<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Have tested and committed these changes.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>That last block of code re the session does need to remain in auth_config.php or move somewhere else if auth_config is to be depricated.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> xerte-dev-bounces@lists.nottingham.ac.uk [mailto:xerte-dev-bounces@lists.nottingham.ac.uk] <b>On Behalf Of </b>Ron Mitchell<br><b>Sent:</b> 24 November 2015 11:43<br><b>To:</b> 'For Xerte technical developers'<br><b>Subject:</b> [Xerte-dev] Re: Moving the moodle restriction code?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Ok I'll make those changes.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>What about the last block of code e.g.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>if($xerte_toolkits_site->authentication_method == "Moodle") {<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> // skip session_start() as we'll probably stomp on Moodle's session if we do. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>}<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>else {<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> session_start();<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>}<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Does that need to remain in auth_config.php and can that move to moodle_restrictions.php too? I'll test that but have a hunch that needs to remain where it is?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We need to be careful about those upgrading so I'm not sure auth_config.php should be removed in case an admin updates the code but doesn't run upgrade.php - does the new code account for that scenario?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Need to update various bits of the documentation once that code is merged?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Ron<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> <a href="mailto:xerte-dev-bounces@lists.nottingham.ac.uk">xerte-dev-bounces@lists.nottingham.ac.uk</a> [<a href="mailto:xerte-dev-bounces@lists.nottingham.ac.uk">mailto:xerte-dev-bounces@lists.nottingham.ac.uk</a>] <b>On Behalf Of </b>Tom Reijnders<br><b>Sent:</b> 24 November 2015 11:30<br><b>To:</b> For Xerte technical developers<br><b>Subject:</b> [Xerte-dev] Re: Moving the moodle restriction code?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>Agree. That should work nicely. Also it solves another issue: What to do with that code if I merge in the code that Len did to be able to set authentication during setup and in the management page.<o:p></o:p></p><div><p class=MsoNormal>Op 24-11-2015 om 12:29 schreef Ron Mitchell:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal>Hi all<o:p></o:p></p><p class=MsoNormal>I was made aware of a slight issue with the Moodle authentication recently and have investigated further and confirmed that in certain scenarios there is an issue but I think an easy enough fix…<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>In auth_config.php we have some uncommented and commented code specific to moodle authentication. First we have an uncommented/active section of code where it checks if the authentication method set is Moodle and if so then checks if the logged in username is guest and if it is displays a you don't have permissions message to prevent guest users from authoring with xerte. We've had this for a long time and it mostly works ok but if the moodle allows guest login to courses that contain links to public xerte LO's this code also prevents access to those LO's not just to the workspace. If someone visits the public links without first logging in to Moodle as guest then it works fine. I think this has been the case for quite a while now but isn't often picked up as an issue because it's only an issue in this specific scenario. I also think it only became an issue when the authentication code was moved in a much earlier version.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I've tested the following but wanted to check your thoughts before making the changes and committing….<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>1. Move the uncommented //restrict moodle guest access code and the commented //restrict moodle access via custom moodle profile field named xot code to a new file names moodle_restrictions.php<o:p></o:p></p><p class=MsoNormal>2. add a require to that file around line 46 of index.php just under login_processing2();<o:p></o:p></p><p class=MsoNormal>3. Update moodle_integration_readme.txt accordingly<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>This change means that the code still works and prevents access to the authoring workspace but doesn't prevent access to public LO's even if logged in to moodle as guest.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Ok for me to make and commit these changes? <o:p></o:p></p><p class=MsoNormal>Or is there a different/better way to achieve this?<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Ron<o:p></o:p></p><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>This message and any attachment are intended solely for the addressee<o:p></o:p></pre><pre>and may contain confidential information. If you have received this<o:p></o:p></pre><pre>message in error, please send it back to me, and immediately delete it. <o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Please do not use, copy or disclose the information contained in this<o:p></o:p></pre><pre>message or in any attachment. Any views or opinions expressed by the<o:p></o:p></pre><pre>author of this email do not necessarily reflect the views of the<o:p></o:p></pre><pre>University of Nottingham.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>This message has been checked for viruses but the contents of an<o:p></o:p></pre><pre>attachment may still contain software viruses which could damage your<o:p></o:p></pre><pre>computer system, you are advised to perform your own checks. Email<o:p></o:p></pre><pre>communications with the University of Nottingham may be monitored as<o:p></o:p></pre><pre>permitted by UK legislation.<o:p></o:p></pre><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br><o:p></o:p></span></p><pre>_______________________________________________<o:p></o:p></pre><pre>Xerte-dev mailing list<o:p></o:p></pre><pre><a href="mailto:Xerte-dev@lists.nottingham.ac.uk">Xerte-dev@lists.nottingham.ac.uk</a><o:p></o:p></pre><pre><a href="http://lists.nottingham.ac.uk/mailman/listinfo/xerte-dev">http://lists.nottingham.ac.uk/mailman/listinfo/xerte-dev</a><o:p></o:p></pre></blockquote><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p><pre>-- <o:p></o:p></pre><pre>--<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Tom Reijnders<o:p></o:p></pre><pre>TOR Informatica<o:p></o:p></pre><pre>Chopinlaan 27<o:p></o:p></pre><pre>5242HM Rosmalen<o:p></o:p></pre><pre>Tel: 073 5226191<o:p></o:p></pre><pre>Fax: 073 5226196<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>This message and any attachment are intended solely for the addressee<o:p></o:p></pre><pre>and may contain confidential information. If you have received this<o:p></o:p></pre><pre>message in error, please send it back to me, and immediately delete it. <o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Please do not use, copy or disclose the information contained in this<o:p></o:p></pre><pre>message or in any attachment. Any views or opinions expressed by the<o:p></o:p></pre><pre>author of this email do not necessarily reflect the views of the<o:p></o:p></pre><pre>University of Nottingham.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>This message has been checked for viruses but the contents of an<o:p></o:p></pre><pre>attachment may still contain software viruses which could damage your<o:p></o:p></pre><pre>computer system, you are advised to perform your own checks. Email<o:p></o:p></pre><pre>communications with the University of Nottingham may be monitored as<o:p></o:p></pre><pre>permitted by UK legislation.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>This message and any attachment are intended solely for the addressee<o:p></o:p></pre><pre>and may contain confidential information. If you have received this<o:p></o:p></pre><pre>message in error, please send it back to me, and immediately delete it. <o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Please do not use, copy or disclose the information contained in this<o:p></o:p></pre><pre>message or in any attachment. Any views or opinions expressed by the<o:p></o:p></pre><pre>author of this email do not necessarily reflect the views of the<o:p></o:p></pre><pre>University of Nottingham.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>This message has been checked for viruses but the contents of an<o:p></o:p></pre><pre>attachment may still contain software viruses which could damage your<o:p></o:p></pre><pre>computer system, you are advised to perform your own checks. Email<o:p></o:p></pre><pre>communications with the University of Nottingham may be monitored as<o:p></o:p></pre><pre>permitted by UK legislation.<o:p></o:p></pre></div></body></html>