Moodle

In the process of reviewing the Security Report, which is improved form 1.9.3+ to 1.9.4, I noticed from the report is missing the check about "Cron execution from command line only".

Although cron execution via web may not damage sites, it could be used to create excess cpu load, thus slowing down the server. Could be useful an info level in the report?

Good idea. +1 here

We really need to port this back to 1.8.9 as well.

bacported into MOODLE_18_STABLE - the admin and XSS risks could not be backported, because the sql code relies on context.path which is not available in < 1.9.0

We had a discussion over at http://moodle.org/mod/forum/discuss.php?d=123189#p540218 whether one could borrow something along those lines from Drupal (admittedly I haven't tried this security report yet).

Thanks for reporting this issue.

We have detected that this issue has been inactive for over a year has been recorded as affecting versions that are no longer supported.

If you believe that this issue is still relevant to current versions (2.1 and beyond), please comment on the issue. Issues left inactive for a further month will be closed.

Michael d;

lqjjLKA0p6

I'm closing this issue as it appears to have become inactive and is probably not relevant to a current supported version. If you are encountering this problem or one similar, please launch a new issue.