Issue Details (XML | Word | Printable)

Key: MDL-2953
Type: Bug Bug
Status: Open Open
Priority: Major Major
Assignee: Mathieu Petit-Clair
Reporter: Zbigniew Fiedorowicz
Votes: 0
Watchers: 0
Operations

Add/Edit UI Mockup to this issue
If you were logged in you would be able to see more operations.
Moodle

Pasting HTML containing internal links into editor means links get rewritten as relative links

Created: 17/Apr/05 12:35 AM   Updated: 23/Apr/08 12:27 PM
Return to search
Component/s: Forum, HTML Editor, Messages
Affects Version/s: 1.4.4, 1.9
Fix Version/s: None

Environment: All
Issue Links:
Cloners
 

Participants: Martin Dougiamas, Mathieu Petit-Clair and Zbigniew Fiedorowicz
Security Level: None
Affected Branches: MOODLE_14_STABLE, MOODLE_19_STABLE


 Description  « Hide
Moodle currently emails forum posts containing glossary autolinks in the form that they appear within the forum module. This results in dysfunctional autolinks in the email of the form <a href=../glossary/...



While previously I didn't care too much about this, there is now an unfortunate interaction with a mail spam detection software running on Ohio State mail servers called Mail Scanner. Recently some heuristics have been added to Mail Scanner for detecting and warning about phishing attempts in the email. This code in Mail Scanner now flags the dysfunctional autolinks in the Moodle email as cloaked urls designed to redirect unsuspecting Outlook (Express) users to evil phishing sites, and adds the warning in the subject line to every autolinked term in the email. Consequently a lot of my moodle.org email has become unreadable.



Our mail server administrators are unsympathetic to requests to modify the Mail Scanner configuration. They point out with some justification that the problem lies with Moodle.



It should be fairly easy to modify the forum email code to do a search for glossary autolinks in the outgoing email and replace the dysfunctional urls ../glossary/... by something like

$CFG->wwwroot . /mod/glossary/...



My concern is that perhaps these autolinks might appear elsewhere in Moodle email besides forum post emails and perhaps the fix should go elsewhere.

 All   Comments   Change History   Version Control      Sort Order: Ascending order - Click to sort in descending order
Martin Dougiamas added a comment - 18/Apr/05 02:20 AM
From Martin Dougiamas (martin at moodle.com) Sunday, 17 April 2005, 01:15 AM:

Wow! I'm looking at moodle.org mail, and they are bad URLs! I had never noticed!

But but, the glossary filter code seems to be doing it correctly! I can't see why this mail should be coming out like that ... :-/

From Martin Dougiamas (martin at moodle.com) Sunday, 17 April 2005, 01:19 AM:

Eloy, check this bug out - it's wierd! Any ideas?

The glossary code for making those links already looks like this:

$href_tag_begin = <a target=\entry\ class=\autolink\ title=\$title\ href=\$CFG->wwwroot/mod/glossary/showentry.php?courseid=$courseid&concept=$encodedconcept\ .onClick=\return openpopup('/mod/glossary/showentry.php?courseid=$courseid\&concept=$encodedconcept', 'entry', 'menubar=0,location=0,scrollbars,resizable,width=600,height=450', 0);\>;

And I know glossary links in email etc USED to work (I remember testing it quite clearly).

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Sunday, 17 April 2005, 01:53 AM:

It's stopped doing it. I've just recieved a copy of my post from moodle.org and the autolinks were fixed.

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Sunday, 17 April 2005, 02:12 AM:

Nope, I was being optimistic. This is a sporadic problem which occurs in relatively few Moodle forum emails. The first instance I can find in my archived email is Dec. 10, 2004 from a post by Lorenzo Nicora entitled Weird session problem

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Sunday, 17 April 2005, 03:34 AM:

Actually I found an earlier example dated Sept. 3, 2004

Here's the output of a perl script I wrote to scan my email for ../glossary

Date: Fri, 3 Sep 2004 15:10:06 +0800

Subject: Using Moodle: Re: installation problems

[../glossary/showentry.php?courseid=3D5&concept=3DMySQL] mysql stuffs?=0D

know about <a href=3D../glossary/showentry.php?courseid=3D5&concept=3DMyS=

Date: Sat, 11 Dec 2004 04:20:03 +0800

Subject: Using Moodle: Re: Weird session problem

[../glossary/showentry.php?courseid=3D5&concept=3DPHP] PHP session

  • Version of [../glossary/showentry.php?courseid=3D5&concept=3DPHP] PHP

[../glossary/showentry.php?courseid=3D5&concept=3DMySQL] mysql? If you

  • Version of </span><a href=3D../glossary/showentry.php?courseid=3D5&conce=

Date: Sat, 15 Jan 2005 11:20:04 +0800

Subject: Using Moodle: Re: Session problems

[../glossary/showentry.php?courseid=3D5&concept=3DPHP] PHP fixes will

<a href=3D../glossary/showentry.php?courseid=3D5&concept=3DPHP title=3D=

Date: Mon, 17 Jan 2005 20:10:31 +0800

Subject: Using Moodle: Re: Session problems

[../glossary/showentry.php?courseid=3D5&concept=3DPHP] PHP fixes will

and </span><a style=3Dfont-style: italic; href=3D../glossary/showentry=

Date: Wed, 2 Feb 2005 12:30:06 +0800

Subject: Using Moodle: Activities linking in meantime for Moodle 1.4.3 and regulates rights

