Import Course Data--No Permissions Needed?

Import Course Data--No Permissions Needed?

by Elizabeth Lewis -
Number of replies: 5
It appears that the Import Course Data function allows "Teacher A" to wholesale take "Teacher B's" course activities without having any rights to "Teacher B's" course.  Is there something that I am missing that would prevent this from happening?
Average of ratings: -
In reply to Elizabeth Lewis

Re: Import Course Data--No Permissions Needed?

by James Dugal -
This can be fixed with a simple change to course/import.php.  I will attach a context diff of the change I made, but please note that the change will affect all non-admin users (ie, affect course creators) because that behaviour was desired here.  You may want creators to be able to import from courses that they didn't create (and the
change to do that is shown as a comment in the diff file).

--James Dugal
In reply to James Dugal

Re: Import Course Data--No Permissions Needed?

by Jussi Hannunen -
I must admit that I too was a bit shocked when I finally understood how the import course data functionality currently works. I don't think that is the correct default behaviour. At least in my institution ability of each teacher to access (copy) the contents of any courses on the site is not acceptable.

I was under the impression that in Moodle a teacher is supposed to have has much of control over his/her own course as can be given without compromising the whole site, but that a teacher should not have any privileges over courses in which he/she is not the teacher.

To put it bluntly, I can't trust our entire 500+ faculty and staff members to behave responsibly, never mind the students that may be unpaid assistant teachers on some courses or working on some project. Phew, at least it was easy to disable (and fix later).

In reply to Jussi Hannunen

Re: Import Course Data--No Permissions Needed?

by Jacques Monnard -
The thing which confuses me (and possibly others) in this respect is the first text which appears on the "Find a course to import from" page : it says "Courses I have taught". This not correct : the list displayed contains all the courses where the current user is registered, either as a teacher or as a student. Shouldn't it be "Courses I have participated in" or something similar ?

One more comment on this "feature" : I can understand that this behavior is by design. However, most teachers are not aware of it, i.e. they don't know that any teacher can import content from their courses. Thus they (wrongly) get the  impression that their content is "private", whereas it is not. Maybe this is something that should be communicated to them. Also, I would appreciate if this could be configured by the administrator, since I don't want to have to apply a diff file for each new version of Moodle wink
In reply to Jacques Monnard

Re: Import Course Data--No Permissions Needed?

by James Dugal -
I reported this in Bug #3648 and also provided a fix.  Perhaps you could visit
moodle.org/bugs and vote on that bug report to encourage getting it fixed permanently.  You will find there a patch to resolve it easily.