Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-55243

SVG files are images and should be allowed for course images, drag-drop questions, etc.

    XMLWordPrintable

Details

    • MOODLE_30_STABLE, MOODLE_311_STABLE, MOODLE_31_STABLE
    • MOODLE_310_STABLE, MOODLE_311_STABLE
    • MDL-55243-311
    • MDL-55243-master
    • Hide

      Initial setup

      1. Create a course.
      2. Go to Site administration > Appearance > Courses
      3. On courseoverviewfilesext setting, click Choose
      4. Select Image (SVG+XML) .svg and Save changes.

      Functional testing

      1. Edit created Course.
      2. Drag/Upload test_svg_no_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will see the image under the course name.
      6. Verify that you will not see a link to the SVG file.

      XSS testing (Case 1)

      1. Go to the courses page (Site home).
      2. Right-click on the SVG image and click "Open image in New Tab".
      3. Verify that the browser will not display the image directly.
      4. Verify that the browser will download the file to your computer.

      XSS testing (Case 2)

      1. Edit created Course.
      2. Drag/Upload test_svg_with_xss.svg to Course image.
      3. Click on Save and display button.
      4. Go to the courses page (Site home).
      5. Verify that you will not see a popup that says "Test XSS".
      6. Right-click on the SVG image and click "Open image in New Tab".
      7. Verify that the browser will not display the image directly.
      8. Verify that the browser will download the file to your computer.
      9. Verify that you will not see a popup that says "Test XSS".
      Show
      Initial setup Create a course. Go to Site administration > Appearance > Courses On courseoverviewfilesext setting, click Choose Select Image (SVG+XML) .svg and Save changes . Functional testing Edit created Course. Drag/Upload test_svg_no_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will see the image under the course name. Verify that you will not see a link to the SVG file. XSS testing (Case 1) Go to the courses page (Site home). Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. XSS testing (Case 2) Edit created Course. Drag/Upload test_svg_with_xss.svg to Course image. Click on Save and display button. Go to the courses page (Site home). Verify that you will not see a popup that says "Test XSS". Right-click on the SVG image and click "Open image in New Tab". Verify that the browser will not display the image directly. Verify that the browser will download the file to your computer. Verify that you will not see a popup that says "Test XSS".
    • 1
    • Internationals - 4.0 Sprint 1, HQ Team International Sprint 2, HQ Team International Sprint 3

    Description

      The is_valid_image returns false for svg files.

      This means that when looking at the courses page we do not see an image for the course but simply a link to the svg file.

      NOTE: It is likely that svg files were excluded at the time the code was written because IE didn't support them. All modern browsers support svg files now.

      Attachments

        1. MDl-55243_Test Passed.png
          MDl-55243_Test Passed.png
          186 kB
        2. MDL-55243 error.png
          MDL-55243 error.png
          37 kB
        3. MDL-55243 func ok.png
          MDL-55243 func ok.png
          9 kB
        4. svg image in courses page.png
          svg image in courses page.png
          109 kB
        5. test_svg_no_xss.svg
          4 kB
        6. test_svg_no_xss-1.svg
          4 kB
        7. test_svg_with_xss.svg
          4 kB

        Issue Links

          caused a regression

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-72242 Missing SVG files in forum posts

          • Major - Major loss of function, incorrect output
          • Closed

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-72317 Auto-resize in filepicker shows NaN for SVG images

          • Minor - Minor loss of function where workaround is possible
          • Closed

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-72443 SVG files do not support the preview mode

          • Minor - Minor loss of function where workaround is possible
          • Closed
          has a non-specific relationship to

          Improvement - An enhancement to an existing Moodle feature. MDL-61963 Remove file format restrictions for Logos

          • Minor - Minor loss of function where workaround is possible
          • Open

          Improvement - An enhancement to an existing Moodle feature. MDL-72018 Add support to SVG files to badges

          • Minor - Minor loss of function where workaround is possible
          • Open
          has been marked as being related by

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-61215 Badge and user profile picture using an svg file doesn't display

          • Minor - Minor loss of function where workaround is possible
          • Closed
          is blocked by

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-71737 portfolio_flickr should use its own method to check the supported files

          • Minor - Minor loss of function where workaround is possible
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-71430 Drag-drop markers question form validation cannot handle SVG background images

          • Minor - Minor loss of function where workaround is possible
          • Closed

          Activity

            People

              huongn@moodle.com Huong Nguyen
              brudinie guy thomas
              Simey Lameze Simey Lameze
              Andrew Lyons Andrew Lyons
              Gladys Basiana Gladys Basiana
              Votes:
              7 Vote for this issue
              Watchers:
              17 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                12/Jul/21

                Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 days, 5 hours, 41 minutes
                  4d 5h 41m