Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-59681

Possible to create circular reference with file aliases

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.2.4, 3.3.1
    • Fix Version/s: None
    • Component/s: Files API, Repositories
    • Labels:
    • Affected Branches:
      MOODLE_32_STABLE, MOODLE_33_STABLE

      Description

      It's possible (from the UI) to create a circular local file reference, which when viewed, causes the script loading the file to crash, which then holds the user's session open indefinitely.

      Steps to reproduce:

      1. Create a page resource
      2. Add an image to the page content area
      3. Save
      4. Edit page
      5. Go to the page content area and click to add a image
      6. Select the Course Files repository
      7. Find the page you just created/are editing
      8. Select the image you previously added
      9. Select "Create an alias/shortcut to the file"
      10. Click select this file
      11. When prompted, select "Overwrite"
      12. Finish inserting the image
      13. Save

      While it's niche, it seems there are two bugs here:

      • You shouldn't be able to create the circular reference in the first page.
      • pluginfile.php shouldn't die horrifically when it happens. Ideally, in this particular case it would recognize that is a local file that is actually available, and server it, but just returning cleanly with an error would be ok. (Edit: found MDL-42328 related to this)

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                emerrill Eric Merrill
                Participants:
                Component watchers:
                Matteo Scaramuccia, Jake Dallimore, Jun Pataleta, Ryan Wyllie, Adrian Greeve, Mihail Geshoski, Peter Dias
              • Votes:
                4 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                • Created:
                  Updated: