Security Issues

Security Issues

by Howard Miller -
Number of replies: 20
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
I have a crazy plan to spend a little time straightening this module up. I know there has been talk of a complete re-write, but I would initially prefer to patch up the existing code. I *have* had a look and appreciate that some of it is rather grim!!

In particular, could somebody spell out the security issues that have been mentioned. I take it from other posts the Sesskey business is missing or shaky? I guess this would be a good place to start!
Average of ratings: -
In reply to Howard Miller

Re: Security Issues

by Petr Skoda -
Picture of Core developers Picture of Documentation writers Picture of Peer reviewers Picture of Plugin developers
Sure, I will post the details at security.moodle.org today.

skodak
In reply to Petr Skoda

Re: Security Issues

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Thanks! I will look out for it. I have been looking further and am starting to appreciate the magnitude of the problem smile
In reply to Howard Miller

Re: Attendance problems

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
The biggest problem is that you can add one Attendance activity in one week, but the module will create activities in every week! And you can't delete them easily.

I think the whole concept needs revisiting. For example, it would probably be better done as a block, with a nice little graphical display showing attendance for the whole course period or the current week.

I'm still keen to delete the module entirely from the main CVS tree (and move it to contrib)
In reply to Martin Dougiamas

Re: Attendance problems

by Petr Skoda -
Picture of Core developers Picture of Documentation writers Picture of Peer reviewers Picture of Plugin developers
My +1 for moving it to contrib, IMO developers have much greater freedom to modify it there and you do not have to merge the changes back to head wink

I have updated my report on security.moodle.org.
In reply to Martin Dougiamas

Re: Attendance problems

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Thanks Martin!

fair enough.... it's all a bad idea isn't it smile
In reply to Howard Miller

Re: Attendance problems

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Attendance is now gone from HEAD and MOODLE_15_STABLE. The upgrade procedure tries to deal with it nicely, by disabling the module if it had data, or deleting the tables if it wasn't being used.

If anyone wants Attendance, they can easily reinstall it from the modules download page, or from its new location in cvs:/contrib/attendance

I still love the idea of automatically (and optionally, manually) keeping some sort of attendance record or statistics, and would like to see it come back someday!  I think a block makes the most sense ...
In reply to Martin Dougiamas

Re: Attendance problems

by James Robertson -

Thanks Martin,

While attendance records may seem unimportant, I have been surprised at the number of times attendance patterns have been a most valuable diagnostic for helping a struggling student.  Currently attendance records are not mandatory at our school, so every teacher who keeps attendance has their own method and format (mostly individually-created xls or docs).  I have been hoping some attention would be paid to an attendance module so that teachers who desire to keep attendance could have a standardized method that's integrated into the rest of the on-line management system. 

I don't have an opinion about what approach is best (not familiar with blocks), I am just glad to see that there is at least some interest in resurrecting attendance.  I am only a beginner with php (though I have a lot of experience in C/C++) so I am not in a position to help at this point, but if someone does begin work on attendance, I would be interested in testing/reviewing any alpha version as soon as it became available.

Thanks,

Jim Robertson.

In reply to Martin Dougiamas

Re: Attendance problems

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Ok - I would be interested to here from those actually using attendance what they think its future is - what do you like? what do you hate? Should it be an activity or a block? What do you think? I believe I can spend some time on Attendance if there is a need, but I don't have a clear idea where it is going at the moment.
In reply to Howard Miller

Re: Attendance problems

by Vijay Kumar Adhikari -
We use Attendance extensively. It is better to have it as it is. I mean it should be an activity. I like everything about the Attendance module except that it was never stable. I can be of help if you want some testers. We run more than 50 courses here at http://classroom.kcm.edu.np and al course instructors demand for this module.
In reply to Vijay Kumar Adhikari

Re: Attendance problems

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Hi Vijay,

Could you spend 5 minutes and put together a "wish list" for the activity? Particularly any problems with the current version.
In reply to Howard Miller

Re: Attendance problems

by Vijay Kumar Adhikari -
The problems that we have found are:

1. A student can not see if he/she is absent in a particular roll. Currently, the student sees that he/she is always present(mod/attendance/view.php). If the student wants to view all rolls, it says 'Sorry, there is no data for your account here'(mod/attendance/viewall.php). The teacher has no such problems.

2. The teacher gets 'Course module is incorrect' when he/she tries to 'View All Attendance Rolls from the Calendar Week'.(mod/attendance/viewweek.php?scope=week).

3. Teachers don't like the text 'http://www.alpine-usa.com/company_info/press_release/010804_ipad.html' at the bottom(mod/attendance/viewall.php). I don't know why it is there.

3. Student's don't like the texts 'Dynamically moved to section: No
Automatic from logs: No
Graded: No'. There should be some options to show/hide these texts.

