|
|
|
Environment:
|
Moodle 1.9.2
|
|
|
By default, individual course scales should not be accessible to other users on the site unless they've been designated a site-wide "standard" scale, which is something only admins can do.
However, we've discovered that if you create a Grade Item (via Grades > Choose an Action > Categories & Items > Add Grade Item) and click on the "Scale" drop down menu, you see all the custom scales available on the site.
The steps to recreate are:
1) Create a custom scale for Course A as Teacher A
2) Assign that scale to a grade item in Course A.
3) Create a grade item in Course B as Teacher B
4) Add a grade item, and look at the scale menu; if the bug is there, then you'll be able to see the custom scale that should have been limited to to just Course A.
In looking through the code, I discovered the problem lies on line 60:
if ($scales = get_records('scale')) {
This query returns *every* scale in Moodle, both custom and site-wide, rather than just those for the course.
|
|
Description
|
By default, individual course scales should not be accessible to other users on the site unless they've been designated a site-wide "standard" scale, which is something only admins can do.
However, we've discovered that if you create a Grade Item (via Grades > Choose an Action > Categories & Items > Add Grade Item) and click on the "Scale" drop down menu, you see all the custom scales available on the site.
The steps to recreate are:
1) Create a custom scale for Course A as Teacher A
2) Assign that scale to a grade item in Course A.
3) Create a grade item in Course B as Teacher B
4) Add a grade item, and look at the scale menu; if the bug is there, then you'll be able to see the custom scale that should have been limited to to just Course A.
In looking through the code, I discovered the problem lies on line 60:
if ($scales = get_records('scale')) {
This query returns *every* scale in Moodle, both custom and site-wide, rather than just those for the course.
|
Show » |
|
So faculty can select scales blindly (i.e., without being able to see what they contain), perhaps choosing different scales by the same name (since there is no indication of what the scale contains), and can't amend them for their own courses. This is pretty sloppy and has a significant potential for causing erroneous grade calculations applied to student scores. (Granted, instructors should actually know how a scale works before using it - but alas, this bug promotes a bad practice).