {
-        return new moodle_url($this->config->changepasswordurl);
+        if (!empty($this->config->changepasswordurl)) {
+            return new moodle_url($this->config->changepasswordurl);
+        } else {
+            return null;
+        }
     }
 
     /**

diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php
@@ -1603,7 +1603,11 @@ function can_change_password() {
      */
     function change_password_url() {
         if (empty($this->config->stdchangepassword)) {
-            return new moodle_url($this->config->changepasswordurl);
+            if (!empty($this->config->changepasswordurl)) {
+                return new moodle_url($this->config->changepasswordurl);
+            } else {
+                return null;
+            }
         } else {
             return null;
         }

diff --git a/auth/pop3/auth.php b/auth/pop3/auth.php
@@ -120,7 +120,11 @@ function can_change_password() {
      * @return moodle_url
      */
     function change_password_url() {
-        return new moodle_url($this->config->changepasswordurl);
+        if (!empty($this->config->changepasswordurl)) {
+            return new moodle_url($this->config->changepasswordurl);
+        } else {
+            return null;
+        }
     }
 
     /**

diff --git a/auth/upgrade.txt b/auth/upgrade.txt
@@ -1,6 +1,10 @@
 This files describes API changes in /auth/* - plugins,
 information provided here is intended especially for developers.
 
+=== 2.7 ===
+
+* If you are returning a url in method change_password_url() from config, please make sure it is set before trying to use it.
+
 === 2.6 ===
 
 * can_be_manually_set() - This function was introduced in the base class and returns false by default. If overriden by

diff --git a/lib/authlib.php b/lib/authlib.php
@@ -159,6 +159,8 @@ function can_change_password() {
      *
      * This method is used if can_change_password() returns true.
      * This method is called only when user is logged in, it may use global $USER.
+     * If you are using a plugin config variable in this method, please make sure it is set before using it,
+     * as this method can be called even if the plugin is disabled, in which case the config values won't be set.
      *
      * @return moodle_url url of the profile page or null if standard used
      */