-
Bug
-
Resolution: Fixed
-
Critical
-
3.7
-
MOODLE_37_STABLE
-
MOODLE_37_STABLE
-
MDL-64474-master-2 -
MDL-61767 changes usernames for a user who has logged in via LDAP (or others possibly) when they use oauth2 logins.
To reproduce this, setup a site with oauth2 enabled and create a non-auth user with a username that is not their email address, but has a matching email address to an oauth2 provider.
Login with the username, and logout
Check the user table for the username.
Login with the same user but using oauth2 as the login method
Check the user table for the username and note that it has changed to the email address.
This is especially dangerous with users who are synchronized via LDAP as the sync process does not detect the oauth users as LDAP and deletes them after they have been modified.
- is a regression caused by
-
MDL-61767 Update user profile fields according to info send by OAuth2 authorization server
-
- Closed
-