Moodle Security Concerns

Moodle Security Concerns

Alexandre Freire -
回帖数：2

Dear community,

I would like to start a discussion regarding Moodle Security. One of my main concerns I do have about using Moodle is regarding security since we have lof of security flaws and holes on PHP scripting language specially on sql injection techniques.  This is the main reason I did not adopt Moodle yet. I would like to understand and start a discussion about a few topics regarding this subject:

1) What do you think about a specific Forum about Security ?

2) What are the steps needed to make Moodle secure? (directory permissions, database handling etc..)

3) Concerns about using moodle in a hosted service (my example)

4) Steps to identify security holes and steps for a fast  report to Moodle community in order to develop fixes/patches quickly

5) What do you think about creating a Moodle Security quick start Guide?

Thanks!

My regards

Alex.

 

平均分： -
回复Alexandre Freire

Re: Moodle Security Concerns

Anthony Borrow -
Core developers的头像 Plugin developers的头像 Testers的头像
Alex - Actually there is a whole site dedicated to security (http://security.moodle.org/) which thankfully gets remarkably very little traffic. You should probably start by reading http://docs.moodle.org/en/Security since I think it will answer a number of your concerns. The developers have taken great care into making sure that data is validated as it comes in from the user thus helping to reduce the likelihood of sql injection attacks. I know that Moodle is used at many high schools and university campuses. I trust the ingenuity of students to find security holes and exploit them; however, I just have not seen that many issues pop up and when they do the developers make them a top priority and come up with fixes, send notifications out, and help to prevent issues before they start. Thanks for the idea but I think the developers have beaten you to it this time. Feel free to continue to think through suggestions on the forums and if you come up with some ideas of how Moodle can be improved or discover any bugs you should be aware of the tracker at tracker.moodle.org Peace - Anthony
平均分： -
回复Alexandre Freire

Re: Moodle Security Concerns

Martin Dougiamas -
Core developers的头像 Documentation writers的头像 Moodle HQ的头像 Particularly helpful Moodlers的头像 Plugin developers的头像 Testers的头像
We have spent a lot of time dealing with such issues in the past, and will address any further issues quickly if they come up.

Anthony pointed out the security site which is still currently the main place to report issues. This site will be phased out soon because in the new tracker you can flag bugs as security concerns and only the security group can see them.

As for best practice in keeping your own site secure, a web page would be a great idea.

http://docs.moodle.org/en/Security

You may want to help add things to that page.




平均分： -