Moodle in English: Question about sanitizing inputs in Moodle

Question about sanitizing inputs in Moodle

by Timothy Kaemmerer - Saturday, June 25, 2011, 2:54 AM

Hi everyone,

I'm looking at Moodle to use it for an online campus for the college I work for. Right now, it looks like it will be perfect (especially the price

I had a question about the security in Moodle. I was pleased when I read through the documentation on security and several threads here on the forum. The information and recommendations are correct and show that there are some knowledgable security gurus here.

But, I saw two threads so far http://moodle.org/mod/forum/discuss.php?d=174950 and http://moodle.org/mod/forum/discuss.php?d=124063

These show that there was (if only theoretically) an attempted code injection into Moodle. My question is, how would anyone be able to pull this off successfully if inputs are properly sanitized and key characters (such as <,>, ;, etc) are not allowed?

It seems unlikely that inputs aren't properly sanitized. I just want to make sure. Besides, I'm learning php, so I'm curious in that respect as well.

Re: Question about sanitizing inputs in Moodle

by Tim Hunt - Saturday, June 25, 2011, 3:09 AM

Inputs and outputs are properly sanitised in Moodle.

In the two forum posts you link to, one shows that the sanitisation worked, and the other was about an admin uploading virus-infected files to their server using FTP - nothing Moodle can do there.

In Moodle, inputs should alwasy go through either our required_param/optional_param santisation funcitons, or our forms library (formslib).

Output should anways go through one of s(), format_string() or format_text() (depending on the type of string it is) which does proper escaping.

Average of ratings: -

Re: Question about sanitizing inputs in Moodle

by Timothy Kaemmerer - Saturday, June 25, 2011, 3:58 AM

Thanks for the reply. Yeah, I was just double checking.

Average of ratings: -

Security and privacy

Question about sanitizing inputs in Moodle