Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: Minor
Fix Version/s: 4.4.9, 4.5.5, 5.0.1
Affects Version/s: 2.9.6, 3.0.4, 4.4.5
Component/s: Blog
Labels:

Affected Branches:
MOODLE_29_STABLE, MOODLE_30_STABLE, MOODLE_404_STABLE
Fixed Branches:
MOODLE_404_STABLE, MOODLE_405_STABLE, MOODLE_500_STABLE
Pull from Repository:
https://github.com/paulholden/moodle/
Pull 4.4 Branch:
~~MDL-55034~~-404
Pull 4.4 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_404_STABLE...paulholden:MDL-55034-404
Pull 4.5 Branch:
~~MDL-55034~~-405
Pull 4.5 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_405_STABLE...paulholden:MDL-55034-405
Pull 5.0 Branch:
~~MDL-55034~~-500
Pull 5.0 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_500_STABLE...paulholden:MDL-55034-500
Pull Main Branch:
~~MDL-55034~~
Pull Main Diff URL:
https://github.com/moodle/moodle/compare/main...paulholden:MDL-55034
Testing Instructions:
Hide

Log in as admin

Navigate to Site Admin > General > Advanced features > Enable blogs > ensure this is ticked

Navigate to Preferences from user menu

Press Blogs > Register an external blog

RSS feed URL: https://feeds.bbci.co.uk/sport/football/rss.xml (or use any other feed you like)

Name: Football

From subsequent External blogs table, press the Delete icon for your new blog

Confirm URL does not include sesskey=... parameter

Press Continue in the confirmation step

Confirm the blog is deleted and you see the following message:
External blog unregistered
Show
Log in as admin Navigate to Site Admin > General > Advanced features > Enable blogs > ensure this is ticked Navigate to Preferences from user menu Press Blogs > Register an external blog RSS feed URL: https://feeds.bbci.co.uk/sport/football/rss.xml (or use any other feed you like) Name: Football From subsequent External blogs table, press the Delete icon for your new blog Confirm URL does not include sesskey=... parameter Press Continue in the confirmation step Confirm the blog is deleted and you see the following message: External blog unregistered
Pre-check results:
Hide

Code verified against automated checks.

Checked ~~MDL-55034~~ using repository: https://github.com/paulholden/moodle/

MOODLE_404_STABLE (0 errors / 0 warnings) [branch: MDL-55034-404 | CI Job]

MOODLE_405_STABLE (0 errors / 0 warnings) [branch: MDL-55034-405 | CI Job]

MOODLE_500_STABLE (0 errors / 0 warnings) [branch: MDL-55034-500 | CI Job]

main (0 errors / 0 warnings) [branch: MDL-55034 | CI Job]

_{More information about this report}

Built on: Mon Apr 14 17:19:10 UTC 2025
Show
Code verified against automated checks. Checked MDL-55034 using repository: https://github.com/paulholden/moodle/ MOODLE_404_STABLE (0 errors / 0 warnings) [branch: MDL-55034-404 | CI Job ] MOODLE_405_STABLE (0 errors / 0 warnings) [branch: MDL-55034-405 | CI Job ] MOODLE_500_STABLE (0 errors / 0 warnings) [branch: MDL-55034-500 | CI Job ] main (0 errors / 0 warnings) [branch: MDL-55034 | CI Job ] More information about this report Built on: Mon Apr 14 17:19:10 UTC 2025
Automated test results:
Hide

Launching automatic jobs for branch ~~MDL-55034~~-404

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19023/ PHPUnit (sqlsrv)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65053/ Behat (NonJS - boost and classic)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65054/ Behat (Firefox - boost)

Launching automatic jobs for branch ~~MDL-55034~~-405

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19024/ PHPUnit (sqlsrv)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65055/ Behat (NonJS - boost and classic)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65056/ Behat (Firefox - boost)

Launching automatic jobs for branch ~~MDL-55034~~-500

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19025/ PHPUnit (sqlsrv)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65057/ Behat (NonJS - boost and classic)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65058/ Behat (Firefox - boost)

Launching automatic jobs for branch ~~MDL-55034~~

https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19026/ PHPUnit (sqlsrv)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65059/ Behat (NonJS - boost and classic)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65060/ Behat (Firefox - boost) --> Unrelated (can be ignored)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65061/ Behat (Firefox - classic) --> Unrelated (can be ignored)

https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65062/ App tests (stable app version) --> Unrelated (can be ignored)

Built on: Mon Apr 14 18:25:25 UTC 2025
Show
Launching automatic jobs for branch MDL-55034 -404 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19023/ PHPUnit (sqlsrv) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65053/ Behat (NonJS - boost and classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65054/ Behat (Firefox - boost) Launching automatic jobs for branch MDL-55034 -405 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19024/ PHPUnit (sqlsrv) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65055/ Behat (NonJS - boost and classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65056/ Behat (Firefox - boost) Launching automatic jobs for branch MDL-55034 -500 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19025/ PHPUnit (sqlsrv) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65057/ Behat (NonJS - boost and classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65058/ Behat (Firefox - boost) Launching automatic jobs for branch MDL-55034 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/19026/ PHPUnit (sqlsrv) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65059/ Behat (NonJS - boost and classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65060/ Behat (Firefox - boost) --> Unrelated (can be ignored) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65061/ Behat (Firefox - classic) --> Unrelated (can be ignored) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/65062/ App tests (stable app version) --> Unrelated (can be ignored) Built on: Mon Apr 14 18:25:25 UTC 2025

When deleting a External Blog entry from a user profile, the GET is showing the referer address with the sesskey value of the user session. This can be seen using Chrome Developer Tools Networking.

Steps to Replicate

Ensure that External Blogs are enabled in the system
Go to User Profile
Preferences > External Blogs
Add an External Blog RSS Feed and save
Open up Developer Tools in Chrome
Go to Networking
Go back to the Moodle page
Unregister/Delete blog in Moodle
Look at the GET transactions (specifically Javascript)
There will be one that has a referer that looks like the following:
https://<URL>/blog/external_blogs.php?delete=2&sesskey=<sesskey>

The system should not be sending a sesskey value as part of the GET

- - Sort By Name
  - Sort By Date
  - Ascending
  - Descending
  - Thumbnails
  - List
  - Download All

55034 peer review - confirmation step.png
56 kB
14/Apr/25 3:26 PM
55034 peer review - unregister success.png
46 kB
14/Apr/25 3:26 PM
(1) 8 Passed -- (Main)MDL-55034.png
52 kB
16/Apr/25 2:39 PM
(1) 6 Passed -- (Main)MDL-55034.png
70 kB
16/Apr/25 2:39 PM

Assignee:: Paul Holden

Reporter:: Kevin McCarthy

Peer reviewer:: Andrew Gosali

Integrator:: Sara Arjona (@sarjona)

Tester:: Kim Jared Lucas

Participants:: Andrew Gosali, Brendan Heywood, CiBoT, Gavin Porter, Kevin McCarthy, Kim Jared Lucas, Marina Glancy, Paul Holden, Sara Arjona (@sarjona)

Votes:: 2 Vote for this issue

Watchers:: 11 Start watching this issue

Created:: 28/Jun/16 9:14 AM

Updated:: 04/Jun/25 11:13 PM

Resolved:: 17/Apr/25 8:57 PM

Estimated:

Not Specified

Remaining:

Logged:

1h 49m

Details

Description

Attachments

Attachments

Activity

People

Dates

Time Tracking

Clockify