Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-33645

A teacher can alter grades of a submission, even if the grade is overridden in the grade book

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 2.3
    • Fix Version/s: 2.3
    • Component/s: Assignment
    • Labels:
    • Testing Instructions:
      Hide

      1) As a student submit the assignment.
      2) As a teacher grade the submission and verify that the student's grade appears in the grader report.
      3) Turn editing on and override a grade in the grader report by clicking it then typing a new grade in the left hand text box and pressing enter.
      4) The grade should be updated and the background color of the cell should change to indicate that the grade has been overridden.
      5) Return to the assignment and check that you can no longer alter the grade.either from the single grade page or via quickgrading in the submissions table.
      6) When on single grading page, try altering the html source to change the grade. and submit the changes and make sure they are not saved (you might not get any error, just make sure they are not saved)
      7) Go back to the grader report, turn editing on and click the edit icon (hand holding a pencil) for the assignment.
      8) Uncheck the overridden checkbox and press save. Turn editing off.
      9) Verify that you are returned to the grader report and that it now displays the student's original grade.
      10) Return to the assignment and verify that you can now alter the grade.

      Show
      1) As a student submit the assignment. 2) As a teacher grade the submission and verify that the student's grade appears in the grader report. 3) Turn editing on and override a grade in the grader report by clicking it then typing a new grade in the left hand text box and pressing enter. 4) The grade should be updated and the background color of the cell should change to indicate that the grade has been overridden. 5) Return to the assignment and check that you can no longer alter the grade.either from the single grade page or via quickgrading in the submissions table. 6) When on single grading page, try altering the html source to change the grade. and submit the changes and make sure they are not saved (you might not get any error, just make sure they are not saved) 7) Go back to the grader report, turn editing on and click the edit icon (hand holding a pencil) for the assignment. 8) Uncheck the overridden checkbox and press save. Turn editing off. 9) Verify that you are returned to the grader report and that it now displays the student's original grade. 10) Return to the assignment and verify that you can now alter the grade.
    • Affected Branches:
      MOODLE_23_STABLE
    • Fixed Branches:
      MOODLE_23_STABLE
    • Pull Master Branch:
      MDL-33645-master

      Description

      Replication steps:-
      1) As a student submit the assignment.
      2) As a teacher grade the submission and verify that the student's grade appears in the grader report.
      3) Turn editing on and override a grade in the grader report by clicking it then typing a new grade in the left hand text box and pressing enter.
      4) The grade should be updated and the background color of the cell should change to indicate that the grade has been overriden.

      Expected Result:-
      Return to the assignment and check that you can no longer alter the grade either from the single grade page or via quickgrading in the submissions table.

      Actual Result:-
      Teacher is able to alter the grades from the assignments in both the single grade page and via quickgrading in the submissions table.

        Gliffy Diagrams

          Issue Links

            Activity

            Hide
            ankit_frenz Ankit Agarwal added a comment -

            this works for 2.2 on-line text assignment, so it is just an issue with 2.3 assign module.
            Thanks

            Show
            ankit_frenz Ankit Agarwal added a comment - this works for 2.2 on-line text assignment, so it is just an issue with 2.3 assign module. Thanks
            Hide
            ankit_frenz Ankit Agarwal added a comment -

            @integrator
            This is a master only patch

            Thanks

            Show
            ankit_frenz Ankit Agarwal added a comment - @integrator This is a master only patch Thanks
            Hide
            moodle.com moodle.com added a comment -

            Damyon, does this look OK?

            Show
            moodle.com moodle.com added a comment - Damyon, does this look OK?
            Hide
            damyon Damyon Wiese added a comment -

            Not quite - it is missing the same checks for quickgrading - I'll update the test instructions to cover this.

            Show
            damyon Damyon Wiese added a comment - Not quite - it is missing the same checks for quickgrading - I'll update the test instructions to cover this.
            Hide
            ankit_frenz Ankit Agarwal added a comment - - edited

            Hi Damyon,
            Thanks for the review.
            I was just looking at this again, and I noticed that the form can be hacked, if you edit the source and change the value from there.
            Do you think using hardFreeze with setConstant() will make more sense?

            Will add the changes to quick grading page as well.
            Thanks

            Show
            ankit_frenz Ankit Agarwal added a comment - - edited Hi Damyon, Thanks for the review. I was just looking at this again, and I noticed that the form can be hacked, if you edit the source and change the value from there. Do you think using hardFreeze with setConstant() will make more sense? Will add the changes to quick grading page as well. Thanks
            Hide
            damyon Damyon Wiese added a comment -

            Hi Ankit,

            I think we should also modify the process_save_grade and process_save_quick_grades functions to ignore the passed in grade if grading is disabled for the current user. That will prevent anyone hacking the form.

            Thanks, Damyon

            Show
            damyon Damyon Wiese added a comment - Hi Ankit, I think we should also modify the process_save_grade and process_save_quick_grades functions to ignore the passed in grade if grading is disabled for the current user. That will prevent anyone hacking the form. Thanks, Damyon
            Hide
            ankit_frenz Ankit Agarwal added a comment -

            Hi Damyon,
            I have updated the patch. Not sure if that is the correct place to make the changes. Requesting another review.
            Thanks

            Show
            ankit_frenz Ankit Agarwal added a comment - Hi Damyon, I have updated the patch. Not sure if that is the correct place to make the changes. Requesting another review. Thanks
            Hide
            damyon Damyon Wiese added a comment -

            Hi Ankit,

            Thanks for the updates. This looks good to me now.

            Regards, Damyon

            Show
            damyon Damyon Wiese added a comment - Hi Ankit, Thanks for the updates. This looks good to me now. Regards, Damyon
            Hide
            ankit_frenz Ankit Agarwal added a comment -

            Thanks Damyon for the review.

            Sending for integration.
            Thanks

            Show
            ankit_frenz Ankit Agarwal added a comment - Thanks Damyon for the review. Sending for integration. Thanks
            Hide
            samhemelryk Sam Hemelryk added a comment -

            Thanks guys, this has been integrated now

            Show
            samhemelryk Sam Hemelryk added a comment - Thanks guys, this has been integrated now
            Hide
            timb Tim Barker added a comment -

            Ran the testing instructions and all steps passed.

            Your code is Tim proof! Good work.

            Show
            timb Tim Barker added a comment - Ran the testing instructions and all steps passed. Your code is Tim proof! Good work.
            Hide
            stronk7 Eloy Lafuente (stronk7) added a comment -

            Big thanks for the effort. This is now part of Moodle upstream. Let's wait for regressions, yay! LOL

            Ciao

            Show
            stronk7 Eloy Lafuente (stronk7) added a comment - Big thanks for the effort. This is now part of Moodle upstream. Let's wait for regressions, yay! LOL Ciao

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Fix Release Date:
                  25/Jun/12