Skip to content

Commit

Permalink
MDL-76362 enrol_lti: Prevent calling to DataConnector with null keys
Browse files Browse the repository at this point in the history
While it could have been fixed in DataConnector (3rd part lib), better
prevent in our code to call to it with null keys.

Covered by unit tests.
  • Loading branch information
stronk7 authored and andrewnicols committed Jan 23, 2023
1 parent 4a76c77 commit 240b193
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions enrol/lti/classes/data_connector.php
Original file line number Diff line number Diff line change
Expand Up @@ -88,16 +88,18 @@ public function loadToolConsumer($consumer) {
global $DB;

$id = $consumer->getRecordId();
$key = $consumer->getKey();
$result = false;

if (!empty($id)) {
$result = $DB->get_record($this->consumertable, ['id' => $id]);
} else {
$key256 = DataConnector::getConsumerKey($consumer->getKey());
} else if (!empty($key)) {
$key256 = DataConnector::getConsumerKey($key);
$result = $DB->get_record($this->consumertable, ['consumerkey256' => $key256]);
}

if ($result) {
if (empty($key256) || empty($result->consumerkey) || ($consumer->getKey() === $result->consumerkey)) {
if (empty($key256) || empty($result->consumerkey) || ($key === $result->consumerkey)) {
$this->build_tool_consumer_object($result, $consumer);
return true;
}
Expand Down

0 comments on commit 240b193

Please sign in to comment.