Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-55243

SVG files are images and should be allowed for course images, drag-drop questions, etc.

XMLWordPrintable

    • MOODLE_30_STABLE, MOODLE_311_STABLE, MOODLE_31_STABLE
    • MOODLE_310_STABLE, MOODLE_311_STABLE
    • MDL-55243-master
    • Hide

      Initial setup

      1. Create a course.
      2. Go to Site administration > Appearance > Courses
      3. On courseoverviewfilesext setting, click Choose
      4. Select Image (SVG+XML) .svg and Save changes.

      Functional testing

      1. Edit created Course.
      2. Drag/Upload test_svg_no_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will see the image under the course name.
      6. Verify that you will not see a link to the SVG file.

      XSS testing (Case 1)

      1. Go to the courses page (Site home).
      2. Right-click on the SVG image and click "Open image in New Tab".
      3. Verify that the browser will not display the image directly.
      4. Verify that the browser will download the file to your computer.

      XSS testing (Case 2)

      1. Edit created Course.
      2. Drag/Upload test_svg_with_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will not see a popup that says "Test XSS".
      6. Right-click on the SVG image and click "Open image in New Tab".
      7. Verify that the browser will not display the image directly.
      8. Verify that the browser will download the file to your computer.
      9. Verify that you will not see a popup that says "Test XSS".
      Show
      Initial setup Create a course. Go to Site administration > Appearance > Courses On courseoverviewfilesext setting, click Choose Select Image (SVG+XML) .svg and Save changes . Functional testing Edit created Course. Drag/Upload test_svg_no_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will see the image under the course name. Verify that you will not see a link to the SVG file. XSS testing (Case 1) Go to the courses page (Site home). Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. XSS testing (Case 2) Edit created Course. Drag/Upload test_svg_with_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will not see a popup that says "Test XSS". Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. Verify that you will not see a popup that says "Test XSS".
    • 1
    • Internationals - 4.0 Sprint 1, HQ Team International Sprint 2, HQ Team International Sprint 3

      The is_valid_image returns false for svg files.

      This means that when looking at the courses page we do not see an image for the course but simply a link to the svg file.

      NOTE: It is likely that svg files were excluded at the time the code was written because IE didn't support them. All modern browsers support svg files now.

        1. MDl-55243_Test Passed.png
          MDl-55243_Test Passed.png
          186 kB
        2. MDL-55243 error.png
          MDL-55243 error.png
          37 kB
        3. MDL-55243 func ok.png
          MDL-55243 func ok.png
          9 kB
        4. svg image in courses page.png
          svg image in courses page.png
          109 kB
        5. test_svg_no_xss.svg
          4 kB
        6. test_svg_no_xss-1.svg
          4 kB
        7. test_svg_with_xss.svg
          4 kB

            huongn@moodle.com Huong Nguyen
            brudinie guy thomas
            Simey Lameze Simey Lameze
            Andrew Lyons Andrew Lyons
            Gladys Basiana Gladys Basiana
            Votes:
            7 Vote for this issue
            Watchers:
            18 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - 0 minutes
                0m
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 4 days, 5 hours, 41 minutes
                4d 5h 41m

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.