1. 20 Dec, 2019 1 commit
    • Sara Arjona's avatar
      MDL-65809 upgrade: remove upgrade_fix_config_auth_plugin_names · 089e9180
      Sara Arjona authored
      These functions were used only by deleted upgrade steps
      so it's safe to proceed with straight deletion, considering
      them internal. Deletion has been documented in corresponding
      upgrade.txt files:
      - upgrade_fix_config_auth_plugin_names()
      - upgrade_fix_config_auth_plugin_defaults()
  2. 08 Apr, 2019 1 commit
  3. 07 Nov, 2018 1 commit
    • Damyon Wiese's avatar
      MDL-63183 auth: Login protection · 6dfe4283
      Damyon Wiese authored
      CSRF protection for the login form. The authenticate_user_login function was
      extended to validate the token (in \core\session\manager) but by default it
      does not perform the extra validation. Existing uses of this function from
      auth plugins and features like "change password" will continue to work without
      changes. New config value $CFG->disablelogintoken can bypass this check.
  4. 15 Mar, 2018 1 commit
    • Marina Glancy's avatar
      MDL-61477 admin: sitepolicy handler API · 1727c939
      Marina Glancy authored
      - Define sitepolicy handler manager class, base class and the core handler
      - Allow to set a plugin as sitepolicyhandler that implements the sitepolicy API
      - Modify web services to return information from the 3rd party handler instead of core if needed
  5. 19 Dec, 2017 1 commit
  6. 08 May, 2017 1 commit
    • David Mudrák's avatar
      MDL-58793 auth: Do not report migrated settings as new ones on upgrade · 2b948c20
      David Mudrák authored
      As a result of fixing the auth plugins config storage in MDL-12689, many
      settings would be falsely reported as new ones by
      admin/upgradesettings.php. We do not want to confuse admins so we try to
      reduce the bewilderment by pre-populating the config_plugins table with
      default values. This should be done only for disabled auth methods. The
      enabled methods have their settings already stored, so reporting actual
      new settings for them is valid.
  7. 03 May, 2017 1 commit
    • David Mudrák's avatar
      MDL-58692 auth: Improve the migration of auth setting names · 31bd1023
      David Mudrák authored
      Some auth plugins used to have a mix of the legacy style of plugin names
      in config_plugins table (such as 'auth/mnet') and the new correct
      style (such as 'auth_mnet'). Attempting to rename the setting plugin via
      low level SQL UPDATE could lead to duplicate key violation.
      The patch introduces a new helper function to safely migrate the old
      settings to the new ones, eventually informing the admin about the
      values mismatch.
  8. 18 Apr, 2017 1 commit
  9. 03 Apr, 2017 1 commit
  10. 24 Nov, 2016 1 commit
  11. 10 Nov, 2016 1 commit
  12. 28 Oct, 2016 1 commit
  13. 19 Oct, 2016 1 commit
  14. 31 May, 2016 1 commit
    • Jakob's avatar
      MDL-53306 auth: Add hook for auth plugins to access user object. · cffd0fa1
      Jakob authored
      Add a hook for auth plugins to be able to modify or check a user, before
      raising any authentication errors.
      The auth plugin needs to add a public function like this:
       * Pre user_login hook.
       * This method is called from authenticate_user_login() right after the user
       * object is generated. This gives the auth plugins an option to make adjustments
       * before the verification process starts.
       * @param object $user user object, later used for $USER
      public function pre_user_login_hook(&$user) {
          // Override if needed.
  15. 16 Sep, 2015 1 commit
  16. 02 Apr, 2015 1 commit
  17. 01 Dec, 2014 1 commit
  18. 21 Nov, 2014 1 commit
  19. 26 Aug, 2014 1 commit
  20. 07 Aug, 2014 1 commit
  21. 03 Dec, 2013 1 commit
  22. 06 Aug, 2013 1 commit
  23. 07 Aug, 2012 1 commit
  24. 06 Jul, 2012 1 commit
  25. 03 Nov, 2011 1 commit
  26. 16 Oct, 2011 1 commit
    • Petr Skoda's avatar
      MDL-29602 accesslib improvements · e922fe23
      Petr Skoda authored
      Refactoring and improvements of the accesslib.php library including prevention of access for not-logged-in users when forcelogin enabled, improved context caching, OOP refactoring of contexts, fixed context loading, deduplication of role definitions in user sessions, installation improvements, decoupling of enrolment checking from capability loading, added detection of deleted and non-existent users in has_capability(), new function accesslib test, auth and enrol upgrade notes.
      More details are available in tracker subtasks.