2 // This file is part of Moodle - http://moodle.org/
4 // Moodle is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
9 // Moodle is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // You should have received a copy of the GNU General Public License
15 // along with Moodle. If not, see <http://www.gnu.org/licenses/>.
18 * This file responds to a login authentication request
21 * @copyright 2019 Stephen Vickers
22 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
25 require_once(__DIR__
. '/../../config.php');
26 require_once($CFG->dirroot
. '/mod/lti/locallib.php');
28 $scope = optional_param('scope', '', PARAM_TEXT
);
29 $responsetype = optional_param('response_type', '', PARAM_TEXT
);
30 $clientid = optional_param('client_id', '', PARAM_TEXT
);
31 $redirecturi = optional_param('redirect_uri', '', PARAM_TEXT
);
32 $loginhint = optional_param('login_hint', '', PARAM_TEXT
);
33 $ltimessagehint = optional_param('lti_message_hint', 0, PARAM_INT
);
34 $state = optional_param('state', '', PARAM_TEXT
);
35 $responsemode = optional_param('response_mode', '', PARAM_TEXT
);
36 $nonce = optional_param('nonce', '', PARAM_TEXT
);
37 $prompt = optional_param('prompt', '', PARAM_TEXT
);
39 $ok = !empty($scope) && !empty($responsetype) && !empty($clientid) &&
40 !empty($redirecturi) && !empty($loginhint) &&
41 !empty($nonce) && !empty($SESSION->lti_message_hint
);
44 $error = 'invalid_request';
46 if ($ok && ($scope !== 'openid')) {
48 $error = 'invalid_scope';
50 if ($ok && ($responsetype !== 'id_token')) {
52 $error = 'unsupported_response_type';
55 list($courseid, $typeid, $id, $titleb64, $textb64) = explode(',', $SESSION->lti_message_hint
, 5);
56 $ok = ($id !== $ltimessagehint);
58 $error = 'invalid_request';
60 $config = lti_get_type_type_config($typeid);
61 $ok = ($clientid === $config->lti_clientid
);
63 $error = 'unauthorized_client';
67 if ($ok && ($loginhint !== $USER->id
)) {
69 $error = 'access_denied';
72 $uris = array_map("trim", explode("\n", $config->lti_redirectionuris
));
73 $ok = in_array($redirecturi, $uris);
75 $error = 'invalid_request';
76 $desc = 'Unregistered redirect_uri ' . $redirecturi;
80 if (isset($responsemode)) {
81 $ok = ($responsemode === 'form_post');
83 $error = 'invalid_request';
84 $desc = 'Invalid response_mode';
88 $error = 'invalid_request';
89 $desc = 'Missing response_mode';
92 if ($ok && !empty($prompt) && ($prompt !== 'none')) {
94 $error = 'invalid_request';
95 $desc = 'Invalid prompt';
99 $course = $DB->get_record('course', array('id' => $courseid), '*', MUST_EXIST
);
101 $cm = get_coursemodule_from_id('lti', $id, 0, false, MUST_EXIST
);
102 $context = context_module
::instance($cm->id
);
103 require_login($course, true, $cm);
104 require_capability('mod/lti:view', $context);
105 $lti = $DB->get_record('lti', array('id' => $cm->instance
), '*', MUST_EXIST
);
106 list($endpoint, $params) = lti_get_launch_data($lti, $nonce);
108 require_login($course);
109 $context = context_course
::instance($courseid);
110 require_capability('moodle/course:manageactivities', $context);
111 require_capability('mod/lti:addcoursetool', $context);
112 // Set the return URL. We send the launch container along to help us avoid frames-within-frames when the user returns.
114 'course' => $courseid,
116 'sesskey' => sesskey()
118 $returnurl = new \
moodle_url('/mod/lti/contentitem_return.php', $returnurlparams);
119 // Prepare the request.
120 $title = base64_decode($titleb64);
121 $text = base64_decode($textb64);
122 $request = lti_build_content_item_selection_request($typeid, $course, $returnurl, $title, $text,
123 [], [], false, false, false, false, false, $nonce);
124 $endpoint = $request->url
;
125 $params = $request->params
;
128 $params['error'] = $error;
130 $params['error_description'] = $desc;
134 $params['state'] = $state;
136 unset($SESSION->lti_message_hint
);
137 $r = '<form action="' . $redirecturi . "\" name=\"ltiAuthForm\" id=\"ltiAuthForm\" " .
138 "method=\"post\" enctype=\"application/x-www-form-urlencoded\">\n";
139 if (!empty($params)) {
140 foreach ($params as $key => $value) {
141 $key = htmlspecialchars($key);
142 $value = htmlspecialchars($value);
143 $r .= " <input type=\"hidden\" name=\"{$key}\" value=\"{$value}\"/>\n";
147 $r .= "<script type=\"text/javascript\">\n" .
149 "document.ltiAuthForm.submit();\n" .