Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-55243

SVG files are images and should be allowed for course images, drag-drop questions, etc.

    XMLWordPrintable

Details

    • MOODLE_30_STABLE, MOODLE_311_STABLE, MOODLE_31_STABLE
    • MOODLE_310_STABLE, MOODLE_311_STABLE
    • MDL-55243-311
    • MDL-55243-master
    • Hide

      Initial setup

      1. Create a course.
      2. Go to Site administration > Appearance > Courses
      3. On courseoverviewfilesext setting, click Choose
      4. Select Image (SVG+XML) .svg and Save changes.

      Functional testing

      1. Edit created Course.
      2. Drag/Upload test_svg_no_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will see the image under the course name.
      6. Verify that you will not see a link to the SVG file.

      XSS testing (Case 1)

      1. Go to the courses page (Site home).
      2. Right-click on the SVG image and click "Open image in New Tab".
      3. Verify that the browser will not display the image directly.
      4. Verify that the browser will download the file to your computer.

      XSS testing (Case 2)

      1. Edit created Course.
      2. Drag/Upload test_svg_with_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will not see a popup that says "Test XSS".
      6. Right-click on the SVG image and click "Open image in New Tab".
      7. Verify that the browser will not display the image directly.
      8. Verify that the browser will download the file to your computer.
      9. Verify that you will not see a popup that says "Test XSS".
      Show
      Initial setup Create a course. Go to Site administration > Appearance > Courses On courseoverviewfilesext setting, click Choose Select Image (SVG+XML) .svg and Save changes . Functional testing Edit created Course. Drag/Upload test_svg_no_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will see the image under the course name. Verify that you will not see a link to the SVG file. XSS testing (Case 1) Go to the courses page (Site home). Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. XSS testing (Case 2) Edit created Course. Drag/Upload test_svg_with_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will not see a popup that says "Test XSS". Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. Verify that you will not see a popup that says "Test XSS".
    • 1
    • Internationals - 4.0 Sprint 1, HQ Team International Sprint 2, HQ Team International Sprint 3

    Description

      The is_valid_image returns false for svg files.

      This means that when looking at the courses page we do not see an image for the course but simply a link to the svg file.

      NOTE: It is likely that svg files were excluded at the time the code was written because IE didn't support them. All modern browsers support svg files now.

      Attachments

        1. MDl-55243_Test Passed.png
          MDl-55243_Test Passed.png
          186 kB
        2. MDL-55243 error.png
          MDL-55243 error.png
          37 kB
        3. MDL-55243 func ok.png
          MDL-55243 func ok.png
          9 kB
        4. svg image in courses page.png
          svg image in courses page.png
          109 kB
        5. test_svg_no_xss.svg
          4 kB
        6. test_svg_no_xss-1.svg
          4 kB
        7. test_svg_with_xss.svg
          4 kB

        Issue Links

          Activity

            People

              huongn@moodle.com Huong Nguyen
              brudinie guy thomas
              Simey Lameze Simey Lameze
              Andrew Lyons Andrew Lyons
              Gladys Basiana Gladys Basiana
              Amaia Anabitarte, Bas Brands, Carlos Escobedo, Laurent David, Sabina Abellan, Sara Arjona (@sarjona), Matteo Scaramuccia, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
              Votes:
              7 Vote for this issue
              Watchers:
              17 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                12/Jul/21

                Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 days, 5 hours, 41 minutes
                  4d 5h 41m