Feature request: Enable/disable filter codes

[bozicm]

I would like to disable certain filtercodes from being used (disclosing system information or for performance reasons).

A management system like Atto toolbar config could be used for reference how to manage filtercodes:

[michael-milette]

Hi @bozicm

What are your specific concerns regarding system information and performance issues?

Best regards,

Michael

[a-kempka]

Your plugin offers some very convienient functionality! However there are some concerns when enabling most of the tags globally to every role:

• Students can spam tags in a forum making it unreadable or slow due to the amount of content (coursecards, forms)
• Students can abuse system information in a forum post such as displaying the user's IP address or some system data. This could be used for phishing or general fraud.
• Could the sesskey be abused?
• Students can hide text from teachers in a forum (using {ifstudent}) and display a different, harmless text to teachers {ifteacher} making moderation hard as one needs to view the source code of the post to find such occurrences.

It would be great, if tags (or groups of tags such as forms, course cards, if-statements, debug info, system info) could at least be disabled globally (such as there is an option to disable scraping) - a granular control which role's tags or which activities' tags were to be interpreted would be ideal, but I'm not sure filters are aware of this.

[michael-milette]

Hi @a-kempka ,

Thank you for expressing your concerns. It is unfortunate that student-entered information is now processed through Moodle filters. That was not always the case.

As your main concern seems to revolve around the Forum activity, may I suggest that you simply disable the FilterCodes filter for that particular activity? In fact, you can do this for most instances of most activity types in a course.

As for sesskey, it really isn't a secret. There are several links that a user has access to which include the sesskey. It is even available in JavaScript. If someone really wants to make use of it, it is available to them in other ways. IP address? It is going to display your own IP address, not the one of the person who entered it. There are probably dozens of websites like www.myipaddress.com where you can go to find that out, not to mention the OS's shell/command prompt/terminal.

My concern with making it possible to disable some tags is that I want to enable people to use these tags and be creative, not frustrate them because something the documentation says should work does not.

Hope you find this information helpful.

Best regards,

Michael Milette

[PS. Have you ever heard of the Word Censorship plugin for Moodle? Darn, I've said too much already.]

[michael-milette]

Hi @a-kempka ,

Just wanted to let you know that some of your concerns have been addressed in the latest version of FilterCodes released on Moodle.org, particularly with the {sesskey} tag. A solution for some of your additional concerns is under development and will be addressed in the future. Have you had a chance to look into the Word Censorship plugin?