fmido88 / moodle-auth_wallet Goto Github PK

This code here:
https://github.com/fmido88/moodle-auth_wallet/blob/main/confirm.php#L84-L87

could allow a malicious user to iterate over the site and find valid usernames - it would be more secure to return a generic exception and use that same exception text when the AUTH_CONFIRM_ERROR is returned from the confirm function.

that way if a user passes an invalid username and secret, it doesn't allow the exposure of usernames in the site.

you also use code like this to obtain the users - which also includes all other authentication types on the site - manual/saml/oauth etc:
$user = get_complete_user_data('username', $username);

It might be tidier to use a function that only returns users that have the "auth" field in the user table set to "wallet"