2 // This file is part of Moodle - http://moodle.org/
4 // Moodle is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
9 // Moodle is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // You should have received a copy of the GNU General Public License
15 // along with Moodle. If not, see <http://www.gnu.org/licenses/>.
18 * This file responds to a login authentication request
21 * @copyright 2019 Stephen Vickers
22 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
25 require_once(__DIR__
. '/../../config.php');
26 require_once($CFG->dirroot
. '/mod/lti/locallib.php');
27 global $_POST, $_SERVER;
29 if (!isloggedin() && empty($_POST['repost'])) {
30 header_remove("Set-Cookie");
31 $PAGE->set_pagelayout('popup');
32 $PAGE->set_context(context_system
::instance());
33 $output = $PAGE->get_renderer('mod_lti');
34 $page = new \mod_lti\output\repost_crosssite_page
($_SERVER['REQUEST_URI'], $_POST);
35 echo $output->header();
36 echo $output->render($page);
37 echo $output->footer();
41 $scope = optional_param('scope', '', PARAM_TEXT
);
42 $responsetype = optional_param('response_type', '', PARAM_TEXT
);
43 $clientid = optional_param('client_id', '', PARAM_TEXT
);
44 $redirecturi = optional_param('redirect_uri', '', PARAM_URL
);
45 $loginhint = optional_param('login_hint', '', PARAM_TEXT
);
46 $ltimessagehintenc = optional_param('lti_message_hint', '', PARAM_TEXT
);
47 $state = optional_param('state', '', PARAM_TEXT
);
48 $responsemode = optional_param('response_mode', '', PARAM_TEXT
);
49 $nonce = optional_param('nonce', '', PARAM_TEXT
);
50 $prompt = optional_param('prompt', '', PARAM_TEXT
);
52 $ok = !empty($scope) && !empty($responsetype) && !empty($clientid) &&
53 !empty($redirecturi) && !empty($loginhint) &&
57 $error = 'invalid_request';
59 $ltimessagehint = json_decode($ltimessagehintenc);
60 $ok = $ok && isset($ltimessagehint->launchid
);
62 $error = 'invalid_request';
63 $desc = 'No launch id in LTI hint';
65 if ($ok && ($scope !== 'openid')) {
67 $error = 'invalid_scope';
69 if ($ok && ($responsetype !== 'id_token')) {
71 $error = 'unsupported_response_type';
74 $launchid = $ltimessagehint->launchid
;
75 list($courseid, $typeid, $id, $messagetype, $foruserid, $titleb64, $textb64) = explode(',', $SESSION->$launchid, 7);
76 unset($SESSION->$launchid);
77 $config = lti_get_type_type_config($typeid);
78 $ok = ($clientid === $config->lti_clientid
);
80 $error = 'unauthorized_client';
83 if ($ok && ($loginhint !== $USER->id
)) {
85 $error = 'access_denied';
88 // If we're unable to load up config; we cannot trust the redirect uri for POSTing to.
90 throw new moodle_exception('invalidrequest', 'error');
92 $uris = array_map("trim", explode("\n", $config->lti_redirectionuris
));
93 if (!in_array($redirecturi, $uris)) {
94 throw new moodle_exception('invalidrequest', 'error');
98 if (isset($responsemode)) {
99 $ok = ($responsemode === 'form_post');
101 $error = 'invalid_request';
102 $desc = 'Invalid response_mode';
106 $error = 'invalid_request';
107 $desc = 'Missing response_mode';
110 if ($ok && !empty($prompt) && ($prompt !== 'none')) {
112 $error = 'invalid_request';
113 $desc = 'Invalid prompt';
117 $course = $DB->get_record('course', array('id' => $courseid), '*', MUST_EXIST
);
119 $cm = get_coursemodule_from_id('lti', $id, 0, false, MUST_EXIST
);
120 $context = context_module
::instance($cm->id
);
121 require_login($course, true, $cm);
122 require_capability('mod/lti:view', $context);
123 $lti = $DB->get_record('lti', array('id' => $cm->instance
), '*', MUST_EXIST
);
124 $lti->cmid
= $cm->id
;
125 list($endpoint, $params) = lti_get_launch_data($lti, $nonce, $messagetype, $foruserid);
127 require_login($course);
128 $context = context_course
::instance($courseid);
129 require_capability('moodle/course:manageactivities', $context);
130 require_capability('mod/lti:addcoursetool', $context);
131 // Set the return URL. We send the launch container along to help us avoid frames-within-frames when the user returns.
133 'course' => $courseid,
135 'sesskey' => sesskey()
137 $returnurl = new \
moodle_url('/mod/lti/contentitem_return.php', $returnurlparams);
138 // Prepare the request.
139 $title = base64_decode($titleb64);
140 $text = base64_decode($textb64);
141 $request = lti_build_content_item_selection_request($typeid, $course, $returnurl, $title, $text,
142 [], [], false, true, false, false, false, $nonce);
143 $endpoint = $request->url
;
144 $params = $request->params
;
147 $params['error'] = $error;
149 $params['error_description'] = $desc;
153 $params['state'] = $state;
155 unset($SESSION->lti_message_hint
);
156 $r = '<form action="' . $redirecturi . "\" name=\"ltiAuthForm\" id=\"ltiAuthForm\" " .
157 "method=\"post\" enctype=\"application/x-www-form-urlencoded\">\n";
158 if (!empty($params)) {
159 foreach ($params as $key => $value) {
160 $key = htmlspecialchars($key, ENT_COMPAT
);
161 $value = htmlspecialchars($value, ENT_COMPAT
);
162 $r .= " <input type=\"hidden\" name=\"{$key}\" value=\"{$value}\"/>\n";
166 $r .= "<script type=\"text/javascript\">\n" .
168 "document.ltiAuthForm.submit();\n" .