Content processing and user trust

Re: Content processing and user trust

by Michael Hughes -
Number of replies: 0
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers

(paraphrasing response on the ticket for purpose discussion here!)

Speaking as some one who supports a University, with very talented CIS (for example) lecturers and learning technologists who would be impacted by this).

Yes, as some of them are sufficiently competent to do interesting things via this route. Others are not. It should be individual institution decision as to whether or not they trust their staff to be competent to do so, and for Moodle to allow for different levels of trust to be granted. 

So the question "is should they all be allowed to add Javascript to Moodle sites by default?", and does there need to be much more overt warnings to those users who are allowed to do this, about them holding that capability and the repercussions. Should the process why which "arbitrary" javascript is added to a page be improved to ask for verification (say) every time it gets updated (and potentially *prevent* non-permitted users from editing that content and stripping it back out?).

Equally should the issues mentioned by Tim Hunt, where the logged-in-as user has stripped out content make it hard for that user to get a realistic "logged in" view of another user. 

But maybe those privileged users shouldn't be allow to have that content whilst they are privileged, rather than the non-privileged users and once logged in must be treated in all respects as the users they are logged in as (so do XSS protections need to be tightened against admin pages...yes of course).