Hello,
I've recently discovered something which is quite alarming and I really don't like that users are able to do this.
So in Moodle 4, the site changed so that courses and activities are shown fixed-width. This has a lot of readability and accessibility benefits by setting the maximum number of characters that can appear on a line, and I really like it. I have had requests to take this away and I have refused them.
Here's the thing: some people in certain departments have gone rogue and have been sharing this code, which they have been adding to labels and custom HTML blocks in their courses:
-script tag removed-
var cssRules = ".pagelayout-standard #page.drawers .main-inner, body.limitedwidth #page.drawers .main-inner { max-width: 100%;}";
var styleElement = document.createElement('style');
styleElement.appendChild(document.createTextNode(cssRules));
document.getElementsByTagName('head')[0].appendChild(styleElement);
-end script tag removed-
I'm a little bit horrified that they're able to do this. I've managed to reproduce this on a development site, and taking away the "Trust submitted content" permission doesn't seem to stop them being able to do this.
Is anyone familiar with the code behind the "Trust submitted content" feature that can tell me exactly what it blocks and how, and whether random users should be able to embed bits of Javascript like this?
I'm a little bit worred about the security implications of this.
Edit: Adding a link to the purifier function in lib/weblib.php
