MOODLE & GOOGLE ???

MOODLE & GOOGLE ???

by Marc G -
Number of replies: 27

I'm a little concerned w/ the indexing some search engines can do on a Moodle website.  I picked a person popular in Moodle.org...Eloy Lafuente.  I typed his name in Google and here is the result:

GOOGLE RESULTS:

http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=Eloy+Lafuente

As you can see from the link, the top two results are:

moodle: Personal profile: Eloy Lafuente (stronk7)
Moodle -> Eloy Lafuente (stronk7), Eloy Lafuente (stronk7). I could say some
interesting things about me: - I'ma Mac enthusiast. - I'ma Mac enthusiast. ...
moodle.org/user/view.php?id=3176&course=1 - 9k - Cached - Similar pages
[ More results from moodle.org ]

Personal profile: Eloy Lafuente (stronk7) - [ Translate this page ]
Personal profile: Eloy Lafuente (stronk7). Personal profile: Eloy Lafuente
(stronk7). Jump to... ... stronk7), Eloy Lafuente (stronk7). ...
moodle.org/user/view.php?id=3176&course=11 - 24k - Cached - Similar pages

As much of my moodle development is on a test server, and not open to the public, I'd be concerned for my Moodle site when it becomes live.  Is a fix simply disabling the allowing guests on a given Moodle site.  My major concern is once my site is running and open to the world, having such pages that can be indexed by search engines, makes a user's information, as well as their discussions completely public.  Go to Google and type in your name...I was surprised to see all my discussion was open to anyone...even without having to login to Moodle.org as a guest.

Marc

Average of ratings: -
In reply to Marc G

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
This is an optional feature in 1.2 and later. smile

In the Configuration variables is a setting "Open to Google" that by default is turned off. With it off no-one can get in, including Google.

If you turn it on then Google is allowed to cruise the site as Guest, and also people coming in from Google automatically come in as Guest. I have it turned on for this site because it's good for Moodlers using Google.  Sorry if you were surprised to find out this way.
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Ray Lawrence -

As it happens I discovered this myself the other evening (I really must try to get a life). I was also interested to find my entry in the bugtracker, including the password and username I'd submitted so the "bug" could be viewed on my test site.

Average of ratings: -
In reply to Ray Lawrence

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Yes, it's best not to post passwords on public sites like this.

Send me the URL if you like and I can clean it up.
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Marc G -

Thanks,

I was thinking maybe it was something to do w/ permission on the user directory, or something like that.  Very nice...I figured I had missed something simple.  Thank you folks.

Marc

Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Anja Choon -

Hi Martin and everybody else, I have this variable turned off but google still can enter our site. We use Moodle 1.2 Beta (2004022400) at http://www.uwandiigbo.com/moodle. Greetings, Anya

opentogoogle:

No If you enable this setting, then Google will be allowed to enter your site as a Guest. In addition, people coming in to your site via a Google search will automatically be logged in as a Guest. Note that this only provides transparent access to courses that already allow guest access.
Average of ratings: -
In reply to Anja Choon

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Google can always get to the public parts of your site ... this just lets them into the courses as a guest. As your courses don't have guest access I wouldn't expect Google to enter them. Are you sure your internal course pages are open?

By the way, I strongly recommend upgrading to 1.2.1 at least ...
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Anja Choon -

First Martin, thanks for your extremely fast reply! smile Concerning google, it at least can find the profiles, which I already don't like. It seems that it can't find any postings but I am not sure ... How can I ensure that moodle can't find our profiles either? The profile gives the possibility to enter very private information, which I don't want to be accessible by non-members. Greetings, Anya

google.com searching for "anja moemeke-choon"

[...]

