Was the ability to pass the quiz password in the URL query string removed?

Was the ability to pass the quiz password in the URL query string removed?

Evan Donovan -
回帖数:1

I'm trying to figure out if the ability to pass the quiz password in the query string for a quiz was removed between Moodle 2.0 and 2.2. It no longer works after the upgrade, and I didn't see a related issue in Moodle Tracker.

If it was removed, what was the issue where that was discussed? For our purposes, that was a valuable feature - we didn't need the quizzes to be tremendously high security. If it were added back as an option to allow that, that would be great.

回复Evan Donovan

Re: Was the ability to pass the quiz password in the URL query string removed?

Tim Hunt -
Core developers的头像 Documentation writers的头像 Particularly helpful Moodlers的头像 Peer reviewers的头像 Plugin developers的头像

Yes, things have changes in a way that probably does break this. (What you were doing uses exactly the same mechanism as 'cross-site request forgery' (XSRF) security vulnerabilites, and so the Moodle forms library makes it difficult to do, and the code changed from using random HTML to using a real Moodle form.

However, if you try a bit harder you can probalby still fake the correct request.

Alternatively, there are now (in 2.2) things called Quiz access rule plugins (http://docs.moodle.org/dev/Quiz_access_rules) and with a new plugin like this you could probably bring back the old behaviour, but in a more secure way.