Security announcements | Moodle.org

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (eg on their profile page).

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

Separate Groups mode restrictions were not honoured when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.

Separate Groups mode restrictions were not honoured in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

The URL parameters accepted by forum search were not limited to the allowed parameters.

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

The "classname" parameter on the admin ad-hoc tasks page required additional sanitizing to prevent a reflected XSS risk.

The mtrace output when running a task in the admin UI required additional sanitizing to prevent an XSS risk.

Insufficient capability checks meant it was possible for all users to view the recipients of badges.

Separate Groups mode restrictions were not honoured in survey response reports, which would display users from other groups.