--- loncom/lti/ltipassback.pm	2018/08/14 21:42:36	1.6
+++ loncom/lti/ltipassback.pm	2023/06/02 00:28:03	1.8
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # LTI Consumer Module to receive grades passed back by Provider 
 #
-# $Id: ltipassback.pm,v 1.6 2018/08/14 21:42:36 raeburn Exp $
+# $Id: ltipassback.pm,v 1.8 2023/06/02 00:28:03 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -157,7 +157,7 @@ sub handler {
 #
 
     my (%toolsettings,%ltitools);
-    my ($consumer_secret,$nonce_lifetime) = 
+    my ($consumer_secret,$nonce_lifetime) =
         &LONCAPA::ltiutils::get_tool_secret($params->{'oauth_consumer_key'},
                                             $marker,$symb,$cdom,$cnum,
                                             \%toolsettings,\%ltitools,\%errors);
@@ -188,14 +188,16 @@ sub handler {
 # Verify XML in request body has not been tampered with
 #
 
-    my $bodyhash = Digest::SHA::sha1_base64($xmlbody);
-    while (length($bodyhash) % 4) {
-        $bodyhash .= '=';
-    }
-    unless ($bodyhash eq $params->{oauth_body_hash}) {
-        $errors{16} = 1;
-        &invalid_request($r,$params,\%errors);
-        return OK;
+    if ($content_type eq 'application/xml') {
+        my $bodyhash = Digest::SHA::sha1_base64($xmlbody);
+        while (length($bodyhash) % 4) {
+            $bodyhash .= '=';
+        }
+        unless ($bodyhash eq $params->{oauth_body_hash}) {
+            $errors{16} = 1;
+            &invalid_request($r,$params,\%errors);
+            return OK;
+        }
     }
 
 #