mahara-contributors team mailing list archive

[Mahara Bot <1859605@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/10715
Committed: https://git.mahara.org/mahara/mahara/commit/3a306423f2e96c7c086d51a01abeb476ab740f80
Submitter: Robert Lyon (robertl@xxxxxxxxxxxxxxx)
Branch:    19.04_STABLE

commit 3a306423f2e96c7c086d51a01abeb476ab740f80
Author: Peter Spicer <peter.spicer@xxxxxxxxxxxxxxx>
Date:   Mon Jan 13 17:40:13 2020 +0000

Bug 1859605 Allow MNET remote peer to be included in CSP

When using Mahara preview from Moodle grading interface, this initiates
an MNET jump inside an iframe, which fails due to the remotewwwhost not
being specified inside the Content-Security-Policy. Mahara does make
this configurable, but not from inside the MNET workflow by default.

Change-Id: I26cd51f98e7b1880367eedadfaad41aad3a88138
behatnotneeded: Requires MNET to be configured

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1859605

Title:
  Mahara portfolio as Moodle assignment cannot be previewed

Status in Mahara:
  Fix Committed
Status in Mahara 18.10 series:
  In Progress
Status in Mahara 19.04 series:
  Fix Committed
Status in Mahara 19.10 series:
  Fix Committed
Status in Mahara 20.04 series:
  Fix Committed

Bug description:
  When using the assignsubmission_mahara plugin to connect Moodle
  assignments to Mahara, the link to view the portfolio works fine to
  open Mahara, but the preview iframe in Moodle doesn't.

  This is because MNET auth doesn't set up the session in the same way
  as LTI does with the CSP being set to allow such things. Fixing this
  is mostly a matter of copying the setup code into the MNET landing
  page:

      $parts = parse_url($remotewwwroot);
      $cspurl = $parts['scheme'] . '://' . $parts['host'];
      $SESSION->set('csp-ancestor-exemption', $cspurl);

  I am mindful that LTI is considered the future direction of Mahara,
  but we have customers who use MNET and can't move to LTI because it
  does not meet their needs at this time, and this improves the workflow
  a tiny bit for them without a significant overhaul of anything.

  Happy to submit as a formal patch for all currently supported versions
  of Mahara if that would help.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1859605/+subscriptions