Moodle: SMB Web Client - HTTPS...

[fabled-aesop]

I've installed Moodle, SMB Web Client, and the proper certificate for secure access.

 

I've set form authentication for SMB Web Client, which I believe means that the username/password is encrypted before being passed to the remote server... however, is there anyway to for SMB Web Client to operate over HTTPS, so that the data transferred is also encrypted?

 

It probably wouldn't be an issue for students, but I imagine it might be more problematic for teaching staff, where the information transmitted might be confidential.

[CyberNerd]

the 'easy' way is to set the entire site to https - might be overkill.

in the the config.php

 

$CFG->wwwroot   = 'https:/yoursite.com'

 

better option is to put a .htaccess file in the smb_client directory to use https.

I'll have a play with this later

Edited May 20, 2008 by CyberNerd

[fabled-aesop]

better option is to put a .htaccess file in the smb_client directory to use https.

I'll have a play with this later

 

Ahh, now that sounds interesting.

[fabled-aesop]

Thanks for the hint - I've located something about using .htaccess with mod_rewrite to force https on a specific folder:

 

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} blocks/smb_web_client
RewriteRule ^(.*)$ https://my_vle_website/blocks/smb_web_client/$1 [R,L]

 

I've just tried it, and it works :-) Cool! I appreciate that it's sad trying this at 6:50 in the morning, but still, that's what remote access is for :-)

 

Cheers.

[CyberNerd]

Another method, in the file block_smb_web_client.php hardcode the line

$blockwww=$CFG->wwwroot.'/blocks/smb_web_client'

to go direct to https:

 $blockwww='https://yourvle.comblocks/smb_web_client';

[penfold_99]

CyberNerd, you missed a slash in the example, it should be

 

 $blockwww='https://yourvle.com/blocks/smb_web_client';

[allanmorris]

Have just hardcoded the https: into the php which seems to work but IE puts up an annoying prompt about displaying secure and unsecure items. I can change the settings but is there a better way? It seems the icons are the ones that are causing the warning for some reason even though they seem to be coming from the local system.

 

To Change:

 

01) Open Internet Explorer

02) Click on Tools

03) Click on Internet Options

04) Click on the Security Tab

05) Click on the Custom Level button

06) Under the Miscellaneous section look for "Display Mixed Content"

07) Click on Disable for Display Mixed Content instead of Prompt

08) Click on OK twice

09) Close Internet Explorer and reopen

10) Open the webpage that was displaying the warning message, the message should not appear now.

 

Thanks.

 

Allan.

[duncane]

Have just hardcoded the https: into the php which seems to work but IE puts up an annoying prompt about displaying secure and unsecure items. I can change the settings but is there a better way?

 

Have you hard-coded https into both places where it's used? (The code changed since this thread started).

 

There are references to http in both block_smb_web_client.php and class_smbwebclient.php - they both need changing.

Edited October 13, 2008 by duncane
I noticed a grammatical mistake.

[allanmorris]

Have you hard-coded https into both places where it's used? (The code changed since this thread started).

 

There are references to http in both block_smb_web_client.php and class_smbwebclient.php - they both need changing.

 

Hi DuncanE.

 

I've added to the 'block', under the // set block www, only. Have just had a look in the 'class' and can't see anything - but it is a big file. Could you give me a clue where to look as it's worth a try. Most students and teachers just put up with the message even though I've let them all know how to stop it so it would be great to stop it happening at all.

 

Btw, the version I'm using is 2008080500.

 

Thanks.

 

Allan.

Edited October 14, 2008 by allanmorris
Forgot some info

[duncane]

Hi DuncanE.

 

I've added to the 'block', under the // set block www, only. Have just had a look in the 'class' and can't see anything - but it is a big file. Could you give me a clue where to look as it's worth a try. Most students and teachers just put up with the message even though I've let them all know how to stop it so it would be great to stop it happening at all.

 

Btw, the version I'm using is 2008080500.

 

Thanks.

 

Allan.

 

(Please note the changes are in bold.)

 

Okay, in smb_web_client.php I have:

 

function init() {
       global $CFG;

       // Set title and version
       $this->title = get_string('blockmenutitle', 'block_smb_web_client');
       $this->title=$this->title=="[[blockmenutitle]]" ? "Online Documents" : $this->title;
       $this->version = 2008080500;

       // set block www
       $this->blockwww=$CFG->wwwroot.'/blocks/smb_web_client';
       [b]$this->blockwww=str_replace("http://", "https://", $this->blockwww);[/b]
   }

 

In class_smbwebclient.php I have:

 

# loads an HTML template
function Template ($file, $vars=array())
{
       $result = str_replace(array_keys($vars), array_values($vars), $this->GetInlineFile($file));
       [b]$result = str_replace("http://mysiteurl/", "https://mysiteurl/", $result);[/b]
       return $result;
}

 

I didn't describe it very well - sorry about that - it's actually my additions anyway that refer to the http - it's the template function that needed changing.

 

I hope that helps,

Duncan.

[allanmorris]

Hi DuncanE.

 

Your explanation was fine and I've added the 'class' code changes. It now works fine in IE which is great and will make things a bit easier for most people. I'd just add to your mail that the 'mysiteurl' has to change to your real one - in case someone types it in verbatim - and that the whole contents of the function need replacing due to your new $result var.

 

I'm finding it quite humourous that sharing Windows files only works when you use a GNU/Linux based server

 

Thanks for your help.

 

Allan.

[brudinie]

I'm the author of windows share web client.

We use the ldapcapture auth plugin to pass the credentials on to the windows share web client block.

This means that you can have a https login for your site and then not have to worry about the credentials being sent cleartext over http later.

The credentials are fed through to smbclient at the OS level so they never touch http.

 

This is the recommended method.

[allanmorris]

Hi Brudinie (Guy?)

 

Yes, we're using LDAP Capture, which works fine btw, but wanted the share client to work via https as sensitive data can pass between home and school. Now the share client windows pops up as https with a secure lock while the Moodle site stays as http. Any data passing through is secure and is much more safer than carrying a usb stick backwards and forwards. In cases like ours do you think it would be an idea to have a config switch available to use the client under https rather than have to change the code as I did?

 

Thanks.

 

Allan.

CHHS.

[brudinie]

I've modified my latest 'development' version to allow for ssl.

To enable https you add the following config variable:

 

$smb_cfg->cfgssl=true;

 

You can download the latest development version from:

http://www.ossett.wakefield.sch.uk/web/media/files/moodlegpl/head/smb_web_client.zip

 

If anyone could test this for me and give me some feedback, that would be great.

 

Thanks in advance

 

Brudinie (Guy)

[allanmorris]

Hi B(G)

 

Great have just downloaded your latest zip and I'll see if I can test on another install nearby.

 

Thanks.

 

Allan.

CHHS.