Moodle in English: Upload XML Mystery

Upload XML Mystery

by daniel jacobsen - Thursday, January 14, 2021, 4:32 AM

Hi, we encountered a problem today importing questions to moodle using moodleXML.

I have 2 files that im testing with. One properly formatted file with a load of questions, and one test file called test.xml.

Basically when i import the test.xml which just contains a bunch of copied characters over and over, it uploads fine to the server.

But when i try and upload the real file with the actual questions i want to add to the database I get a server error. Keep in mind that this error comes before i've clicked the import button. So this is happening on upload.

They are both xml files.
test.xml is larger than the proper file.
The proper file uploads fine in our other test environment which should be the same backend except it does not operate on https. rather uses http.

To me it seems like https is scanning and rejecting the proper xml file for some reason but is this possible? We are using Bitnami moodle image.

Svar: Upload XML Mystery

by daniel jacobsen - Thursday, January 14, 2021, 6:51 PM

After doing more digging. It certainly seems its the content of the file that determines whether its accepted or not. And i suspect the blocker is cloudflare. After alot of trial and error i found that if i reduce the content down to a couple of questions, simply removing two parenthesis is the difference if the file is accepted or not. In a sentence the word drain is in parenthesis.

So if i change it from "(drain)" to "drain" and keep everything else the same the file will be accepted to upload. I suspect cloudflare reads the file and looks for stuff like that to try and protect from javascript or code uploads in xml files. But that is not confirmed as of now.

Average of ratings: -

Re: Svar: Upload XML Mystery

by Tim Hunt - Friday, January 15, 2021, 5:05 AM

Yes, it seems that people who make security heuristics in firewalls don't care about false positives. These things frequently break people's Moodle sites in ways that are subtle and hard to debug. They are configurable. You can disable particular rules selectively, but it is an annoying hoop to have to jump through.

Average of ratings: -

Quiz

Upload XML Mystery