4. When a roll is moved from one section from another, a new attendance activity is created. Don't know, why.

We can start with fixing these problems.
In reply to Howard Miller

Re: Attendance problems

by W Page -

Hi Howard!

It is very nice of you to look into the possibility of "refactoring" (Did I use this term correctly? You know I am still in the learning process. smile) the Attendance module.

I hope it is "OK" to add to Vijay's wish list (to include some things I have learned while using Moodle and playing with code)?

1.  Making the Attendance module send results to a central table (I read about this a lot with the Gradebook module) so that it is easier to move students (From what I understand this feature will be in future Moodles relating to the Gradebook) between different classes with the same subject and still maintain their attendance record on a continuum.  Also this will be helpful when StudentMoodle pages, ParentMoodle pages, Guidance Counselor Moodle pages, (in other words "Role" specified pages are eventually developed.

2.  Making attendance "PDA" compatible so teachers, parents and specified others can take and monitor attendance from a HandHeld.

3.  Making it optional to assign a grade to attendance which is determined by a specified protocol.  For example, 100% attendance is worth 100 points, 90% - 99% attendance is worth 95 points, etc.

4.  Ability to automatically make certain days count toward attendance and others not.  For example, weekends.

5.  Ability to fine tune what days count toward attendance and which ones do not.  For example there may be

  • A weekend activity that students are expected to partake in.
  • A holiday within the week that is a "no school" day for students.
  • A protracted holiday affecting weekdays. For example, spring break

I think I am done for now. big grin

WP1

In reply to W Page

Re: Attendance problems

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
PDA compatible... is that all? smile

Seriously... thanks for the input. That's very useful.
In reply to Vijay Kumar Adhikari

Re: Attendance problems

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
I'd like to see a lot more thought go into any new version because I think there will be better ways to do the same thing (and go further).  The existing module is still there for anyone who wants it.

Some ideas:

One thing that must change is that one attendance activity must not spew multiple copies of itself throughout the course.  It's confusing to users and it breaks a lot of rules in the code which causes other problems (eg backups).

If it was a block it could

   - be self-contained
   - not be tied to any particular topic or week
   - function across/between courses
   - provide an overview display that is always there

For repeating events, it could add entries into the calendar, entries with links that called the block with different parameters.

I also think the automatic mode should process the standard Moodle logs in order to find out when students were present or not.
In reply to Martin Dougiamas

Re: Attendance problems

by Thomas Robb -
I don't see why an attendance feature should be a resource/activity since there should never be multiple instances of it in a course, should there?  A block would make much more sense.

As far as an automatic feature does, I first tried culling the info out of the logs, but it was just too slow.  For this reason, I decided that separate file that placed copies of relevant records in a separate file was much more efficient.  See my separate posting on this matter.

http://moodle.org/mod/forum/discuss.php?d=24913
In reply to Thomas Robb

Re: Attendance problems

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
For sure, there would be no need to re-process old dates where the logs weren't changing, results for these would be stored within Attendance in summary form.  Only logs for the current hour/day/week/whatever would need to be examined.
In reply to Martin Dougiamas

Re: Attendance problems

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
I agree really. But as for the existing code, is it worth spending a bit of time fixing the security issues and the few bugs or do you think we should just 'abandon' it and start work on a block version?
In reply to Howard Miller

Re: Attendance problems

by Chris Martin -

We've begun work on a block as well for our Mandatory Chapel attendance.  If it was a default block that would help and give us the abilitity to do parameters.  As it stands our plan is for students to be enrolled in a Chapel course that has a gradebook detailing their attendance..... which is validated by a card swipe.  Now we just have to figure out import routines to "validate" the swipe as good and then parse that file to give credit.  Anyone else doing something like this?

In reply to Chris Martin

Re: Attendance problems

by Timothy Takemoto -

As far as I know the attendance module was for checking use of the online system (I never used it) but you are looking for something to check offline attendance - in a physical chapel building, is that correct?

Prof Okuda, Narumi Sekiya and Thomas Robb have developed the feedback module (originally an adapted journal module)
http://moodle.org/mod/forum/discuss.php?d=22526
with which one can give each student a unique random code number in chapel (perhaps handing them out at the door) that the students then have to enter into the feedback module for that week. The problem is that one has to print and cut out enough little pieces of paper for the numbers, but it was very popular with the teachers that tried it here.

BTW Recently photocopiers have been installed in our university that connect directly to my computer. I believe it is possible to merge data from microsoft word and excel, so that, for example a column of addresses is taken from an excel file and added to the top of a letter, so that each letter printed has a different address. The same technique could be used to concatenate the code number with some lecture notes, or chapel hyms, so that the unique identifier is appended to the top of a lecture/chapel handout.

Swipe cards can be lent to other students.

Chris Martin