Was the ability to pass the quiz password in the URL query string removed?

Was the ability to pass the quiz password in the URL query string removed?

Evan Donovan -
Number of replies: 1

I'm trying to figure out if the ability to pass the quiz password in the query string for a quiz was removed between Moodle 2.0 and 2.2. It no longer works after the upgrade, and I didn't see a related issue in Moodle Tracker.

If it was removed, what was the issue where that was discussed? For our purposes, that was a valuable feature - we didn't need the quizzes to be tremendously high security. If it were added back as an option to allow that, that would be great.

Վարկանիշների միջին թիվը. -
In reply to Evan Donovan

Re: Was the ability to pass the quiz password in the URL query string removed?

Tim Hunt -
Core developers Նկարը Documentation writers Նկարը Particularly helpful Moodlers Նկարը Peer reviewers Նկարը Plugin developers Նկարը

Yes, things have changes in a way that probably does break this. (What you were doing uses exactly the same mechanism as 'cross-site request forgery' (XSRF) security vulnerabilites, and so the Moodle forms library makes it difficult to do, and the code changed from using random HTML to using a real Moodle form.

However, if you try a bit harder you can probalby still fake the correct request.

Alternatively, there are now (in 2.2) things called Quiz access rule plugins (http://docs.moodle.org/dev/Quiz_access_rules) and with a new plugin like this you could probably bring back the old behaviour, but in a more secure way.