search

jlb224 / moodle-mod_notetaker

Notetaker plugin for Moodle - allows students to take public or private notes within a course.
https://jlb224.github.io/moodle-mod_notetaker/
Other
2 stars 4 forks source link

Security: Notefield not formatted before displayed, allowing for XSS #5

Closed mudrd8mz closed 3 years ago

mudrd8mz commented 4 years ago

When displaying the notefield only file_rewrite_pluginfile_urls() is called. But there needs to be format_text() called first to

  1. apply the selected format such as Markdown
  2. apply all enabled filters
  3. clean the text from embedded JS

As it is now, users can submit JS into their public notes, which is then executed in other users' sessions. That is serious security bug. Please refer to https://docs.moodle.org/dev/Security:Cross-site_scripting