Uwandiigbo.com: Personal profile: Anja Moemeke-Choon - [ Diese Seite übersetzen ]
... Forum -> Anja Moemeke-Choon, Anja Moemeke-Choon. My name is actually
pronounced "Anya" but written with a "j" since I am from Germany. ...
uwandiigbo.com/moodle/user/view.php?id=1&course=1 - 7k - Im Cache - Ähnliche Seiten

Uwandiigbo.com: Personal profile: Omenka Ejike Eze - [ Diese Seite übersetzen ]
... on this site. Special thanks go to Anja Moemeke-Choon and Chief Thomas
from the Nigeria-Forum for a job well done. Please send all ...
uwandiigbo.com/moodle/user/view.php?id=2&course=1 - 13k - Im Cache - Ähnliche Seiten
[ Weitere Ergebnisse von uwandiigbo.com ]

[...]

Average of ratings: -
In reply to Anja Choon

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
It finds the profiles via the course descriptions (you are a teacher).

This is the sort of thing that prospective students would also probably want to look at ... which is why it's public.

One solution might be to set Admin -> Configuration -> Variables -> Forcelogin which requires people to log in before using the site.  This will keep Google out completely (it will not get beyond your login page).

Another would be a separate new switch something like "requireloginforprofiles" ... how's that sound?
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Anja Choon -

Oh, if only "teachers" are visible than that's ok in our case. Most of our "teachers" got the same text on our website anyway. I was only worried about the "students". Thanks a lot, Anya

PS: In general, I think that new switch would be good idea.

Average of ratings: -
In reply to Anja Choon

Re: MOODLE & GOOGLE ???

by W Page -
Hi Anja!

Marc Greyson originally began this thread. I think it is a very important one. I agree, a switch like that would be good.

After reading Marc's post I also went to goodle and was shocked to find the profile information posted (keywords: w page moodle). I would be considered a student on an active educational Moodle site.

On another thread there was a suggestion to post student's birthdays to help encourage interaction among students. I think this is fine as long as student information (any of it ) is not posted on the internet.
http://moodle.org/mod/forum/discuss.php?d=7445

Maybe a privacy section on the Admin page is warrented where an admin can make certain decisions about the public and or private status of certain information on a Moodle site. For example, whether teacher and /or student profile information (or certain parts of it) can eventually be trolled by a search spider and posted in a search engine.

The internet policy of an institution should make it clear if profile infomation is to be posted on the internet - admin/teacher/student - or not. I would think in some places an institution or instructor would have to get parental/student approval before this could occurr. I know in NYC this would be a reason not to use Moodle. The Department Of Education has strict policies about Student Information on the web via a teacher's web site.

Just a few things to think about and a suggestion (Admin Privacy Section) smile .

WP1
Average of ratings: -
In reply to W Page

Re: MOODLE & GOOGLE ???

by David Lamotte -

I have been following this with interest and was impressed with both the quality of thought in defining the problem, and Martin's quck response in solving it.

But have we fixed a problem that doesn't exist ? 

Isn't it up to our web server to decide how to respond to requests, and give a different responce to search engine 'robots' and real users ?  The file robots.txt controls the response to the various serch engines that may visit your site.  A quick google will reveal much, with http://www.searchengineworld.com/robots/robots_tutorial.htm being a reasonable place to start.

One possible solution would be to have a plain html page that summarises what you are all about and is available to the search engines, and then exclude the whole Moodle site from being indexed.  This would prevent anything 'accidently' slipping out into the search engines.

Just a thought,

David

Average of ratings: -
In reply to David Lamotte

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Sure, yes robots.txt is another solution for the search engines.

This problem is wider than that though, it's really about access to the user descriptions... by default all profiles are accessible to the public (including search engines but also anyone with a browser). This new setting forceloginforprofiles at least forces users to have an account on the server (and thus their access to this information is prevented or at least logged).

Now, the question is should I enable this option for moodle.org?  smile
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Thomas Robb -
Martin asks: Now, the question is should I enable this option for moodle.org?

I would say, no, since people have the clear option to join or not to join, to put up profile info or not. This isn't the case when Moodle is being used as a course site.

On my school's site, we are *requiring* students to upload photos, and many teachers are having their students fill in the descriptions as an English language exercise, so there is a good argument for keeping this stuff private.

