New configuration variable: secureforms (defaults to 'true')

Replaces the old $CFG->buggy_referer (reverses it, in fact) and can
now be set in the configuration page (no need for it in config.php).

diff --git a/admin/config.html b/admin/config.html
index 64f9ff2bf77cfa7e9ef9f3a7766d56121555bf04..63eb1653ece19a56b4d68ac48d784997a06e5fed 100644 (file)
--- a/admin/config.html
+++ b/admin/config.html
@@ -287,6 +287,21 @@
     <?php print_string("configframename") ?>
     </td>
 </tr>
+<tr valign=top>
+       <td align=right><p>secureforms:</td>
+       <td>
+    <?php 
+       unset($options);
+       $options[0]  = get_string("no");
+       $options[1]  = get_string("yes");
+
+       choose_from_menu ($options, "secureforms", $config->secureforms, "", "", "");
+    ?>
+    </td>
+    <td>
+    <?php print_string("configsecureforms") ?>
+    </td>
+</tr>
 
 
 <tr>

diff --git a/admin/config.php b/admin/config.php
index 623b3ab17176d7afe13b46d9c05411468de51b79..944e868e154efffa258d71d722c238c660be5f2a 100644 (file)
--- a/admin/config.php
+++ b/admin/config.php
@@ -33,9 +33,16 @@
     }
 
 
+/// This is to overcome the "insecure forms paradox"
+    if (isset($secureforms) and $secureforms == 0) {
+        $match = "nomatch";
+    } else {
+        $match = "";
+    }
+
 /// If data submitted, then process and store.
 
-       if ($config = data_submitted()) {
+       if ($config = data_submitted($match)) {  
 
         validate_form($config, $err);
 

diff --git a/config-dist.php b/config-dist.php
index 0093b62f288a51467de92d297fa80bdd13c7c617..d9b99e4a46f499d86f39acc865ab86daae52e399 100644 (file)
--- a/config-dist.php
+++ b/config-dist.php
@@ -111,7 +111,7 @@ $CFG->directorypermissions = 0777;
 \r
 \r
 //=========================================================================\r
-// 6. ADMIN LOCATION  (most people can just ignore this setting)\r
+// 6. DIRECTORY LOCATION  (most people can just ignore this setting)\r
 //=========================================================================\r
 // A very few webhosts use /admin as a special URL for you to access a \r
 // control panel or something.  Unfortunately this conflicts with the \r
@@ -122,18 +122,6 @@ $CFG->directorypermissions = 0777;
 $CFG->admin = "admin";\r
 \r
 \r
-//=========================================================================\r
-// 7. TROUBLESHOOTING  (most people can just ignore this setting)\r
-//=========================================================================\r
-// A very small percentage of servers have a bug which causes HTTP_REFERER\r
-// not to work.  The symptoms of this are that you fill out the configure\r
-// form during Moodle setup but when hit save you find yourself on the \r
-// same form, unable to progress.  If this happens to you, come back here\r
-// and set the following to true.  Otherwise this should always be false.\r
-\r
-$CFG->buggy_referer = false;\r
-\r
-\r
 //=========================================================================\r
 // ALL DONE!  To continue your setup, visit your Moodle web page.\r
 //=========================================================================\r

diff --git a/lang/en/moodle.php b/lang/en/moodle.php
index 9dbc4201699f08125d38d39f58f51dec9bc8c5e8..e2539888d604d0e226a7099183d3ea7c83f6c45f 100644 (file)
--- a/lang/en/moodle.php
+++ b/lang/en/moodle.php
@@ -66,6 +66,7 @@ $string['configcountry'] = "If you set a country here, then this country will be
 $string['configdebug'] = "If you turn this on, then PHP's error_reporting will be increased so that more warnings are printed.  This is only useful for developers.";
 $string['configgdversion'] = "Indicate the version of GD that is installed.  The version shown by default is the one that has been auto-detected.  Don't change this unless you really know what you're doing.";
 $string['configerrorlevel'] = "Choose the amount of PHP warnings that you want to be displayed.  Normal is usually the best choice.";
+$string['configsecureforms'] = "Moodle can use an additional level of security when accepting data from web forms. If this is enabled, then the browser's HTTP_REFERER variable is checked against the current form address.  In a very few cases this can cause problems if the user is using a firewall (eg Zonealarm) configured to strip HTTP_REFERER from their web traffic.  Symptoms are getting 'stuck' on a form. If your users are having problems with the login page (for example) you might want to disable this setting, although it might leave your site more open to brute-force password attacks.  If in doubt, leave this set to 'Yes'.";
 $string['confightmleditor'] = "Choose whether or not to allow use of the embedded HTML text editor. Even if you choose allow, this editor will only appear when the user is using a compatible browser (IE 5.5 or later).  Users can also choose not to use it.";
 $string['configintro'] = "On this page you can specify a number of configuration variables that help make Moodle work properly on your server.  Don't worry too much about it - the defaults will usually work fine and you can always come back to this page later and change these settings.";
 $string['configintroadmin'] = "On this page you should configure your main administrator account which will have complete control over the site. Make sure you give it a secure username and password as well as a valid email address.  You can create more admin accounts later on.";

diff --git a/lib/defaults.php b/lib/defaults.php
index db054facd657f7647297b1892bac0695f403273b..02f3d63985c9c88deb39fc538f057e00263d9637 100644 (file)
--- a/lib/defaults.php
+++ b/lib/defaults.php
@@ -8,6 +8,7 @@
        "changepassword"   =>  true,
        "country"          => "",
        "debug"            =>  7,
+       "secureforms"      =>  true,
        "framename"        =>  "_top",
        "gdversion"        =>  1,
        "guestloginbutton" =>  1,

diff --git a/lib/weblib.php b/lib/weblib.php
index b0eba3b8d9ecfdf7fd04a163bd2933d01896db9d..81b386be0fb0c8dd07adf6614027a48ee725ec28 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -134,11 +134,11 @@ function match_referer($goodreferer = "") {
 /// goodreferer is not specified, use qualified_me as the goodreferer 
     global $CFG;
 
-    if (!empty($CFG->buggy_referer)) {
+    if (empty($CFG->secureforms)) {    // Don't bother checking referer
         return true;
     }
 
-    if ($goodreferer == "nomatch") {
+    if ($goodreferer == "nomatch") {   // Don't bother checking referer
         return true;
     }