Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-55178

TeX filter allows unauthenticated generated image viewing

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Minor
    • Resolution: Won't Fix
    • 2.9.7, 3.1.1
    • None
    • Filters, Maths filters
    • None
    • MOODLE_29_STABLE, MOODLE_31_STABLE
    • Hide

      Use Mathjax filter instead of TeX.

      Show
      Use Mathjax filter instead of TeX.

    Description

      Full Steps:
      1) Access Moodle, enable TeX filter.
      2) Enter some valid LaTeX into Moodle
      3) Note URL for generated LaTeX in page (using developer tools or similar)
      4) Logout of Moodle
      5) Access above URL, LaTeX is returned without being authenticated.

      What I expected:
      That accessing the generated LaTeX would be unsuccessful due to be unauthenticated.

      What actually happened:
      LaTeX image was returned to the browser while unauthenticated.

      It could be possible to generate random strings that match an MD5 sum and retrieve some (or given enough time, all) of the generated .GIF files stored in moodledata/filter/tex/*

      Attachments

        Activity

          People

            Unassigned Unassigned
            james.mclean James McLean
            David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: