Moodle

Forums with restricted access have subscribers without appropriate rights

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: 1.9.1
  • Fix Version/s: 1.9.3
  • Component/s: Forum
  • Labels:
    None

Description

The Using Moodle teacher forum has non-teacher subscribers:

http://moodle.org/mod/forum/subscribers.php?id=21

I don't know exactly when non-teachers became subscribed to the teacher forum, only that when I last checked in 2007, there were no non-teacher subscribers.

The moderator forum, available for moderator group members only, has non-moderator subscribers too now:

http://moodle.org/mod/forum/subscribers.php?id=1018

The Moderator forum was created four days ago.

Issue Links

Activity

Hide
Helen Foster added a comment -

Increasing the security level, as another forum with restricted access is found to be affected.

Show
Helen Foster added a comment - Increasing the security level, as another forum with restricted access is found to be affected.
Hide
Helen Foster added a comment -

Changed from an MDLSITE issue to an MDL issue, as I've reproduced the problem locally.

Users without appropriate rights become subscribed to restricted access forums by using the "Subscribe to all forums" link.

Show
Helen Foster added a comment - Changed from an MDLSITE issue to an MDL issue, as I've reproduced the problem locally. Users without appropriate rights become subscribed to restricted access forums by using the "Subscribe to all forums" link.
Hide
Eloy Lafuente (stronk7) added a comment -

Yu, confirmed!

Yesterday I was reviewing the Spanish Teachers forum and I saw more than 20 users (non teachers) subscribed. And the forum is hidden since ages. So something is failing there.

Ciao

Show
Eloy Lafuente (stronk7) added a comment - Yu, confirmed! Yesterday I was reviewing the Spanish Teachers forum and I saw more than 20 users (non teachers) subscribed. And the forum is hidden since ages. So something is failing there. Ciao
Hide
Martin Dougiamas added a comment -

DongSheng can you examine this?

Show
Martin Dougiamas added a comment - DongSheng can you examine this?
Hide
Eloy Lafuente (stronk7) added a comment -

Raising this to critical and addressing for 1.9.2.

Show
Eloy Lafuente (stronk7) added a comment - Raising this to critical and addressing for 1.9.2.
Hide
Petr Škoda (skodak) added a comment -

excuse me, why is this marked as critical+serious security issue? Those users do not get any email notifications, right?

Show
Petr Škoda (skodak) added a comment - excuse me, why is this marked as critical+serious security issue? Those users do not get any email notifications, right?
Hide
Dongsheng Cai added a comment -

Eloy, can you tell me how to reproduce this bug? I cannot access that page.

Show
Dongsheng Cai added a comment - Eloy, can you tell me how to reproduce this bug? I cannot access that page.
Hide
Helen Foster added a comment -

Hi Dongsheng,

Here are some steps to reproduce the bug:

1. Create a hidden forum in a course
2. Login as a student and enrol in the course
3. Follow the "Subscribe to all forums" link at the top right of the forums index page
4. Login as an admin or teacher and check the list of subscribers to the hidden forum

Expected result:

Students cannot subscribe to hidden forums.

Actual result:

The student is subscribed to the hidden forum.

PS Petr, sorry I've no idea whether users receive emails of forum posts. Please feel free to reduce the security level of this issue if not.

Show
Helen Foster added a comment - Hi Dongsheng, Here are some steps to reproduce the bug: 1. Create a hidden forum in a course 2. Login as a student and enrol in the course 3. Follow the "Subscribe to all forums" link at the top right of the forums index page 4. Login as an admin or teacher and check the list of subscribers to the hidden forum Expected result: Students cannot subscribe to hidden forums. Actual result: The student is subscribed to the hidden forum. PS Petr, sorry I've no idea whether users receive emails of forum posts. Please feel free to reduce the security level of this issue if not.
Hide
Petr Škoda (skodak) added a comment -

the access control is implemented separately in forum cron, if user can no see the forum, nothing gets mailed - that was part of the change that fixed the mailing to users that were not enrolled. I did not test it, I just reviewed the code and it seems ok.

