Comments

• 

  Plugins bot

  Sun, 28 June 2015, 3:02 PM

  Prechecker results: 1600 errors/1238 warnings
  http://integration.moodle.org/job/Precheck%20remote%20branch/14146/artifact/work/smurf.html
• 

  Dan Marsden

  Mon, 6 July 2015, 2:22 PM

  Hi There,
  
  thanks for sharing your plugin, unfortunately it does not meet the standards required for approval within the plugins db. The Prechecker results above show a very large number of issues that you should look at.
  
  The link to your source control and tracker links above are invalid (although I found the repositories in your github account) - it would be good to rename those to a more standard moodle repository naming convention if possible such as "moodle-report_ktreeuserdedicationreport"
  
  A very quick initial look at one of your files showed this:
  https://github.com/KtreeOpenSource/moodle--General-_-KTree-Dashboard--V26/blob/master/exportreportcsv.php#L36
  There are a number of issues with that line
  * direct access to $_GET/$_POST is not allowed, optional/required_param functions should be used with appropriate sanitisation.
  * Injecting user-input in-line into SQL is not allowed (and is very dangerous) - you should use correct Moodle DML syntax and parameterisation.
  * Usernames are not "fixed" - many organisations modify the username of the admin user in particular. removing Guest/admin accounts should be done using moodle capability checks.
  
  This code suggests you need to improve your knowledge on how to write secure code. OWASP and the moodle dev docs have some very useful information that you should investigate further.
  https://docs.moodle.org/dev/Security
  https://www.owasp.org/index.php/PHP_Top_5
  
  I have not looked at other files in your plugin but you need to improve the quality of this code before we can look further, once you have addressed these issues throughout your code, feel free to upload a new version here in the plugins database for someone to take another look.
• 

  Dan Marsden

  Mon, 6 July 2015, 2:27 PM

  My apologies - it looks like I have partially confused this review with the other plugin you have submitted. A quick look at the code in the uploads provided above suggests they suffer from the same issues found in your other plugin - please address these across both plugins you have submitted. Thanks.