Moodle

wiki security issues

Details

  • Type: Sub-task Sub-task
  • Status: Open Open
  • Priority: Major Major
  • Resolution: Unresolved
  • Affects Version/s: 2.0
  • Fix Version/s: STABLE backlog
  • Component/s: Wiki (2.x)
  • Labels:
  • Affected Branches:
    MOODLE_20_STABLE

Description

Tim just created new security related pages in our docs http://docs.moodle.org/en/Development:Security

1/ learn how to use require_login() and require_course_login()
2/ learn how to use sesskey to prevent CSRF
3/ add missing capability tests
4/ learn how to use s() in forms - potential XSS in block_wiki_search - PARAM_ACTION prevents it, but this type is not correct there because it would work for english only

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Petr Škoda (skodak) added a comment -

this is not a real security issue, but following can not work:

<code php>
$option = optional_param('editoption','', PARAM_ALPHA);
if ($option == get_string('cancel')) {
<code>

Show
Petr Škoda (skodak) added a comment - this is not a real security issue, but following can not work: <code php> $option = optional_param('editoption','', PARAM_ALPHA); if ($option == get_string('cancel')) { <code>
Hide
Permalink
Petr Škoda (skodak) added a comment -

still also will not work $newcontent = optional_param('newcontent','', PARAM_CLEANHTML);
because it is not always in HTML format

Show
Petr Škoda (skodak) added a comment - still also will not work $newcontent = optional_param('newcontent','', PARAM_CLEANHTML); because it is not always in HTML format
Hide
Permalink
Ludo ( Marc Alier) added a comment -

Jordi, Petr,
is this still an opened issue?

Show
Ludo ( Marc Alier) added a comment - Jordi, Petr, is this still an opened issue?
Hide
Permalink
Petr Škoda (skodak) added a comment -

yes I have just found multiple security issues in the mod/wiki, going to post them here today
ciao

Show
Petr Škoda (skodak) added a comment - yes I have just found multiple security issues in the mod/wiki, going to post them here today ciao
Hide
Permalink
Helen Foster added a comment -

Petr, sorry I can't see your post! Can this issue be resolved now?

Show
Helen Foster added a comment - Petr, sorry I can't see your post! Can this issue be resolved now?
Hide
Permalink
Petr Škoda (skodak) added a comment -

No idea, I did not study the code recently, going to have a quick look later today....

Show
Petr Škoda (skodak) added a comment - No idea, I did not study the code recently, going to have a quick look later today....
Hide
Permalink
Helen Foster added a comment -

Dongsheng please could you look into whether there are any security issues in the wiki.

Show
Helen Foster added a comment - Dongsheng please could you look into whether there are any security issues in the wiki.

People

Vote (0)
Watch (3)

Dates

  • Created:
    Updated:
Atlassian JIRA (v4.4.3#663-r165197) | Report a problem
Powered by a free Atlassian JIRA open source license for Moodle. Try JIRA - bug tracking software for your team.