If the security level is set to 'Could be a security issue', then you need to be logged in to view the issue. If the security level is set higher than this, you need to be in a certain group to be able to view it.
After a security issue is fixed, sometimes the level is changed to allow more people to view it. Otherwise, the security announcement will provide enough information so that it is not necessary to view the tracker issue.
Hello Helen,
do you have any news for this issue??
You understand it's very critical for moodle admins as it has security impacts to companies and organisations..
Regards,
Andreas
Hello Andreas,
I can confirm that the issue has the priority set as 'Critical' and is being worked on. The developers are trying to get the fix included in Moodle 3.1.3 (scheduled for release on Monday 14 November); if not it will be available soon afterwards.
Thank you Helen for your reply.
In the meantime, as security issues raised, I managed to hide this option from css with this codeQ
.path-mod-assign [data-region="user-selector"] .alignment input {
width:100px;
border:none;
box-shadow: inset 0 0px 0px rgba(0,0,0,0);
pointer-events:none;
}
.path-mod-assign [data-region="user-selector"] .alignment .form-autocomplete-downarrow {
display:none!important;
}
I post it here if anyone needs to use it.
Thanks Andreas for your workaround.
I can confirm that MDL-56363 is fixed in today's release of Moodle 3.1.3.
Thank you Helen for your support!
Glad to hear that this huge bug has been fixed!
Another update: The security level of MDL-56363 has been reduced, so everyone can now view it.