Moodle

Recent activity reports quiz grade regardless of review settings for the quiz.

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 1.9.5
  • Fix Version/s: 1.9.9
  • Component/s: Quiz
  • Labels:
    None
  • Affected Branches:
    MOODLE_19_STABLE
  • Fixed Branches:
    MOODLE_19_STABLE

Description

When a user clicks the link for "Full report of recent activity..." ("course/recent.php") in a course their recent quiz grades are displayed on the resulting report regardless of the review settings for the quiz.

There is no check in the function "quiz_print_recent_mod_activity()" located in "mod/quiz/lib.php" to determine if the user should be able to see the grade.

Attachments

  1. Text File
    quiz_recent_activity.patch
    16/Nov/09 9:24 PM
    0.8 kB
    Yolanda Ordoñez Rufat
  2. Text File
    quiz_recent_activity.patch.txt
    26/Apr/10 10:03 PM
    9 kB
    Tim Hunt
  3. Text File
    quiz_recent_activity.patch.txt
    26/Apr/10 7:21 PM
    9 kB
    Tim Hunt
  4. Text File
    quiz_recent_activity2.0.patch.txt
    26/Apr/10 10:03 PM
    10 kB
    Tim Hunt

Issue Links

This issue is duplicated by:
MDL-18855 Student are able to see quiz scores even when the review options are set to not allow it. Major Closed

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Orestes Mas added a comment -

I can confirm this bug, and I must add that it's even worse than this, because students can see their grades although the link for "Full report of recent activity..." is hidden. The trick is to go to the course's main page and change "view.php" in the URL to "recent.php", and voilà!

e.g.: change "http://.../course/view.php?id=7" to "http://.../course/recent.php?id=7"

Show
Orestes Mas added a comment - I can confirm this bug, and I must add that it's even worse than this, because students can see their grades although the link for "Full report of recent activity..." is hidden. The trick is to go to the course's main page and change "view.php" in the URL to "recent.php", and voilà! e.g.: change "http://.../course/view.php?id=7" to "http://.../course/recent.php?id=7"
Hide
Permalink
Yolanda Ordoñez Rufat added a comment -

I attach a patch for this bug. I simply check for the review options in the function quiz_get_recent_mod_activity in mod/quiz/lib.php the same way is done in mod/quiz/review.php

We tested this patch in our 1.9.5 moodle with a 8.4.0 postgres and 5.2.3 PHP installed in a SUSE Linux Enterprise Server.

Show
Yolanda Ordoñez Rufat added a comment - I attach a patch for this bug. I simply check for the review options in the function quiz_get_recent_mod_activity in mod/quiz/lib.php the same way is done in mod/quiz/review.php We tested this patch in our 1.9.5 moodle with a 8.4.0 postgres and 5.2.3 PHP installed in a SUSE Linux Enterprise Server.
Hide
Permalink
Yolanda Ordoñez Rufat added a comment -

patch tested in version 1.9.5

Show
Yolanda Ordoñez Rufat added a comment - patch tested in version 1.9.5
Hide
Permalink
Tim Hunt added a comment -

Ah. Cool thanks. I'm afraid that I have a bit of a backlog of patches to review, but I will do my best this week.

Show
Tim Hunt added a comment - Ah. Cool thanks. I'm afraid that I have a bit of a backlog of patches to review, but I will do my best this week.
Hide
Permalink
Tim Hunt added a comment -

Sorry, I should have looked at this long ago.

I think the patch is basically right, but not exactly. I think it is best to copy the logic for whether the grades are displayed from mod/quiz/view.php. That is just $options->scores, not ->responses. Also, we should check quiz_has_grades(...).

I'm afraid the patch is technically quite bad. In particular, doing $quiz = get_record("quiz", "id", $attempt->quiz) inside the for loop is a performance disaster area. At the least do it outside the loop, but actually, I think we can do it without any DB queries using $modinfo.

Show
Tim Hunt added a comment - Sorry, I should have looked at this long ago. I think the patch is basically right, but not exactly. I think it is best to copy the logic for whether the grades are displayed from mod/quiz/view.php. That is just $options->scores, not ->responses. Also, we should check quiz_has_grades(...). I'm afraid the patch is technically quite bad. In particular, doing $quiz = get_record("quiz", "id", $attempt->quiz) inside the for loop is a performance disaster area. At the least do it outside the loop, but actually, I think we can do it without any DB queries using $modinfo.
Hide
Permalink
Tim Hunt added a comment -

I think this patch is a correct fix for the issue. Is anyone able to test it please?

Show
Tim Hunt added a comment - I think this patch is a correct fix for the issue. Is anyone able to test it please?
Hide
Permalink
Tim Hunt added a comment -

Sorry, I should have made it clear, the new patch is quiz_recent_activity.patch.txt.

Show
Tim Hunt added a comment - Sorry, I should have made it clear, the new patch is quiz_recent_activity.patch.txt.
Hide
Permalink
Tim Hunt added a comment -

And here is a patch for Moodle 2.0, and a slight revision to the 1.9 patch (mostly white-space clean-up compared to the previous patch.)

Show
Tim Hunt added a comment - And here is a patch for Moodle 2.0, and a slight revision to the 1.9 patch (mostly white-space clean-up compared to the previous patch.)
Hide
Permalink
Tim Hunt added a comment -

I have checked in the fix to both 1.9 and HEAD branches.

It would be really great if anyone can help to test this before next Wednesday's weekly build.

Show
Tim Hunt added a comment - I have checked in the fix to both 1.9 and HEAD branches. It would be really great if anyone can help to test this before next Wednesday's weekly build.

People

Vote (1)
Watch (3)

Dates

  • Created:
    Updated:
    Resolved:
Atlassian JIRA (v4.4.3#663-r165197) | Report a problem
Powered by a free Atlassian JIRA open source license for Moodle. Try JIRA - bug tracking software for your team.