-
Bug
-
Resolution: Fixed
-
Minor
-
3.1
-
MOODLE_31_STABLE
-
MOODLE_30_STABLE, MOODLE_31_STABLE
-
wip-
MDL-56120-master-v2 -
If you create future events that display in the calendar (e.g. assignment or quiz deadlines) then disable the mod that they relate to, then calls to the calendar function calendar_get_events will still return those events, even though in other parts of the code they will not be shown to users (for example, the activity itself won't be shown on the course page).
If you have a calendar block on the page or visit the main calendar then it'll throw a notice similar to:
PHP Notice: info_module::is_user_visible called with invalid cmid 6919
Various other bits of code seem to expect only active modules events to be returned though they often throw errors rather than actually display any info.
I've marked this as a minor security issue, as there is the possibility for information leaking unexpectedly, though it's probably quite difficult to stumble across this in normal usage and unlikely to leak anything critical.