Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-67198

404 errors for missing parameters should be 307

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 3.6.7, 3.7.1, 3.7.2
    • Fix Version/s: None
    • Component/s: Libraries
    • Labels:
    • Affected Branches:
      MOODLE_36_STABLE, MOODLE_37_STABLE

      Description

      I am running Moodle 3.7.2 on a shared webserver. My logfiles showed  several scripts generating 404 (and other) errors in what seemed to be a somewhat arbitrary pattern. A few examples:

       

      • /mod/assign/index.php
      • /mod/assign/view.php
      • /mod/lesson/edit.php
      • /mod/lesson/continue.php
      • /mod/lesson/view.php
      • /mod/lesson/essay.php
      • /mod/lesson/lesson.php
      • /mod/lesson/report.php

      After giving it a closer look, I found out that this happens for example if the id parameter is missing. However, this should not happen if people are following a lesson normally. Some users had the problem right after logging in. There is at least one case where the HTTP referrer was mod/lesson/view.php?id=XXX&pageid=XXX, meaning that the id and pageid were there before. In other cases, it is caused by a missing sesskey parameter.

      In my opinion, the 404 Status Code is wrong in that case, because the requested resource is actually found. I suggest setting the response to 307 (Temporary Redirect), because we are only redirecting to an error page for the missing parameters. On the next correct request, the resource will be shipped out normally.

      We should bear in mind that 404 errors might trigger IP bans on shared hosting plans.

      As a workaround, I modified lib/outputrenderers.php on line 2788.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              philippimhof PhilippImhof
              Participants:
              Component watchers:
              Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona), Víctor Déniz Falcón
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 10 minutes
                10m