From d3f722611d6e0519c247e302321ff835fb242388 Mon Sep 17 00:00:00 2001
From: Markos Gogoulos <markos@sixfeetup.com>
Date: Tue, 10 Feb 2026 15:10:05 +0200
Subject: [PATCH] fix

---
 lms-plugins/mediacms-moodle/filter/mediacms/launch.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lms-plugins/mediacms-moodle/filter/mediacms/launch.php b/lms-plugins/mediacms-moodle/filter/mediacms/launch.php
index a70a893a..02ab1575 100644
--- a/lms-plugins/mediacms-moodle/filter/mediacms/launch.php
+++ b/lms-plugins/mediacms-moodle/filter/mediacms/launch.php
@@ -142,6 +142,11 @@ $typeconfig = lti_get_type_type_config($type->id);
 // Initiate LTI Login with proper cmid (for permissions) and custom token
 $content = lti_initiate_login($course->id, $dummy_cmid, $instance, $typeconfig, null, $instance->name);
 
+// CRITICAL: Inject media_token as hidden field in OIDC form
+// MediaCMS will encode it in state and inject into custom claims (fallback mechanism)
+$media_token_field = '<input type="hidden" name="media_token" value="' . htmlspecialchars($mediatoken, ENT_QUOTES) . '" />';
+$content = str_replace('</form>', $media_token_field . '</form>', $content);
+
 echo $OUTPUT->header();
 echo $content;
 echo $OUTPUT->footer();