The response that the web service mod_quiz_get_attempt_review can contain URLs to files in three places. All three seem to have the wrong URL /pluginfile.php instead of /webservice/pluginfile.php

The wrong URLs appear as part of the question (when the question contains inline images), as part of the answer (if the student is allowed to answer with html and uses inline images) and in the attachments (if a question allows the student to include attachments as part of the answer).

A less important fourth place with problematic URLs is for the icons of the attachments. For example /theme/image.php/classic/core/1662989707/f/spreadsheet

I don't know if those should also start with /webservice.

The problem is of course that the URL:s provided in the web service response should be reachable by a web service, but the URLs that don't start with /webservice require different types of authentication (for example SSO) instead of the token used by the web services.

I have compared this to the web service mod_assign_get_submissions where all the URLs are correct and start with /webservice.