Martin Dougiamas

Moodle 2 requires PHP 5.2.4 or later. In these versions zip and xmlrpc are both included and recommended.

The Moodle docs were wrong, it's all much simpler than that.

Fixed: admin/environment/php_extension/zip

It looks like $COURSE is not being set properly for that script (or it is actually somewhere in the top front page course).

The PHP/Moodle script should be doing something like this at the top to authenticate the user properly and set the $COURSE global as well:

require_course_login($course, true, $cm);

(based on data gained from the parameters to the script)

Tim wrote a cool new regexp that seems to cover an even wider range of cases, I've installed it.

$text = preg_replace('#(?:MDL|MDLSITE|CONTRIB)-\d+\b(?![^\'"<>]*[\'"][^>]*>)(?![^<]*)#',
'$0',
$text);


All we need now is a reliable method using nolink tags that all the filters can use! eg MDL-15555

In this case, I don't think netpublish has any problems at all.

But as you guessed the correct procedure would be to flag a security issue in the tracker, plus it would be nice to let the author know (if you know them).