activities [../glossary/showentry.php?courseid=3D5&concept=3Dactivities] li=

1 - Only quiz, lesson [../glossary/showentry.php?courseid=3D5&concept=3DLes=

href=3D../glossary/showentry.php?courseid=3D5&concept=3Dactivities tit=

<p>1 - Only quiz, <a href=3D../glossary/showentry.php?courseid=3D5&concept=

Date: Fri, 4 Feb 2005 19:20:16 +0800

Subject: Using Moodle: Re: CMS like features - new frontpage!

[../glossary/showentry.php?courseid=3D5&concept=3Dactivities] in Moodle to =

[../glossary/showentry.php?courseid=3D5&concept=3Dactivities].

a href=3D../glossary/showentry.php?courseid=3D5&concept=3Dactivities tit=

n><a href=3D../glossary/showentry.php?courseid=3D5&concept=3Dactivities =

Date: Sat, 12 Feb 2005 21:40:03 +0800

Subject: Using Moodle: Re: image display model

[../glossary/showentry.php?courseid=3D5&concept=3DHow+do+the+limits+on+uplo=

<div style=3Dmargin-left: 40px; ><a href=3D../glossary/showentry.php?cou=

Date: Tue, 15 Feb 2005 20:40:46 +0800

Subject: Using Moodle: Re: Security problems with web link authentication

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['REMOTE_ADDR'].$s=

Date: Tue, 22 Feb 2005 22:20:08 +0800

Subject: Using Moodle: Re: Why use several Moodle servers?

[../glossary/showentry.php?courseid=3D5&concept=3DFantastico]

to enrol onto only their own moodle <a href=3D../glossary/showentry.php?co=

Date: Thu, 17 Mar 2005 09:00:18 +0800

Subject: Using Moodle: Re: Grades Link proposal

[../glossary/showentry.php?courseid=3D5&concept=3DHow+to+debug+server+probl=

italic; >I've been seeing the </span><a href=3D../glossary/showentry.php?=

Date: Wed, 30 Mar 2005 02:10:04 +0800

Subject: Using Moodle: Re: usability?

[../glossary/showentry.php?courseid=3D5&concept=3DJavascript] so bad? Why =

Date: Wed, 30 Mar 2005 06:20:06 +0800

Subject: Using Moodle: Re: Centralized versus decentralized hosting of moodle (VLE's) in HE - what's the future?

[../glossary/showentry.php?courseid=3D5&concept=3DFantastico] cluster for

href=3D../glossary/showentry.php?courseid=3D5&concept=3DFantastico titl=

Date: Mon, 11 Apr 2005 07:40:15 +0800

Subject: Using Moodle: Re: Project Module Prospectus

[../glossary/showentry.php?courseid=3D5&concept=3DMySQL] tool that does som=

>>We have an internal php/</span><a href=3D../glossary/showentry.php=

Date: Thu, 14 Apr 2005 18:10:40 +0800

Subject: Using Moodle: Re: Edukalibre Collab Moodle 0.8.2

[../glossary/showentry.php?courseid=3D5&concept=3DPHP]/MySQL

[../glossary/showentry.php?courseid=3D5&concept=3DMySQL]?

Q1 .What is the backend technology? Is it <a href=3D../glossary/showentry.=

Date: Fri, 15 Apr 2005 12:30:05 +0800

Subject: Using Moodle: Re: List of unmerged files updated...

< <?PHP [../glossary/showentry.php?courseid=3D5&concept=3DPHP] // $Id:

> <?PHP [../glossary/showentry.php?courseid=3D5&concept=3DPHP] // $Id:

le/mod/choice/view.php,v<br />< <?<a href=3D../glossary/showentry.ph=

Date: Sat, 16 Apr 2005 23:20:36 +0800

Subject: Using Moodle: IIS compatibility problem with REQUEST_URI

[../glossary/showentry.php?courseid=3D5&concept=3DFantastico] when using la=

[../glossary/showentry.php?courseid=3D5&concept=3DFantastico] features that=

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['REQUEST_URI']) &&

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['SCRIPT_NAME'])) {

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['QUERY_STRING']))=

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['REQUEST_URI'] =

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['SCRIPT_NAME'].'?=

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['QUERY_STRING'];

