coalescing_panda 5.2.0.beta1 → 5.2.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bee89db63211898d79a2be426960cb091d7d4b9c384b848587c45744e40471e9
-  data.tar.gz: 06b1367659b15e63d7811a0a4ed6385f8f8925c3fac3767b9b0283bd00bd78b2
+  metadata.gz: 0f3c2a99cdf57e1876a7f60db9c9aa7ce7f9bc87da1f378e8d370b7109753868
+  data.tar.gz: 544f758cf5309d51f41d2a502039d91fa0aa3573edc93aa6a00808009965959f
 SHA512:
-  metadata.gz: c902f68f0ed0685039be21864520fe6c80bc199f74afc897b5a38a38e6ea72b335463c0de6498024871e335cb515a7b68c9fa952a384fdf8cb10da12df5e6f23
-  data.tar.gz: 6cc22dcad22c6c77a9734b818969356e5600eedef854057d06320b05e1692631e4c814106ac8179a83bb39d2bef1e5396a02df95a6f1144046b09b5eaa739b64
+  metadata.gz: 655fe3553d89cedcb82c34ce92165afdb19aea705f225ac92d1eb82eb9530f23f66b0b314e7c0d6499cc80c5c3dcdf6e8cab07875b944ce7436d6dd4fe32a6eb
+  data.tar.gz: d82c810593f9bfa9d2944e51f7dd1db61ecfdd22e5feef4b593dfc8006ea33d37c1c60bb84d6251b19c8d62debab8c8808e207bc4975c68906a4fa526792b00e

data/lib/coalescing_panda/controller_helpers.rb

@@ -93,7 +93,11 @@ module CoalescingPanda
     end
 
     def lti_authorize!(*roles)
-      return true if valid_session?
+      if valid_session? # This means that we are returning from an OAuth dance.
+        # Set the params as they were at launch to avoid any bait-and-switch attack vulnerabilities in the App's launch controller
+        params.merge!(current_session_data[:launch_params])
+        return true
+      end
 
       authorized = false
       if (@lti_account = params['oauth_consumer_key'] && LtiAccount.find_by_key(params['oauth_consumer_key']))

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '5.2.0.beta1'
+  VERSION = '5.2.0.beta2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 5.2.0.beta1
+  version: 5.2.0.beta2
 platform: ruby
 authors:
 - Nathan Mills