search

orca-nrw / crossplatform-moodle-lti-plugin

GNU General Public License v3.0
3 stars 5 forks source link

LTI 1.3-MOODLE `name` claim value is HTML encoded #104

Closed wazelin closed 11 months ago

wazelin commented 11 months ago

Describe the bug OIDC profile scope name claim value is getting HTML encoded.

To Reproduce Steps to reproduce the behaviour:

  1. Have a student with special characters in the first or last name, e.g. D'andre Thompson
  2. Assign the profile to a course
  3. Start the course via LTI 1.3
  4. Observe that the name claim is HTML encoded (D'andre Thompson), while given_name and family_name claims are not.

Expected behaviour name claim value is not HTML-encoded (D'andre Thompson)

Possible solutions / proposals Modify https://github.com/orca-nrw/crossplatform-moodle-lti-plugin/blob/main_311/locallib.php#L924, so that it no-longer HTML-encodes the value, i.e. to $requestparams['lis_person_name_full'] = fullname($USER, true); fullname() by default will produce a displayable value. It's not needed here. The claims must be simple character strings with no additional encoding. Providing true as the second argument will no longer produce a displayable name, but will provision the full name as-is.

Screenshots If applicable, add screenshots to help explain your problem.

Software versions (please complete the following information): TBD

Additional context TBD