tjhunt [Tue, 20 Nov 2007 15:08:05 +0000 (15:08 +0000)]
MDL-12133 - Errors calling parent::validation in a moodle form subclass because the base class method returns true not an empty array. This patch allow subclasses to start their validate method with
$errors = parent::validation($data, $files);
which is what you naturally want to do if you are used to object oriented programming.
tjhunt [Tue, 20 Nov 2007 12:41:04 +0000 (12:41 +0000)]
MDL-12133 - Errors calling parent::validation in a moodle form subclass because the base class method signature was changed. This patch fixes all calls to parent::validation in the question editing forms. Merged from MOODLE_19_STABLE.
martinlanghoff [Tue, 20 Nov 2007 00:18:31 +0000 (00:18 +0000)]
accesslib: has_capability_in_accessdata() respects rdef locality a bit more
With this patch, we respect rdef locality when two roles
assignments in the same context have conflicting rdefs.
In that case, the most local rdef wins.
So RA locality still matters most. If you are a teacher
sitewide and a student in course X, student role trumps
teacher.
For a use case, see the discussion here
http://moodle.org/mod/forum/discuss.php?d=84472
Notes:
- If we wanted to have locality of RDEF trump everything
we can. A comment in this patch shows how.
- I don't know how to reproduce this in pure SQL.
And Also:
This patch also fixes a bug where if CAP_PROHIBIT was set
_and_ another role added to it in the same context, we would
add or substract 1 to CAP_PROHIBIT, and it would lose its magic.
And while at it, tighten the code to avoid casts. All the
ints are unambiguously ints.
martinlanghoff [Mon, 19 Nov 2007 02:43:48 +0000 (02:43 +0000)]
user_login() was not converted to using get_cache_flags().
It was still using the 'old' get_config() interface, so the 'cookie'
set by ntlmsso_finish() wasn't retrieved at all, and the automatic
login always failed.
Signed-off-by: Iñaki Arenaza <iarenuno@eteo.mondragon.edu>
Author: Iñaki Arenaza <iarenuno@eteo.mondragon.edu>
Committer: Martin Langhoff <martin@catalyst.net.nz>
martinlanghoff [Mon, 19 Nov 2007 02:43:34 +0000 (02:43 +0000)]
If the cache flag is not set, it doesn't make sense trying to test its value
Signed-off-by: Iñaki Arenaza <iarenuno@eteo.mondragon.edu>
Author: Iñaki Arenaza <iarenuno@eteo.mondragon.edu>
Committer: Martin Langhoff <martin@catalyst.net.nz>
martinlanghoff [Mon, 19 Nov 2007 02:43:16 +0000 (02:43 +0000)]
Fix typo in ntlmsso_finish()
Signed-off-by: Iñaki Arenaza <iarenuno@eteo.mondragon.edu>
Author: Iñaki Arenaza <iarenuno@eteo.mondragon.edu>
Committer: Martin Langhoff <martin@catalyst.net.nz>
urs_hunkler [Fri, 16 Nov 2007 13:33:51 +0000 (13:33 +0000)]
merged from 1.9 :: MDL-12221 :: Added wrapper functions for print_box, print_box_start and print_box_end to be able to add custom_corners to any boxes.
If you call print_custom_corners_box with the same parameters as print_box and custom_corners is enabled you get the custom corners divs within those boxes and can style them accordingly.
urs_hunkler [Fri, 16 Nov 2007 07:29:14 +0000 (07:29 +0000)]
merged from 1.9 :: MDL-12045 :: the extra "clearer" div broke the custom_corners theme on IE7. I removed the "clearer" div and added the class "clerafix" to the surrounding coursebox.
martinlanghoff [Wed, 14 Nov 2007 22:23:45 +0000 (22:23 +0000)]
MDL-12178 auth/ldap: "creators" role assignment now also supports contexts
Now the DNs that indicate a course-creator role can also be contexts.
This way we support one more widely used practice in the weird and
wonderful LDAP world...
martinlanghoff [Wed, 14 Nov 2007 22:12:57 +0000 (22:12 +0000)]
MDL-9399 auth/ldap: NTLM temp sessions now use cache_flags
cache_flags is now the apropriate way to manage this kind of temp
data. It gives us time expiry and GC for free, so it's a perfect fit
for the job, as it simplifies the code a bit.
martinlanghoff [Wed, 14 Nov 2007 22:09:59 +0000 (22:09 +0000)]
MDL-9399 auth/ldap: Tighten NTLM AD checks to the appropriate OU
From Iñaki Arenaza...
Right now, if someone logs in via NTLM magic, we don't check if that
user is inside the contexts specified in the LDAP settings. I mean,
if I want to restrict my Moodle site to those users inside a given OU
or subtree of my LDAP directory, with the current code any valid user
in my whole AD domain (and if we are using a GC as the LDAP server,
the whole forest) can log in. We should check that the user is inside
one of the configured contexts before allowing his/her to log in.
Something along the lines of the attached patch could do it.
martinlanghoff [Wed, 14 Nov 2007 22:09:45 +0000 (22:09 +0000)]
MDL-9399 auth/ldap: ntlmsso_finish() now completes the user session setup
As Iñaki points out, ntlmsso_finish() needs to do all the setup that
login/index.php would do for a user once auth succeeds. With this
patch, the session setup is complete so the logon is usable.
martinlanghoff [Wed, 14 Nov 2007 22:08:11 +0000 (22:08 +0000)]
MDL-9399 auth/ldap: flesh out ntlmsso_* functions
Flesh out the functions that get the job done. These will be triggered
by PHP files sitting under auth/ldap/ ...
ntlmsso_magic() - here is where the magic happens. Call it serving
something harmless, like a space GIF, from a URL that is blessed with
Integrated Windows Authentication. If the IWA is successful, it will
set a special session cookie in config_plugins table.
It won't complete the job because when we are under IWA magic we
cannot change (even read!) the session data, as the execution happens
under the OS privileges of the actual user acct being logged in (!!!)
ntlmsso_finish() - if it finds the session set by ntlmsso_magic() and
it hasn't expired, it will finish the job of logging in the user, by
calling authenticate_user_login() and exercising the whole auth
machinery.
user_login() - when called by authenticate_user_login() it will check
to see if there's a session setup by ntlmsso_magic() and OK the login
without really asking the AD backend to proof a password we don't have
anyway.
A work in progress -- initial loginpage_hook() and headers for the
remaining functions. One thing to consider here is that this won't
work if there's a proxy in the middle.
martinlanghoff [Wed, 14 Nov 2007 22:06:17 +0000 (22:06 +0000)]
MDL-9399 - auth/shibboleth: ensure we load enrolments
Most of this code should be replaced with complete_user_login() but it
does a few odd things, so we'll play it safe for now, specially since
I don't have a Shib setup to test...
martinlanghoff [Wed, 14 Nov 2007 22:04:05 +0000 (22:04 +0000)]
accesslib: Move check_enrolment_plugins() to complete_user_login()
... where it belongs ;-)
load_all_capabiloties() gets called at several points where we don't
want to be re-querying the enrolment backends. It needs to be called
before load_all_capabilities() and only by callers that are setting up
a logon session.
Those callers need to be calling complete_user_login() anyway, as they
need to set the Moodle cookie, log the logon action, etc. In fact,
those callers duplicate a lot of that code already.
The callers that don't duplicate code for the login are actually the
cases where the backend enrolment plugins should not be queried.
projects / moodle.git / log