General help

I can't really see a way around this if the files are to be uploaded ... there are many cases when course files must be accessible to students in that course even if they are not directly linked as an uploaded resources (eg files linked within another file).  I suppose you could tell your teachers to use random names like 2answers-74757458989.html

The best way is just not to upload them as files ... instead, use the internal formats (plain text or HTML resources). These are stored in the database and all the visible/non-visible security applies to them.

Hi Gustav,

here is a small hack of moodle/file.php that restrict to students direct access to an uploaded file if it is not included in a resource in the current course.

First try, only for testing and discussion.

Bye,

Bernard

//bb
if (!isteacher($course->id) and !isadmin() ) {
    if (!$resources = get_records_sql("SELECT *
        FROM {$CFG->prefix}resource
        WHERE course= $courseid
        AND reference
        LIKE '%$filename%'")) {
            notice("<center>You cannot access this item directly until it appears as a ressource     in  the course</center> ");
    }
}

Good work for a Sunday moodlers.

Here is a bigger hack modifying only file.php but correcting many ( it is not completed but it give a good idea on how to finish it that way ).

It use log to check from where came the student.

It also treat not visible resources.

Is there things that are not possible that way? ( please don't tell things that are not done it is not finished).

Have a good cogitation,

Bernard

p.s. I lost some indentation in the txt file

//bb
    if (!isteacher($course->id) and !isadmin() ) {
        $logs = get_records("log", "userid", $USER->id);

     foreach ($logs as $log) {  // sure it exist a better way to get the last one
        }

     switch ($log->module) {
            case "course":
                $label = get_records_sql("SELECT *
                             FROM {$CFG->prefix}label
                             WHERE course= $courseid
              AND content
                             LIKE '%$filename%'"); 
    
    $section = get_records_sql("SELECT *
                                FROM {$CFG->prefix}course_sections
                                WHERE course= $courseid
                    AND summary
                                LIKE '%$filename%'"); 

    $resource = get_record_sql("SELECT *
                                    FROM {$CFG->prefix}resource
                                    WHERE course= $courseid
                        AND reference
                                    LIKE '%$filename%'");

    
    if ($resource )  {
                   $module = get_record("course_modules", "course", $courseid,"module", 6,"instance",                       $resource->id);
                }

    
    if (!$section and !$label and (!$resource or !$module->visible)) {

                    notice("<center>You cannot access this item directly until it appears in the course</center> ");
                }
   break;

   case "resource":
                if (!$resource = get_records_sql("SELECT *
                                         FROM {$CFG->prefix}resource
                                         WHERE course= $courseid
                 AND reference
                                         LIKE '%$filename%'"))  {
                    notice("<center>You cannot access this item directly until it appears in the course</center> ");
                }
   break;
  
            case "quiz":
                if (!$quiz = get_records_sql("SELECT *
                                 FROM {$CFG->prefix}quiz_questions
                                 WHERE 1
         AND  image LIKE '%$filename%'
                 OR
              questiontext  LIKE '%$filename%'") )  {
                        notice("<center>You cannot access this item directly until it appears in the course</center> ");
                }
   break;
     default:
    $resource = get_record_sql("SELECT *
                                    FROM {$CFG->prefix}resource
                                    WHERE course= $courseid
                        AND reference
                                    LIKE '%$filename%'");

    
    if ($resource )  {
                   $module = get_record("course_modules", "course", $courseid,"module", 6,"instance",                       $resource->id);
                }

    if (!$resource or !$module->visible) {
     notice("<center>You cannot access this item directly until it appears in the course</center> ");
                }
            break;
        }
    }

I know that this thread is over a year old, but...

I, too, am wrestling with this security issue. Here is an idea that may be easily workable.

I propose that a new table be created with the following schema...

CREATE TABLE filelinks (
file_id CHAR(30) PRIMARY KEY,
file_name CHAR(256),
);

Then, any time a new "Uploaded File" resource is added, a row would be inserted into this table as follows...

A random string of characters would be generated as the "file_id"
The desired file name would, of course, be assigned to "file_name"
An attempt to insert the row would be made
If the attempt succeeds, the process would be complete
If the attempt does not succeed, due to a duplicate primary, a new random string
would be generated and a new attempt would be made

The actual resource row would include the "file_id" value in its "name" column, instead of the actual file name.

Then, the file.php script would be modified slightly so as not to expect a filename path, but instead to expect a "file_id". When invoked, it would do a simple, quick retrieval of the row in the "filelinks" table where the file_id matches.

If now row is found, the script would report a friendly message like "You are attempting to hack the CMS. Please see your instructor for proper disciplinary action."

If a row is found, the script would perform its normal processing of the file whose name is retrieved.

The only other mods that would need to be made would be for when a resource is edited or deleted.

This solution would obscure the filenames completely from the student and, thus, prohibit them from guessing the name of non-assigned resources.

Any thoughts?