-
Improvement
-
Resolution: Fixed
-
Minor
-
4.3.7, 4.4.3
-
MOODLE_403_STABLE, MOODLE_404_STABLE
-
MOODLE_500_STABLE
-
MDL-82958-main -
-
-
-
2
-
Team Hedgehog 2024 Sprint 3.2, Team Hedgehog 2024 Sprint 3.3, Team Hedgehog 2024 Review 4, Team Hedgehog 2024 Sprint 4.1, Team Hedgehog 2024 Sprint 4.2, Team Hedgehog 2024 Sprint 4.3, Team Hedgehog 2025 Sprint 1.0
If you visit wwwroot/user/ and either don't include any params, or include an id (course ID) or contextid which don't exist, you are shown the DML exception which references the relevant database table (course or context).
I don't consider this a vulnerability, because they are the generic Moodle table names (which are open source information), but it's not best practice (and not an error intended for user consumption), so we should simply return a generic error that the submitted data is not valid.