Security Issue: Moodle login page logs the user in without a password about wp2moodle-moodle HOT 3 CLOSED

Pushed a patch that closes this hole, sorry all for the inconvenience!

from wp2moodle-moodle.

Thank you! We wanted to notify you about it. This is a great plugin and we are currently working on a patch that will verify the password on WordPress if a user tries to login from the Moodle page and then return true if validated at the user end. I would love to share the patch with you if you are interested in adding it to your plugin.

from wp2moodle-moodle.

that would be great. i initially didn’t do it because i didn’t want to use the same salts between installations (security, again). I imagine you’ll pass over the hashed password and salt from wordpress and store those somehow (setting them in files is of course the most secure), and then modify the login function to perform the same hash during the database lookup. Let me know how you go (or fork and merge request it on github)

Tim St. Clair
http://about.me/timstclair/

On 10 Feb 2015, at 2:32 am, Mukarram Syed [email protected] wrote:

Thank you! We wanted to notify you about it. This is a great plugin and we are currently working on a patch that will verify the password on WordPress if a user tries to login from the Moodle page and then return true if validated at the user end. I would love to share the patch with you if you are interested in adding it to your plugin.

—
Reply to this email directly or view it on GitHub #12 (comment).

from wp2moodle-moodle.