mahara-contributors team mailing list archive

[Mahara Bot <1394082@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/8027
Committed: https://git.mahara.org/mahara/mahara/commit/4b53f8fe307ffada7c73a91b0014c3aa7308ba16
Submitter: Robert Lyon (robertl@xxxxxxxxxxxxxxx)
Branch:    master

commit 4b53f8fe307ffada7c73a91b0014c3aa7308ba16
Author: Robert Lyon <robertl@xxxxxxxxxxxxxxx>
Date:   Tue Sep 19 11:55:31 2017 +1200

Bug 1394082: Stop mnet url fall back to added id value

behatnotneeded

Change-Id: I7ccf01a05b3a229916a4d3b4138faaaab47dd7c0
Signed-off-by: Robert Lyon <robertl@xxxxxxxxxxxxxxx>

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1394082

Title:
  Can create a URL that takes you to a different page depending on
  whether you're logged in to MNet or not.

Status in Mahara:
  Fix Committed

Bug description:
  As reported on the mahara.org forum:
  https://mahara.org/interaction/forum/topic.php?id=6549

  To replicate:

  1. Set up a Moodle instance with the Mahara assignment submission
  plugin and connect it up to your Mahara instance.

  2. Create a view with ID 1000.

  3. Create another view with ID 1001.

  4. Make both these pages accessible to the public.

  5. Set up an Mahara assignment in Moodle.

  6. Submit the view with ID 1000 to Moodle as an assignment submission.

  7. Note the access URL that gets generated, which will contain an MNet
  access token, i.e. /view/view.php?mt=abcd1234

  8. Add the ID of page 1001 to this URL:
  /view/view.php?id=1001&mt=abcd1234

  Expected Result: This URL should either display page 1000 every time,
  or an "access denied" message

  Actual Result: If you're logged in to Mahara via MNet, you see page
  1000. If you're not, you see page 1001.

  
  The cause of this problem, is that /view/view.php completely ignores the "mt=" tag if you're not logged in via MNet. In which case, if an ID is also supplied, it falls back to that.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1394082/+subscriptions