Moodle

This is not a bug, only student submitted data is filtered - if we filtered all js, we could not use any Flash, Java, SVG, SCORM, uploaded html files etc.

This is a bug. Filtering a description is not to hard. A description should never hold any form of Flash, Java, whatever.

Many people do not think so and want to add funny html with active content.

This is not a security problem because the capability (moodle/course:manageactivities) required for editing of this description is marked with XSS risk.

Well, then we disagree. Most 'hacks' are made from the inside. If Moodle does not want to filter a simple subject then it might need a wakeup call.

p.s. I've only started to find issues, will submit more in the next few weeks

There are many places with unfiltered content submitted by teachers - Resource mod content, Book content, teacher uploaded files (==course files), module descriptions, etc.

On the other hand all content/files submitted by students or content with unknown origin should be filtered - we are using modified KSES engine (and HTML purifier in 1.9dev).
The uploaded files by students are served with special headers that prevent opening in browser and forces download, there is also a special handling of all PDF files. I hope we will implement better enhanced protection soon

I am glad that you are working on security Please report any problems you find. I will make sure that any problem is fixed ASAP.

THANKS!!

My skype id is petr.skoda if you want to contact me directly.

I am very much aware that filtering content isn't easy. To filter a scorm package is almost undoable. However, this should not mean Moodle should let it go on all other data. Please start filtering what you can.

Currently I am working on blocks that will connect backoffice stuff from third parties that is very much needed. I do want to submit it as oss and so does my employer. We do want a safe enviroment for it.

Over the next few weeks you might see some weird postings stating a security issue. Please ask me about why it might be an issue if you do not understand.

Regards,

Hans

I'm not using skype. But you can contact me by e-mail or jabber (hans.wolters@jabber.xs4all.nl)

Filtering of content is technical problem which can be usually solved, the problem is IMO people wanting to do fancy stuff in web browsers - we are trying to find some balance to make Moodle as much secure as possible while keep it usable and as feature rich as possible. I am usually the one trying to make it more secure (or adding switches to disable insecure features) - MartinD wants fancy features Fortunately we are not doing banking.

Thanks again for working on security aspects of Moodle.

BTW I hate Skype, some cough developers cough do not want to use something else more standards based and open.

Well, allowing fancy stuff can be defined. If you want to allow http://foo/bar then it can be defined, if you do not want to allow http://sex/forme then close the popup issues

Skype isn't something I do not want, I just hate to have two IM clients opened, it eats desktop space.

Regards,

Hans