Details
Bug
Closed
Minor
Description
By default, individual course scales should not be accessible to other users on the site unless they've been designated a site-wide "standard" scale, which is something only admins can do.
However, we've discovered that if you create a Grade Item (via Grades > Choose an Action > Categories & Items > Add Grade Item) and click on the "Scale" drop down menu, you see all the custom scales available on the site.
The steps to recreate are:
1) Create a custom scale for Course A as Teacher A
2) Assign that scale to a grade item in Course A.
3) Create a grade item in Course B as Teacher B
4) Add a grade item, and look at the scale menu; if the bug is there, then you'll be able to see the custom scale that should have been limited to to just Course A.
In looking through the code, I discovered the problem lies on line 60:
if ($scales = get_records('scale')) {
This query returns every scale in Moodle, both custom and site-wide, rather than just those for the course.
True enough... and potentially very confusing for instructors, since there can be many scales with the same name, and which can be edited only by the instructor who created them (or an admin logged in as the instructor). To compound the issue, the scale's values are not visible anywhere (that I can find) except in the drop-downs in an instructor's view of the gradebook (then only after selecting the scale) and in the creator's scales-editing area - additionally there is no simple way to identify who the creator is.
So faculty can select scales blindly (i.e., without being able to see what they contain), perhaps choosing different scales by the same name (since there is no indication of what the scale contains), and can't amend them for their own courses. This is pretty sloppy and has a significant potential for causing erroneous grade calculations applied to student scores. (Granted, instructors should actually know how a scale works before using it - but alas, this bug promotes a bad practice).