Moodle

MSA-09-0014 - Some users can put the whole site in maintenance mode when they aren't supposed to

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 1.9.5
  • Fix Version/s: None
  • Labels:
    None
  • Environment:
    MySQL 5.0.51, Moodle 1.9.5+, Apache 2.2, PHP 5.2.4, Ubuntu 8.04
  • Database:
    MySQL
  • Affected Branches:
    MOODLE_19_STABLE

Description

This issue has already been reported, but the hyperlink is not active, http://docs.moodle.org/en/Release_Notes#Known_problems_and_regressions. Has this issue been resolved? My company hosts for several school districts. We recently received a complaint regarding this issue. If this issue has not been resolved, is there a way to find out which user is putting the site in maintenance mode?

Activity

Hide
Petr Škoda (skodak) added a comment -

That issue was not a security problem in fact, because all the users that are allowed to use course restore feature must be trusted. No user with restore capability should ever try this DoS, if they do you have much bigger problems elsewhere.

It is just a normal bug where some teachers might accidentally send the site to Maintenance mode.

I have fixed the release notes, thanks for the report.

Show
Petr Škoda (skodak) added a comment - That issue was not a security problem in fact, because all the users that are allowed to use course restore feature must be trusted. No user with restore capability should ever try this DoS, if they do you have much bigger problems elsewhere. It is just a normal bug where some teachers might accidentally send the site to Maintenance mode. I have fixed the release notes, thanks for the report.
Hide
Thomas Bachert added a comment -

Thank you Petr. I noticed that you tagged this bug as being fixed. Has this bug been fixed? Do you know if the fix has been applied to 1.9.5's codebase?

Show
Thomas Bachert added a comment - Thank you Petr. I noticed that you tagged this bug as being fixed. Has this bug been fixed? Do you know if the fix has been applied to 1.9.5's codebase?
Hide
Petr Škoda (skodak) added a comment -

yes, see the link above (MDL-18594)

Show
Petr Škoda (skodak) added a comment - yes, see the link above (MDL-18594)

People

Vote (0)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: