Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-56831

module:mod_quiz/preflightcheck uses a YUI module in an unsafe manner

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.1.2
    • Fix Version/s: 3.1.4
    • Component/s: Quiz
    • Labels:
    • Testing Instructions:
      Hide

      As a teacher...
      1. Create a quiz with the following settings:
      a) Extra restrictions on attempts > Require password: Set a password (e.g. abc)
      b) Extra restrictions on attempts (advanced) > Browser security: Full screen pop-up with some JavaScript security
      2. Add a question

      Afterwards, as a student...
      3. Navigate to the quiz
      4. Click "Attempt quiz now"
      5. Enter something in the password field
      6. Try navigating away. Confirm that a warning is shown. Stay on the page instead of navigating away.
      7. Click "Start attempt"
      8. Verify that the proper window is shown (i.e. a started attempt). This verifies that io-form is still included correctly.
      9. Close the opened popup. Now, in the original window, try to navigate away. Confirm that no warning about navigating away is displayed (unless you typed something into the password field after performing step 7). This confirms that moodle-core-formchangechecker is still working.

      Show
      As a teacher... 1. Create a quiz with the following settings: a) Extra restrictions on attempts > Require password: Set a password (e.g. abc) b) Extra restrictions on attempts (advanced) > Browser security: Full screen pop-up with some JavaScript security 2. Add a question Afterwards, as a student... 3. Navigate to the quiz 4. Click "Attempt quiz now" 5. Enter something in the password field 6. Try navigating away. Confirm that a warning is shown. Stay on the page instead of navigating away. 7. Click "Start attempt" 8. Verify that the proper window is shown (i.e. a started attempt). This verifies that io-form is still included correctly. 9. Close the opened popup. Now, in the original window, try to navigate away. Confirm that no warning about navigating away is displayed (unless you typed something into the password field after performing step 7). This confirms that moodle-core-formchangechecker is still working.
    • Affected Branches:
      MOODLE_31_STABLE
    • Fixed Branches:
      MOODLE_31_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      mdl-56831-master

      Description

      The method launchQuizPopup in the amd module:mod_quiz/preflightcheck contains a reference to M.core_formchangechecker, which is a YUI module. However, it is not explicitly imported in that place, but in the method init.

      Usually, init is called prior to launchQuizPopup. There is no guarantee that init completes before launchQuizPopup, though. Therefore there is a slight chance that the module tries to call M.core_formchangechecker, even though it is not loaded yet.

        Attachments

          Activity

            People

            Assignee:
            jan.dagefoerde Jan Dageförde
            Reporter:
            jan.dagefoerde Jan Dageförde
            Peer reviewer:
            Tim Hunt
            Integrator:
            Dan Poltawski
            Tester:
            Jun Pataleta
            Participants:
            Component watchers:
            Tim Hunt, Andrew Nicols, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Fix Release Date:
              9/Jan/17