search

dualcube / moodle-enrol_stripepayment

Moodle Stripe Payment Collector
16 stars 27 forks source link

secret key leak on js is fixed #45

Closed thelonewolf123 closed 3 years ago

thelonewolf123 commented 3 years ago

This project contained some serious vulnerabilities,

  1. Sensitive data exposure # file - enrol.php from line no. 187 
    'secretkey' : "<?php echo $this->get_config('secretkey'); ?>",
'amount' : "<?php echo str_replace(".", "", $cost); ?>",
'currency' : "<?php echo strtolower($instance->currency); ?>",
'description' : "<?php echo 'Enrolment charge for '.$coursefullname; ?>",
'courseid' : "<?php echo $course->id; ?>",
'receiptemail' : emailId,

from the above code, you can see the plugin leaking the stripe secret key. This key should be stored on the server and never exposed to the public.