From b2f4bf31f383caba56a9c15a188d7eac39b55619 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sa=C3=BAl=20D=C3=ADaz?= <sauldiazdiaz210@gmail.com>
Date: Thu, 8 Oct 2026 13:38:30 +0200
Subject: [PATCH] [LTI] fix: keep LTI launches working with celtic/lti 5.4.4
 and later

---
 .../class.ilAuthProviderLTI.php               |  2 +-
 .../class.ilLTIExitException.php              | 35 ++++++++++++++++
 .../InternalProvider/class.ilLTITool.php      | 40 ++++++++++++++++++-
 3 files changed, 74 insertions(+), 3 deletions(-)
 create mode 100644 components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTIExitException.php

diff --git a/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilAuthProviderLTI.php b/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilAuthProviderLTI.php
index 46903c538604..99a2ee228539 100644
--- a/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilAuthProviderLTI.php
+++ b/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilAuthProviderLTI.php
@@ -255,7 +255,7 @@ public function doAuthentication(\ilAuthStatus $status): bool
         $lti_provider->rsaKey = $pk['key'];
         $lti_provider->kid = $pk['kid'];
         $lti_provider->signatureMethod = 'RS256';
-        $lti_provider->handleRequest();
+        $lti_provider->processRequest();
         $this->provider = $lti_provider;
         $this->messageParameters = $this->provider->getMessageParameters();
 
diff --git a/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTIExitException.php b/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTIExitException.php
new file mode 100644
index 000000000000..81c72f0fb5be
--- /dev/null
+++ b/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTIExitException.php
@@ -0,0 +1,35 @@
+<?php
+
+/**
+ * This file is part of ILIAS, a powerful learning management system
+ * published by ILIAS open source e-Learning e.V.
+ *
+ * ILIAS is licensed with the GPL-3.0,
+ * see https://www.gnu.org/licenses/gpl-3.0.en.html
+ * You should have received a copy of said license along with the
+ * source code, too.
+ *
+ * If this is not the case or you just want to try ILIAS, you'll find
+ * us at:
+ * https://www.ilias.de
+ * https://github.com/ILIAS-eLearning
+ *
+ *********************************************************************/
+
+declare(strict_types=1);
+
+/**
+ * Thrown by the LTI library instead of terminating the request on its own.
+ *
+ * The library is designed to be the only thing handling an LTI request, so it ends the request
+ * itself once the message has been processed. ILIAS still has to authenticate the user and send
+ * them to the requested object afterwards, so it asks the library to throw this exception rather
+ * than to exit, and regains control in ilLTITool::processRequest().
+ */
+class ilLTIExitException extends ilException
+{
+    public function __construct(string $message = '', int $code = 0)
+    {
+        parent::__construct($message, $code);
+    }
+}
diff --git a/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTITool.php b/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTITool.php
index 9e99b5ff0756..bfda29930d1a 100644
--- a/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTITool.php
+++ b/components/ILIAS/LTIProvider/classes/InternalProvider/class.ilLTITool.php
@@ -22,6 +22,7 @@
 use ceLTIc\LTI\ResourceLink;
 use ceLTIc\LTI\Tool;
 use ceLTIc\LTI\User;
+use ceLTIc\LTI\Util;
 use ILIAS\HTTP\Wrapper\ArrayBasedRequestWrapper;
 
 /**
@@ -87,7 +88,13 @@ public function parsePostBody(ArrayBasedRequestWrapper $postData): array
         return $res;
     }
 
-    public function handleRequest(?bool $strictMode = null, bool $disableCookieCheck = false, bool $generateWarnings = false): void
+    /**
+     * Process the LTI request and return to ILIAS once the message has been accepted.
+     *
+     * This does not override handleRequest(): the library declares that method as never returning,
+     * while ILIAS needs control back to authenticate the user.
+     */
+    public function processRequest(): void
     {
         global $DIC;
 
@@ -100,6 +107,35 @@ public function handleRequest(?bool $strictMode = null, bool $disableCookieCheck
 
         self::$authenticateUsingGet = true;
 
-        parent::handleRequest($strictMode, $disableCookieCheck, $generateWarnings);
+        // The LTI library ends the request itself once the message has been processed. ILIAS still
+        // has to authenticate the user and forward them to the requested object, so the library is
+        // asked to throw instead of exiting.
+        $this->onExitExceptionClass = ilLTIExitException::class;
+
+        try {
+            $this->handleRequest();
+        } catch (ilLTIExitException $e) {
+            $this->sendPendingResponse();
+        }
+    }
+
+    /**
+     * Send whatever the LTI library prepared for the platform before it tried to end the request.
+     *
+     * A redirect back to the platform carries an error message, an output body is either an error
+     * page or one of the self submitting forms used for the browser storage and cookie checks. A
+     * successfully processed launch leaves both of them empty, which is the only case where the
+     * control flow returns to ILIAS.
+     */
+    private function sendPendingResponse(): void
+    {
+        if (!is_null($this->redirectUrl)) {
+            Util::redirect($this->redirectUrl);
+        }
+
+        if (!is_null($this->output)) {
+            echo $this->output;
+            exit;
+        }
     }
 }