Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-55243

SVG files are images and should be allowed for course images, drag-drop questions, etc.

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide

      Initial setup

      1. Create a course.
      2. Go to Site administration > Appearance > Courses
      3. On courseoverviewfilesext setting, click Choose
      4. Select Image (SVG+XML) .svg and Save changes.

      Functional testing

      1. Edit created Course.
      2. Drag/Upload test_svg_no_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will see the image under the course name.
      6. Verify that you will not see a link to the SVG file.

      XSS testing (Case 1)

      1. Go to the courses page (Site home).
      2. Right-click on the SVG image and click "Open image in New Tab".
      3. Verify that the browser will not display the image directly.
      4. Verify that the browser will download the file to your computer.

      XSS testing (Case 2)

      1. Edit created Course.
      2. Drag/Upload test_svg_with_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will not see a popup that says "Test XSS".
      6. Right-click on the SVG image and click "Open image in New Tab".
      7. Verify that the browser will not display the image directly.
      8. Verify that the browser will download the file to your computer.
      9. Verify that you will not see a popup that says "Test XSS".
      Show
      Initial setup Create a course. Go to Site administration > Appearance > Courses On courseoverviewfilesext setting, click Choose Select Image (SVG+XML) .svg and Save changes . Functional testing Edit created Course. Drag/Upload test_svg_no_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will see the image under the course name. Verify that you will not see a link to the SVG file. XSS testing (Case 1) Go to the courses page (Site home). Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. XSS testing (Case 2) Edit created Course. Drag/Upload test_svg_with_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will not see a popup that says "Test XSS". Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. Verify that you will not see a popup that says "Test XSS".
    • Affected Branches:
      MOODLE_30_STABLE, MOODLE_311_STABLE, MOODLE_31_STABLE
    • Fixed Branches:
      MOODLE_310_STABLE, MOODLE_311_STABLE
    • Pull 3.10 Branch:
      MDL-55243-310
    • Pull 3.11 Branch:
      MDL-55243-311
    • Pull Master Branch:
      MDL-55243-master
    • Story Points:
      1
    • Sprint:
      Internationals - 4.0 Sprint 1, HQ Team International Sprint 2, HQ Team International Sprint 3

      Description

      The is_valid_image returns false for svg files.

      This means that when looking at the courses page we do not see an image for the course but simply a link to the svg file.

      NOTE: It is likely that svg files were excluded at the time the code was written because IE didn't support them. All modern browsers support svg files now.

        Attachments

        1. MDl-55243_Test Passed.png
          MDl-55243_Test Passed.png
          186 kB
        2. MDL-55243 error.png
          MDL-55243 error.png
          37 kB
        3. MDL-55243 func ok.png
          MDL-55243 func ok.png
          9 kB
        4. svg image in courses page.png
          svg image in courses page.png
          109 kB
        5. test_svg_no_xss.svg
          4 kB
        6. test_svg_with_xss.svg
          4 kB

          Issue Links

            Activity

              People

              Assignee:
              huongn@moodle.com Huong Nguyen
              Reporter:
              brudinie guy thomas
              Peer reviewer:
              Simey Lameze Simey Lameze
              Integrator:
              Andrew Lyons Andrew Lyons
              Tester:
              Gladys Basiana Gladys Basiana
              Participants:
              Component watchers:
              Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Sara Arjona (@sarjona), Matteo Scaramuccia, Andrew Lyons, Dongsheng Cai, Huong Nguyen, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
              Votes:
              7 Vote for this issue
              Watchers:
              17 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Fix Release Date:
                12/Jul/21

                  Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 days, 5 hours, 41 minutes
                  4d 5h 41m