Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-76590

assignfeedback_editpdf doesn't delete its files and data when a submission is removed

Details

    Description

      When a student removes their submission, the preview files generated by assignfeedback_editpdf aren't deleted. Trainers can still view the submission inside the grading view. This is a potential privacy issue, since the removed submission might contain sensitive information if the student uploaded the wrong file erroneously.

      Steps to reproduce

      1. Create an assignment (with assignfeedback_editpdf enabled).
      2. Log in as a student and hand in a PDF file.
      3. Log in as a teacher, click "Grade" next to the student's submission and wait for the PDF preview to be displayed (this is necessary to ensure that the preview is generated).
      4. Log in as the student and remove the submission.
      5. Log in as the teacher and click "Grade" next to the submission.

      What you see: The grading preview of the PDF file uploaded by the student.

      What you expect: A blank page.

      Suggested solution

      Remove the preview files (and database entries?) related to a submission when it is removed. A "submission_removed" event (which I proposed in MDL-74433 because it doesn't currently exist) would come in handy here.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              bonczek Lars Bonczek
              Votes:
              5 Vote for this issue
              Watchers:
              10 Start watching this issue

              Dates

                Created:
                Updated:

                Clockify

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.