Skip to content

Update auth code validation according to RFC 6749#3163

Open
weilai-irl wants to merge 1 commit into
MOODLE_405_STABLEfrom
wip-129956-m405
Open

Update auth code validation according to RFC 6749#3163
weilai-irl wants to merge 1 commit into
MOODLE_405_STABLEfrom
wip-129956-m405

Conversation

@weilai-irl
Copy link
Copy Markdown
Collaborator

No description provided.

Copilot AI review requested due to automatic review settings May 5, 2026 14:22
@weilai-irl weilai-irl self-assigned this May 5, 2026
@weilai-irl weilai-irl added this to the 2026-02 milestone May 5, 2026
@weilai-irl weilai-irl linked an issue May 5, 2026 that may be closed by this pull request
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the validation logic for OIDC redirect parameters (notably the authorization code and state) in the auth_oidc auth-code login flow, aiming to accept a wider set of RFC-compliant values.

Changes:

  • Updated the getoidcparam() docblock to describe RFC 6749 VSCHAR-based validation.
  • Replaced the previous Base64-variant character whitelist with a visible-ASCII range-based filter.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread auth/oidc/classes/loginflow/authcode.php Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Incorrect validation of OIDC code parameter

2 participants