search

FMCorz / moodle-block_xp

A gamification plugin for Moodle allowing students to gain experience points and level up.
https://levelup.plus/?ref=github
149 stars 42 forks source link

Users can edit other users profiles from the ladder. #119

Closed easyflhomeschool closed 3 years ago

easyflhomeschool commented 3 years ago

I have a group of students who click on other students on the ladder and changed their photos and usernames. Thankfully they only did this to their siblings and close friends, but they were able to access all member so the site. How can this be restricted? I can hide their identites, but that takes the fun out of the ladder. How can I show the identities, but not allow them to access member profiles?

FMCorz commented 3 years ago

Thank you for your report.

Level up! does not allow students to edit any other students information, even teachers themselves cannot use Level up! to modify students' pictures or names. There must be an issue in permissions allowing students to modify other accounts, we suggest that you revise the "edit:profile" capabilities.

Regarding removing the link to the profile page from the leaderboards, at this point you can either choose to completely hide the identity of other students, or not, there are unfortunately no options to remove the link on its own. Regardless, removing the link would not prevent students from accessing each other's profile via other links, or simply by modifying the URLs.

easyflhomeschool commented 3 years ago

I think I was able to lock it all down. Thank you.