Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-70638

Teacher cannot view files in a student's description

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Minor
    • Resolution: Fixed
    • 3.10, 3.11, 4.0
    • 3.10.5, 3.11.1
    • Files API
    • MOODLE_310_STABLE, MOODLE_311_STABLE, MOODLE_400_STABLE
    • MOODLE_310_STABLE, MOODLE_311_STABLE
    • MDL-70638-311
    • Hide

      Setup

      1. Login as admin
      2. Create two new users: teacher & student
      3. After creation, edit each users Description field to include a file
        • Note it's easier to test if just embedding an image from the Wikimedia repository
      4. Create a new course
      5. Enrol both users in the course (teacher with Teacher role; student with Student role)
      6. Logout

      As teacher

      1. Login as teacher
      2. Navigate to course
      3. View course participants
      4. View the course profile of both users (teacher and student)
      5. Confirm the image embedded in the description is shown for both users
      6. On each profile page, press Miscellaneous > Full profile
      7. Confirm the image embedded in the description is shown for both users
      8. Logout

      As student

      1. Repeat all steps as performed for the teacher above
      Show
      Setup Login as admin Create two new users: teacher & student After creation, edit each users Description field to include a file Note it's easier to test if just embedding an image from the Wikimedia repository Create a new course Enrol both users in the course (teacher with Teacher role; student with Student role) Logout As teacher Login as teacher Navigate to course View course participants View the course profile of both users (teacher and student) Confirm the image embedded in the description is shown for both users On each profile page, press Miscellaneous > Full profile Confirm the image embedded in the description is shown for both users Logout As student Repeat all steps as performed for the teacher above

    Description

      It's possible for a student to embed files (such as a name pronunciation) in the description field of their profile. However, a teacher who tries to view the file will encounter a "file not found" error or similar (with streaming media, it's "The media could not be loaded, either because the server or network failed or because the format is not supported." or something like it, depending on the browser).

      I think the root issue is the order of tests in the file_pluginfile function. Within user and profile, assuming login is forced for profiles, they go like this:

      1. Is the viewing user a guest user?
      2. Does the target user have a course contact role (i.e. a teacher) and the viewing user have the moodle/user:viewdetails capability?
      3. Does the viewing user have the moodle/user:viewdetails capability in one or more courses?

      The first two tests are an automatic fail, calling send_file_not_found(). I don't think that's right for the second test. If you're a teacher viewing a student you'll never reach the third test, because the student doesn't have the coursecontact role. A teacher can view a teacher's profile, however.

      Attachments

        Issue Links

          Activity

            People

              pholden Paul Holden
              cfulton Charles Fulton
              Sujith Haridasan Sujith Haridasan
              Eloy Lafuente (stronk7) Eloy Lafuente (stronk7)
              Anna Carissa Sadia Anna Carissa Sadia
              Matteo Scaramuccia, Andrew Lyons, Huong Nguyen, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze, Stevani Andolo
              Votes:
              6 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                12/Jul/21

                Time Tracking

                  Estimated:
                  Original Estimate - 0 minutes
                  0m
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours, 10 minutes
                  4h 10m