Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-77230

The preview of questions for feedback is still possible via WebServices

XMLWordPrintable

    • 1
    • HQ 2023 Sprint i1.1 Moppies

      In MDL-70586 some changes were introduced to prevent end-users to preview the questions.

      Previously, any user at any team was able to preview the questions but now it is only possible to view the questions (launching an attempt to complete the feedback) under two circumstances:
      1 - Feedback available to students without time restrictions set

      2 - Feedback available to students with time restrictions set and the current time is OK (time restrictions wise)

      Via Web Services it is still possible to preview the questions even with time restrictions set and the current time is not ok (out of the valid period), I think this could be addressed by adding the same check that is present in mod/feedback/complete.php

      $feedbackcompletion->is_open() and throwing an exception when the feedback is not open (and the user is not a manager with enough permissions to retrieve items at any time)

      The WebServices to update are get_items() and get_page_items(). The rest of the WS seems to be OK because they are using the validate_feedback_access helper method that does proper checks.

            sarjona Sara Arjona (@sarjona)
            jleyva Juan Leyva
            Juan Leyva Juan Leyva
            Andrew Lyons Andrew Lyons
            CiBoT CiBoT
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - 0 minutes
                0m
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 7 hours
                7h

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.