WP Manifestindependent plugin directory

UoE LTI WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Provides a Learning Tools Interoperability (LTI) integration for creating WordPress blogs with appropriate user roles based on roles set within the Virtual Learning Environment (VLE)

★ 12stars
v1.4.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/uoe-dlam/ed-lti/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This plugin allows Virtual Learning Environment (VLE) users to create blogs on a WordPress multisite installation through the use of Learning Tools Interoperability (LTI) tools. The plugin is designed to make it easy to integrate WordPress with a VLE course to provide an individual or group working space for students. It isn't designed to support course materials on an external WordPress site being included in the VLE.

In this case, the LTI Consumer is the VLE (e.g. Moodle) and WordPress is the LTI Provider. VLE roles are mapped to appropriate WordPress roles in all cases.

This is a single plugin that supports 2 different use cases:

  1. Course Blog: A single blog that is shared by all students in a course.
  2. Student Blog: A single blog for every student in a course.

Differentiating these two different uses of blogs is done as part of setting up the LTI tool in your VLE of choice. You set up the LTI tool at system level twice in the VLE, giving each instance a suitably descriptive name, and including custom parameters that tells the plugin in WordPress which behaviour to provide.

Teachers are then able to drop an instance of the tool into their course wherever it’s required.

Course Blogs

The first VLE user to click on a course blog tool link will be taken to the WordPress multisite install and a blog will be created for the course. The user will also be made a member of the blog. Any subsequent users that click on the link are added to the blog as a member. Teachers on the course will get the WordPress Administrator role and students will be added as WordPress Authors.

Student Blogs

If a VLE user with the student role clicks on a student blog tool link they are taken to the WordPress multisite install and a blog is created for them. The student is added to the blog with the Wordpress Administrator role. Teachers on the course who follow the student tool link will be taken to a WordPress page with a list of links to all the student blogs associated with the course. If the Teacher clicks on one of the links, they are given the WordPress Author role and taken to the home page of the blog.

Associated Plugins

This plugin works with the following plugins (none of which are mandatory):

  • NS Cloner - Site Copier
  • Multisite Privacy
  • More Privacy Options

If NS Cloner is installed and activated. NS Cloner will be used to create blogs instead of WordPress Core.

If the Multisite Privacy plugin or the More Privacy Option plugins are installed, Wordpress admin have the option of making new blogs private on creation. If neither of these plugins are installed, blogs will always be made public on creation.

Installation and Configuration

WordPress

This plugin relies on Composer libraries. Please ensure you run composer install in the root directory to download all dependencies prior to installing this plugin. For more information on Composer you can visit the Composer website.

  1. Copy the ed-lti folder to the plugins folder. Note: for instructions on how to install a plugin manually, please visit WordPress for dummies
  2. From Network Admin > Plugins select the plugin and click Network Activate.
  3. Go to Network Admin > Settings > LTI Consumer Keys and enter a name, key and password. Make a note of the key and password, as they will be needed when you create an LTI tool in your VLE.
  4. Check Enabled to activate your key.
  5. Go to Network Admin > Settings > LTI Settings and enter the URL of the blog that you would like to use as the template for new blogs. This value defaults to the root blog if left empty.
  6. If one of the privacy plugins is installed, you have the option of making blogs private on site creation. You can also enter the URL for a help page that is included in error messages. If this field is left empty, error messages will not include help info.

VLE Settings

After you have installed and configured the plugin in WordPress, you will need to create LTI tools in your VLE. You should create separate tools for student and course blogs. You can find more info about creating LTI tools on Moodle and Learn on their sites:

You should name your tool appropriately; e.g, WordPress Course, WordPress Student.

The tool URL is the URL of your WordPress install; e.g., https://<mydomain.com>/index.php. Important: you must include index.php after your domain or the link won't work.

You should include the consumer key and password that you created in WordPress admin. You should use the same consumer key password pair for both course and student LTI tool configurations. If you use more than one VLE, it is recommended that you create a separate key password pair (in WordPress) for each VLE that you use; i.e. use one key password pair for Moodle and another for Learn.

For course tools, you do not need to add any custom parameters. For student tools, you must include the following custom parameter:

blog_type=student

You will also probably want to set your tool to launch in a new window, although this is not mandatory.

Further Information

Multiple Blogs in a Course

It’s possible to have more than one instance of the tool per course, which could be useful for the Course Blogs behaviour above where you might want to have a few different activities within a course, each of which are supported by a WordPress blog.

