search

michael-milette / moodle-filter_filtercodes

FilterCodes filter for Moodle enables content creators to easily customize and personalize course and site content using plain text tags (no HTML). For premium support, contact us at https://www.tngconsulting.ca/contact
https://moodle.org/plugins/filter_filtercodes
GNU General Public License v3.0
32 stars 43 forks source link

Bug: XSRF through sesskey #246

Closed skodak closed 1 year ago

skodak commented 1 year ago

UPDATE: The message was deleted for failure to conform with the repository's code of conduct.

michael-milette commented 1 year ago

Petr, while I appreciate your intention, you are exhibiting unprofessional behaviour, putting site owners in danger and attempting to coerce. This is a direct violation of the repositories code of conduct that you agreed to. If you continue with this unprofessional behaviour, I will have no other choice than to ban you from this repo. You will not receive any additional warnings.

Did you try the latest release of FilterCodes?

andrewhancox commented 1 year ago

@skodak Surely the fact that the sesskey is available from the sesskey property of the M.cfg object means this is either not an issue, or at least not an issue unique to this plugin?

andrewhancox commented 1 year ago

Totally down with the OWASP top 10 - I get the issue now, the filter will enable users to build a URL in a post with a valid sesskey that an instructor could inadvertently open. I was just looking at it from the perspective XSRF/XSS attacks from other applications...

michael-milette commented 1 year ago

@skodak thank you for your comments. I try to see past your poor attitude as the points you bring up are actually very helpful use cases that I had not considered. I will be taking these into consideration.

Please keep in mind that I do this on a voluntary basis. Nobody is paying me to work on this plugin. I am sorry that resolving this issue isn't moving ahead as quickly a you might prefer. Consider financially sponsoring the development of solutions to these issues if you would like it to move faster.

Is there a reason that you keep recommending that people uninstall the plugin rather than just disable the sesskey tag in the settings or make use of the Word Censorship plugin to disable any tags they don’t want?