search

learnweb / moodle-mod_moodleoverflow

:speech_balloon: Non-linear discussion module for Q&A forums
GNU General Public License v3.0
12 stars 22 forks source link

Bypassing anonymous mode #171

Closed gergelyrakoczi closed 7 months ago

gergelyrakoczi commented 8 months ago

Thank you for this great plugin, we love it at TU Wien - especially the anonymous mode. In this mode I have detected an interesting thing. When a teacher sets the parameter "Anonymous" to "Questioners and answerers (irreversible!)" and later edits a posting of a student that includes an attachment, in the details of the attachment the teacher can identify the name of the author. This bypasses anonymity.

See in this screenshot: moodleoverflow_screenshot_2024

Did I misconfigure something or is this an open issue/bug somehow.

Looking forward to hearing from you.

Thank you and keep up the great work.

Best regards, Gergely Rakoczi

NinaHerrmann commented 8 months ago

Hey Gergely Rakoczi, indeed this is a bug that I did not encounter beforehand. As the filepicker is taken from core Moodle we have to do some research on files that can be uploaded anonymously. Otherwise, I think the only valid behavior is to disallow file uploading for anonymous forums or disable editing :thinking: Thanks for reporting we will take a look at it cheers, Nina

gergelyrakoczi commented 8 months ago

Hi Nina, you are welcome and thank you for having a look at it. I agree - preventing attachments will work, however from a didactical point of view they are really useful in some cases. Thank you and best regards from Vienna, Gergely

NinaHerrmann commented 8 months ago

173 might be a solution - however, the pull request requires tests before being merged. If you have time it would help us greatly if you would test the branch!

gergelyrakoczi commented 8 months ago

Superb, thank you. I have tested it locally and now instead of the user's name, I see "Anonym" (as a teacher). Great thank you!

NinaHerrmann commented 8 months ago

Okay, that is great! I think we still need to test minor things e.g. what happens if files are changed removed etc. but looks like we have a solution where we do no have to limit functionality! :partying_face: