search

EduardoKrausME / moodle-mod_certificatebeautiful

1 stars 2 forks source link

Direct access of $_FILES #8

Closed purnendudash closed 8 months ago

purnendudash commented 9 months ago

https://github.com/EduardoKrausME/moodle-mod_certificatebeautiful/blob/55c90966d8e638e04288206f7175775754e4e888/_editor/upload.php#L27

Kindly use this one instead - https://moodledev.io/docs/apis/subsystems/form/usage/files

eduardokraus commented 9 months ago

Dear Purnendu Dash,

I appreciate your message and suggestion. However, I would like to emphasize that the file in question is indispensable for the proper functioning of the certificate editor. Unfortunately, the suggested replacement is not a viable option for me, as the use of this specific file is essential for proper loading in the editor.

Furthermore, it is important to mention that I do not load the Moodle config.php file, and removing this support would compromise the necessary UPLOAD functionality for the certificate editor.

Thank you for your understanding, and I am available to discuss possible alternatives or solutions that can be implemented without compromising the integrity and functionality of the system.

Sincerely, Eduardo kraus

mudrd8mz commented 8 months ago

it is important to mention that I do not load the Moodle config.php file

Was there a particular reason for not doing so? I think I understand the need to have a service that returns base64 encoded file. However, by not using config.php, sesskey and all other common protection layers, this script effectively turns every Moodle site with this plugin into a public host offering this as a free service.

Not an end of the world, but I am wondering about the reasoning. TIA.

eduardokraus commented 8 months ago

I asked for help from the GrapesJS community, and they provided me with a solution.

mudrd8mz commented 8 months ago

Did they specifically suggest to bypass the standard authentication and authorisation mechanisms in Moodle?

mudrd8mz commented 8 months ago

Was this closed as completed intentionally or by mistake? I became quite confused now I must admit.

eduardokraus commented 8 months ago

I closed it because I deleted the file

https://github.com/EduardoKrausME/moodle-mod_certificatebeautiful/commit/ed1ff080717502a4a51cb2ef0be3490e2cf909d2

mudrd8mz commented 8 months ago

Oh I see. So is it going to be implemented in another way?

eduardokraus commented 8 months ago

I've already changed and committed. this problem no longer exists.