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['REQUEST_URI'] =

[../glossary/showentry.php?courseid=3D5&concept=3Dserver]['SCRIPT_NAME'];

S test <a href=3D../glossary/showentry.php?courseid=3D5&concept=3DFantasti=

hould use only <a href=3D../glossary/showentry.php?courseid=3D5&concept=3D=

: courier new,courier,monospace; >if (!isset($_<a href=3D../glossary/show=

T_URI']) && isset($_<a href=3D../glossary/showentry.php?courseid=

=A0 if (isset($_<a href=3D../glossary/showentry.php?courseid=3D5&concept=

<a href=3D../glossary/showentry.php?courseid=3D5&concept=3Dserver title=

b></font> SERVER</a>['REQUEST_URI'] =3D $_<a href=3D../glossary/showentry.=

].'?'.$_<a href=3D../glossary/showentry.php?courseid=3D5&concept=3Dserver=

=A0 $_<a href=3D../glossary/showentry.php?courseid=3D5&concept=3Dserver =

be</b></font> SERVER</a>['REQUEST_URI'] =3D $_<a href=3D../glossary/showe=

Date: Sun, 17 Apr 2005 01:20:06 +0800

Subject: Using Moodle: MailScanner has detected a possible fraud attempt from ..

autolinks in the email of the form <a href=3D../glossary/...

../glossary/... by something like

form <a href=3D../glossary/...<br /><br />While previously I =

outgoing email and replace the dysfunctional urls ../glossary/... by =

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Sunday, 17 April 2005, 04:10 AM:

Perhaps it's the effect of some filter running on moodle.org which acts after the glossary autolinking filter. [I notice that there is a filter named moodlelinks in the moodle.org filter directory.]

From Eloy Lafuente (stronk7 at moodle.org) Sunday, 17 April 2005, 06:51 PM:

Uhm,

strange (and weird!)

I've examined closely some of the examples sent by Fied (thanks!) and I've seen this:

  • The initial post (by Mike) has the PHP and MySQL PLAIN strings correctly linked (both the href and the javascript popup) by the glossary and everything seems ok there.
  • The problematic reply (by Luis), seems to have such links working correctly but taking a more closer view (viewing source code of the page), I've detected that the ../glossary/ href call is present! And it's missing the javascript popup call!
  • You can check it. If you press over PHP in Mike's message a correct popup will be showed whereas over Luis' message, you won't be the popup!
  • After this point, I've edited (as admin) the wrong message and I've seen that such ../glossary/ html code is there, in the original posted message (without being processed by any filter at all!!).

So it seems that Luis, when typing its message, copied and pasted some code from Mike's original and such action included the problematic links in the message.

Then, the glossary filter, did nothing (because it ignores existing links completely).

Perhaps, asking to moodlers how they edit such messages we can find where is the problem. But I think that it isn't filter-related but editing-related.

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Sunday, 17 April 2005, 09:21 PM:

It is a bug in HTML editor. When you copy the text of a completed post into a new post, HTML editor converts all occurences of

href=http://yoursite/mod/something

into

href=../something

From Martin Dougiamas (martin at moodle.com) Sunday, 17 April 2005, 09:44 PM:

Phew, thanks ELoy! My sanity is not as far gone as I had feared. I'm downgrading this one and re-categorising it.

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Sunday, 17 April 2005, 09:49 PM:

I disagree that is low priority. This has the potential of causing a lot of confusion when students get email copies of announcements. At Ohio State, with the unfortunate interaction with MailScanner, this problem is excacerbated.

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Monday, 18 April 2005, 12:05 AM:

I think you may be missing the point that it affects not just autolinks, but any internal links in the body of the post.

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Monday, 18 April 2005, 01:17 AM:

This may be caused by the Mozilla Firefox browser itself. When I paste into an editor window in Moodle, then switch to source mode, I see the URLs as modified into relative ones. If I then switch back to normal edit mode, copy the text in the editor window into Mozilla Composer, I see the URLs as being converted back into absolute URLs.

This behavior doesn't happen in Internet Explorer or in the old Mozilla browser.

The version of Firefox I am using is:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

From Zbigniew Fiedorowicz (fiedorow at math.ohio-state.edu) Monday, 18 April 2005, 02:04 AM:

I've just tested pasting html into gmail within Firefox. The same behavior occurs - an absolute link

href=http://gmail.google.com/smail/excult.php

gets converted into

href=../smail/excult.php

From Martin Dougiamas (martin at moodle.com) Monday, 18 April 2005, 02:20 AM:

Yes, right, I had thought it was only autolinks. All links is more serious.

I fear this is a Firefox bug ... I hope there is a switch or something to fix it. I just spent some time searching at https://bugzilla.mozilla.org/query.cgi but no luck yet.