Also worth considering is that fact that Moodle *forces* people to put something in the description box or they can't save their profile.

By the way, while talking about the profile...there was talk quite a while ago about what items should appear in the profile and/or account set-up info. It would be great, if in version 287.2 of Moodle (or sooner), the site administrator could select for each item whether it appears on the profile and account set-up page and whether the item is optional or required.

Hey, and while I'm at it, it would be nice to have about 2 optional fields in mdl_user that the administrator could define in the set-up. In the database, they could be labelled simply as option1 and option2, and the labels for them could be entered in the mdl_config.

Hmm.., if Ger ever gives up his job as thinker/seer-of-Moodle's-future, maybe I could apply for the job! smile
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Hans de Zwart -

I have to admit that out of personal interest I would you not to turn forceloginforprofiles on in Moodle. This way I can take some of the reflected glory of Moodle's link popularity with Google and link to my site(s) in my profile.

If people really want their privacy, then they just don't fill in any real personal details in the profiles...

Those are just my thoughts. I can imagine that other people might have some very strong feelings/opinions in another direction.

Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Jeff Wood -

Does this mean that if the option is turned on "true" than a guest that logs in will be able to see profies from course participants?

If this is the case... is there a way to allow guests (a parent) access to a course without allowing them access to user information (profiles, etc)? 

Jeff

Average of ratings: -
In reply to Jeff Wood

Re: MOODLE & GOOGLE ???

by N Hansen -
Is it possible to allow Google in as a guest but if someone finds a course page through Google, force them to create a login to view it? I ask because having individual pages within a course indexed by Google would probably help drive more traffic to a site, but I do not want users to be able to enter the course without registering. I would rather they be bumped to the registration page automatically and then be taken to the page they found through Google automatically.
Average of ratings: -
In reply to N Hansen

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Hmm .. you can certainly do it (code is near the bottom of lib/setup.php)

However, imagine if all web sites worked like that - Google would be nearly useless as a way to get to information on the web.

I think Google wouldn't like that (they might ban your site from the index).  I wouldn't want Moodle to be associated with that sort of thing.
Average of ratings: -
In reply to David Lamotte

Re: MOODLE & GOOGLE ???

by W Page -
Hi David!

This may be a good approach especially in situations like NYC where student online privacy is paramount.

WP1
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Petr Skoda -
Picture of Core developers Picture of Documentation writers Picture of Peer reviewers Picture of Plugin developers
There is already switch named "forcelogin" with description: "If you want to force people to log in before they do ANYTHING on the site, then you should enable this setting."

I thought (falsely) that it makes login mandatory before ANY access, but in fact it does not protect all pages, I think it should protect also user details and possibly any other non-course data.

The solution should be relatively easy, just add
if ($CFG->forcelogin) {
require_login();
}
to files that you want to make private.

Actually all php files should include require_login or check for forcelogin.

skodak
Average of ratings: -
In reply to Petr Skoda

Re: MOODLE & GOOGLE ???

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Thanks, fixed.  You can now also set $CFG->forceloginforprofiles in config.php.
Average of ratings: -
In reply to Martin Dougiamas

Re: MOODLE & GOOGLE ???

by Art Lader -
Hi, all,

I do not see $CFG->forceloginforprofiles in our config file. Is it something that I should simply add to config.php?

Thanks,
Art
Average of ratings: -
In reply to Marc G

Re: MOODLE & GOOGLE ???

by Jeff Wood -

YIKES!

I did my name (according to what it is on my moodle site) and google returns it as its #1 link.

There I am - my moodle profile.

Jeff

Average of ratings: -
In reply to Jeff Wood

Re: MOODLE & GOOGLE ???

by Mark Burnet -
As Google's Pagerank system ranks based on site links,  (and moodle.org has thousands of these links built into every moodle site)  it is likely that our profiles are more heavily linked here than anywhere else on the web.  Despite the relevance factor.  Unfortunately this is a logic weakness in the Google engine.
Average of ratings: -