Status: Development in progress
3.11.11, 4.0.5, 4.1
When a student removes their submission, the preview files generated by assignfeedback_editpdf aren't deleted. Trainers can still view the submission inside the grading view. This is a potential privacy issue, since the removed submission might contain sensitive information if the student uploaded the wrong file erroneously.
Steps to reproduce
- Create an assignment (with assignfeedback_editpdf enabled).
- Log in as a student and hand in a PDF file.
- Log in as a teacher, click "Grade" next to the student's submission and wait for the PDF preview to be displayed (this is necessary to ensure that the preview is generated).
- Log in as the student and remove the submission.
- Log in as the teacher and click "Grade" next to the submission.
What you see: The grading preview of the PDF file uploaded by the student.
What you expect: A blank page.
Remove the preview files (and database entries?) related to a submission when it is removed. A "submission_removed" event (which I proposed in
MDL-74433 because it doesn't currently exist) would come in handy here.