If you add a second course tool link to a course, when the first user clicks on the link a second blog will be created for the course, which will include appropriate version info. For example, the title of the blog will be My Course Blog 2. Each new link will result in an additional blog for the course. This is also true for student blogs, so it is possible for students to have multiple individual blogs for a course.

Sub-Course Group Blogs

If you are using groups within your VLE to limit access to a series of resources that support a learning activity, you can drop an instance of the blog tool into each group and the VLE permissions that restrict access to the group will take care of making sure that only the students in that group can get onto the blog. Probably the Course Blog behaviour is the one that’s most useful here too.

Requirements

The following versions of PHP are supported:

  • PHP 7.0
  • PHP 7.1
  • PHP 7.2

The following versions of WordPress are supported.

  • WordPress 4.9.8

Note: It is very possible that this plugin will work with earlier versions of WordPress, but it has only been tested on the above.

Changelog

See the project changelog

Support

Bugs and feature requests are tracked on GitHub.

If you have any questions about ed-lti please open a ticket here; please don't email the address below.

License

This package is released under the GNU License. See the bundled LICENSE file for details.

Credits

This code is principally developed and maintained by the University of Edinburgh's Digital Learning Applications and Media team .

This plugin was inspired by the IMS Basic Learning Tools Interoperability plugin (developed by Chuck Severance & Antoni Bertran). Some of the code used in this plugin is borrowed from that plugin. For further details, please visit IMS Global

This plugin also makes use of the PHP LTI Tool Provider Library developed by IMS Global. For further details, please visit GitHub

Releases

8 releases.

Tag
Published
v1.4.0 latest
Mar 17, 2025 1 year ago
Sep 29, 2020 6 years ago
Jul 9, 2020 6 years ago
Apr 30, 2020 6 years ago
Jun 21, 2019 7 years ago
Dec 5, 2018 7 years ago
Nov 23, 2018 7 years ago
Nov 23, 2018 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

UoE LTI 1.3.1 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
1.3.1
Findings
2
Worst severity
high
Content hash
38630efe64178b0433187c4b…

Findings

  • high LTI launch mints a session for any existing WordPress login matching the LMS username

    auth_bypass

    do_launch runs on parse_request for unauthenticated basic-lti-launch-request POSTs to the main site. After IMS OAuth HMAC-SHA1 succeeds, get_username_from_request() returns raw $_REQUEST ext_user_username, else lis_person_sourcedid, else user_id — not $tool->user->getId() and not a consumer-key-prefixed ID (the bundled IMS library's ID_SCOPE_GLOBAL). first_or_create_user does get_user_by('login', $username) and, if a row exists, returns that WP_User with no email match, no 'provisioned by LTI' flag, and no is_super_admin() refusal. signin_user then wp_set_auth_cookie($user->ID, true, true) (persistent 14-day secure cookie) and redirects into the new blog. A learner whose VLE username equals an existing account — the common default 'admin' on both Moodle and WordPress, or any other colliding login — receives that user's full capabilities, including network super admin. Anyone who knows an enabled consumer secret (plaintext in {$wpdb->base_prefix}lti2_consumer, shown in Network Admin → LTI Consumers Keys, and copied into the VLE tool config) can also sign a launch with an arbitrary ext_user_username. New users are created with a random password; existing users keep theirs, so the victim can still log in while the attacker holds a parallel session.

    classes/class-ed-lti.php:104-118,194-207,246-271,296-302

    Recommendation

    Never bind an LTI identity to an existing WordPress login. Derive the WP user_login from the consumer key plus LTI user_id (IMS ID_SCOPE_GLOBAL), store the LTI user_id in usermeta, and only auto-login that provisioned user. If linking to a pre-existing account is required, demand a matching verified email and refuse is_super_admin() accounts. Read the username from the OAuth-verified ToolProvider user object, not $_REQUEST.

  • low Git tag, plugin header, and readme report three different versions

    version_mismatch

    The audited artifact is GitHub tag v1.4.0 (slug ed-lti-1.4.0, changelog 1.4.0 dated 2025-03-17) but ed-lti.php still declares Version: 1.3.1 and readme.txt still declares Stable tag/Version 1.2.0 (Tested up to 4.9.10). Inventory, Update URI-less GitHub installs, and WordPress's plugin row will disagree on whether 1.4.0 is present, so operators cannot tell whether they are running the NS Cloner / PHP 8 changes from the 1.4.0 tag.

    ed-lti.php:3-11

    Recommendation

    Set Plugin Name header Version, readme.txt Stable tag, and the git tag to the same value (1.4.0) on each release so operators and scanners can identify the build.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.