Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-83088

Diacritics cannot be used in calculated questions

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a bug
    • Icon: Minor Minor
    • None
    • 4.1.13, 4.3.6, 4.3.7
    • Questions
    • None
    • MOODLE_401_STABLE, MOODLE_403_STABLE

      Testing instructions:

      • Create a calculated question within a test or in the question bank;
      • Within the first answer's formula of that question, enter a formula which has a diacritic signs (e.g. é, à, ô, ç) – Example: ({filles}/({garçons}+{filles}))*100;
      • Enter a Question text with those variables, with or without the diactric signs – Example: If there are {filles} filles, and {garcons} garçons in the classroom, what is the proportion of filles in the classroom percentage-wise?
      • Save changes and read the red error message under your formula. There should be Illegal formula syntax starting with '('.

      After upgrading to Moodle 4.3.6, we've received reports that previously created calculated questions weren't working properly if they had diacritic signs within their formulas variables. Moodle was sending Error code: illegalformulasyntax when trying to launch an attempt within quizzes using those questions.

      It seems that those changes are to prevent remote code execution linked to CVE-2024-43425. This is the actual commit (red is previous code, green is new)
        */
       class qtype_calculated extends question_type {
           /**
      -     * @var string a placeholder is a letter, followed by almost any characters. (This should probably be restricted more.)
      +     * @var string a placeholder is a letter, followed by zero or more alphanum chars (as well as space, - and _ for readability).
            */
      -    const PLACEHOLDER_REGEX_PART = '[[:alpha:]][^>} <`{"\']*';
      +    const PLACEHOLDER_REGEX_PART = '[[:alpha:]][[:alpha:][:digit:]-_\s]*';
       
      This can be solved relatively well by teachers as removing the diacritic signs from a Calculated simple question's formula(s) solves the issue. That said, when using sets of variable shared between Calculated questions, it becomes a headache changing sets and the Calculated questions using this.
       
      Is it possible to allow diactric signs again as this could impact many users around the world whose language commonly use diacritics. Otherwise, a more detailed error message mentionning not to use diacritics would be appreciated.
       
      Also, a SQL query to update all calculated questions' formulas and their corresponding sets to replace letters with diacritics to their corresponding letters without diacritics would be useful for admins. I'll see if I can make one myself.
       
      I've also been able to reproduce on 4.1.13, so I suppose all the latest versions of Moodle since August 2024 are affected.

            Unassigned Unassigned
            mblcollecto Marius Larose
            Votes:
            2 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.