Going to work more on this after the File API Milestone3...

Show
Petr Škoda (skodak) added a comment - the access control is implemented separately in forum cron, if user can no see the forum, nothing gets mailed - that was part of the change that fixed the mailing to users that were not enrolled. I did not test it, I just reviewed the code and it seems ok. Going to work more on this after the File API Milestone3...
Hide
Helen Foster added a comment -

Thanks Petr, reducing the priority and security level based on your comments...

Show
Helen Foster added a comment - Thanks Petr, reducing the priority and security level based on your comments...
Hide
Dongsheng Cai added a comment -

Helen, did you override the capability of mod/forum:viewdiscussion to hide the forum?
If so, the attached patch can fix this bug...

Show
Dongsheng Cai added a comment - Helen, did you override the capability of mod/forum:viewdiscussion to hide the forum? If so, the attached patch can fix this bug...
Hide
Helen Foster added a comment -

There were no overrides set - it was just set to hide in the common module settings.

Show
Helen Foster added a comment - There were no overrides set - it was just set to hide in the common module settings.
Hide
Dongsheng Cai added a comment -

Helen, is the setting in "Updating: Forum" page? I cannot find it.

Show
Dongsheng Cai added a comment - Helen, is the setting in "Updating: Forum" page? I cannot find it.
Hide
Helen Foster added a comment -

Yes, that's right, it's in the updating forum page. You can also hide the forum (or any other activity) from the course page when editing is turned on by clicking the eye icon.

Show
Helen Foster added a comment - Yes, that's right, it's in the updating forum page. You can also hide the forum (or any other activity) from the course page when editing is turned on by clicking the eye icon.
Hide
Dongsheng Cai added a comment -

It should be OK now, when forum is invisible, only users with 'mod/forum:managesubscriptions' capability can subscrib forum, please review, thanks

Show
Dongsheng Cai added a comment - It should be OK now, when forum is invisible, only users with 'mod/forum:managesubscriptions' capability can subscrib forum, please review, thanks
Hide
Helen Foster added a comment -

Thanks Dongsheng, things seem to be working fine now

Show
Helen Foster added a comment - Thanks Dongsheng, things seem to be working fine now
Hide
Joseph Rézeau added a comment -

Well, the bug has been fixed but in latest version 1.9.2 just downloaded today (with debug mode ON) when student clicks on Subscribe to all forums and there exists in the course a forum which student cannot subscribe to, this triggers the following error messages:
Notice : Undefined property: object::$path i C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 381
Notice : Undefined property: object::$contextlevel C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 452
Notice : Undefined property: object::$path i C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 381
Notice : Undefined property: object::$contextlevel C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 452

All forums in CF101 are subscribed.
( Continue )
Joseph

Show
Joseph Rézeau added a comment - Well, the bug has been fixed but in latest version 1.9.2 just downloaded today (with debug mode ON) when student clicks on Subscribe to all forums and there exists in the course a forum which student cannot subscribe to, this triggers the following error messages: Notice : Undefined property: object::$path i C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 381 Notice : Undefined property: object::$contextlevel C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 452 Notice : Undefined property: object::$path i C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 381 Notice : Undefined property: object::$contextlevel C:\Program Files\xampp\htdocs\moodle19dev\moodle\lib\accesslib.php on line 452 All forums in CF101 are subscribed. ( Continue ) Joseph
Hide
Dan Poltawski added a comment -

Hi, I'm afraid this fix was broken and introduced a regression, see: MDL-17961

has_capability was not being called on a valid context..

Show
Dan Poltawski added a comment - Hi, I'm afraid this fix was broken and introduced a regression, see: MDL-17961 has_capability was not being called on a valid context..

Dates

  • Created:
    Updated:
    Resolved: