Moodle for mobile

User Student Role Removed from Course via App

 
Ryan Hazen
User Student Role Removed from Course via App
 

Hi all,

Somehow a user, or perhaps the app independent of the user, managed to remove their role in a course form the mobile app.

Here is the situation: Running Moodle 3.1.7+, the user is a student in a course. The student somehow had their role removed, resulting in removing the grades as well. I was able to restore the grades, so no real problem here, but when I checked into the logs to see who had removed this user's role, I found that the origin was "ws" (web services, or the mobile app) and the IP address was the student's mobile IP address, identifiable as a mobile carrier's IP address and the same address from which normal activity on the user's account originates, so pretty good indicator this is the user's device. Here's a sanitized log entry for the event:

Role unassignment

My question is: if a student in a course is not allowed to remove their own role through the web browser, how did this role unassignment happen from the mobile app? Any insight is appreciated; I have disabled web services for my Moodle until I get a handle on this issue.

Thanks in advance!

 
Average of ratings: -
Picture of Dani Palou
Re: User Student Role Removed from Course via App
Core developersMoodle HQParticularly helpful MoodlersPlugin developers

Hi Ryan,

that's really weird. I took a look at the list of WebServices and there is one named "core_role_unassign_roles", but it isn't used by the Mobile app and it isn't even part of the Mobile service, so we shouldn't be able to use it even if we wanted to unless you have created another service.

Maybe it's a side effect of some other WebService call. I searched a bit but I wasn't able to find what might have caused this. I'll let Juan Leyva know, but you'll have to wait a few days to get an answer.

I guess the student was using the official Moodle Mobile app, not a custom app, right?

Kind regards,

Dani

 
Average of ratings: Useful (1)
Ryan Hazen
Re: User Student Role Removed from Course via App
 

Correct, this is the official Moodle app - not a custom version.

I do have a few other Web services set up - Mootivated, Intelliboard, Attendance, and MHAAIRS (McGraw-Hill). The reason I suspect the mobile app is because the student was actively using the mobile app when the role removal happened.

 
Average of ratings: -
Picture of Dani Palou
Re: User Student Role Removed from Course via App
Core developersMoodle HQParticularly helpful MoodlersPlugin developers

Thanks, I'll tell Juan Leyva about this since he knows a lot more about WebServices and maybe he can provide a clue about what happened. However, you might have to wait a few days to get a response.

Cheers,

Dani

 
Average of ratings: -
Picture of Juan Leyva
Re: User Student Role Removed from Course via App
Core developersMoodle HQParticularly helpful MoodlersPlugin developersTesters

Hi,

the Mobile services don't export any WS capable of doing a user un-enrolment, I suspect that this was done by some of the plugins.

You may have a clue in the log report where it says "the user with id .. unassigned" you should check if that user is used by one of the other plugins.


 
Average of ratings: -