Details
Bug
Closed
Minor
Description
When anonymous users ( which are not logged into the moodle system ) are viewing Category Pages,
it enables them to see images that teachers put inside Course's Summary which are
inside the course's file repository. and are normally not accessible to
un-authenticated (not logged in) users. if at all, exposed by the teacher in the main course pages.
the patch...
i have added a security trimmed /sendfile.php instead of /file.php
and i replaced the following line (moodle/course/lib.php line 1946) :
echo format_text( $course->summary, FORMAT_MOODLE, $options, $course->id);
with this line:
echo format_text( str_replace("file.php", "sendfile.php", $course->summary), FORMAT_MOODLE, $options, $course->id);
and i am attaching the sendfile.php (for review as well !)
Hello,
yes this is a known problem, the solution is part of 2.0 file api rewrite. There are no plans to lower security of course files in 1.9.x, sorry.
Petr