diff --git a/filter/mediaplugin/dev/perftest.php b/filter/mediaplugin/dev/perftest.php index 2d09c50f856..2ad68a6d4cd 100644 --- a/filter/mediaplugin/dev/perftest.php +++ b/filter/mediaplugin/dev/perftest.php @@ -42,7 +42,7 @@ print $OUTPUT->header(); // Enable all players. $enabledmediaplugins = \core\plugininfo\media::get_enabled_plugins(); -\core\plugininfo\media::set_enabled_plugins('vimeo,youtube,videojs,html5audio,html5video,swf'); +\core\plugininfo\media::set_enabled_plugins('vimeo,youtube,videojs,html5audio,html5video'); // Create plugin. $filterplugin = new filter_mediaplugin(null, array()); @@ -153,4 +153,4 @@ filter_mediaplugin_perf_stop('One link (mp3)'); // End page. echo html_writer::end_tag('ul'); -print $OUTPUT->footer(); \ No newline at end of file +print $OUTPUT->footer(); diff --git a/filter/mediaplugin/filter.php b/filter/mediaplugin/filter.php index 726c1d1abd8..7d70f8368c3 100644 --- a/filter/mediaplugin/filter.php +++ b/filter/mediaplugin/filter.php @@ -74,7 +74,7 @@ class filter_mediaplugin extends moodle_text_filter { return $text; } - // Check SWF permissions. + // Check permissions. $this->trusted = !empty($options['noclean']) or !empty($CFG->allowobjectembed); // Looking for tags. @@ -177,7 +177,7 @@ class filter_mediaplugin extends moodle_text_filter { */ protected function embed_alternatives($urls, $name, $width, $height, $options) { - // Allow SWF (or not). + // Allow trusted content (or not). if ($this->trusted) { $options[core_media_manager::OPTION_TRUSTED] = true; } diff --git a/filter/mediaplugin/tests/filter_test.php b/filter/mediaplugin/tests/filter_test.php index 861e4f01b84..de09814238f 100644 --- a/filter/mediaplugin/tests/filter_test.php +++ b/filter/mediaplugin/tests/filter_test.php @@ -34,8 +34,8 @@ class filter_mediaplugin_testcase extends advanced_testcase { function test_filter_mediaplugin_link() { $this->resetAfterTest(true); - // we need to enable the plugins somehow and the flash fallback. - \core\plugininfo\media::set_enabled_plugins('vimeo,youtube,videojs,html5video,swf,html5audio'); + // We need to enable the media plugins. + \core\plugininfo\media::set_enabled_plugins('vimeo,youtube,videojs,html5video,html5audio'); set_config('useflash', true, 'media_videojs'); $filterplugin = new filter_mediaplugin(null, array()); diff --git a/lang/en/admin.php b/lang/en/admin.php index 5723e87c1c6..ebd2744195c 100644 --- a/lang/en/admin.php +++ b/lang/en/admin.php @@ -826,8 +826,6 @@ $string['mediapluginogv'] = 'Enable .ogv filter'; $string['mediapluginram'] = 'Enable .ram filter'; $string['mediapluginrm'] = 'Enable .rm filter'; $string['mediapluginrpm'] = 'Enable .rpm filter'; -$string['mediapluginswf'] = 'Enable .swf filter'; -$string['mediapluginswfnote'] = 'As a default security measure, normal users should not be allowed to embed swf flash files.'; $string['mediapluginwmv'] = 'Enable .wmv filter'; $string['mediapluginyoutube'] = 'Enable YouTube links filter'; $string['messaging'] = 'Enable messaging system'; @@ -1552,3 +1550,6 @@ $string['modchooserdefault'] = 'Activity chooser default'; // Deprecated since Moodle 4.0. $string['coursepage'] = 'Course page'; +$string['mediapluginswf'] = 'Enable .swf filter'; +$string['mediapluginswfnote'] = 'As a default security measure, normal users should not be allowed to embed swf flash files.'; + diff --git a/lang/en/deprecated.txt b/lang/en/deprecated.txt index 82c1378f352..cb6a296e2e8 100644 --- a/lang/en/deprecated.txt +++ b/lang/en/deprecated.txt @@ -159,3 +159,5 @@ importfrominstructions,core_calendar proceedtocourse,core_enrol coursepage,core_admin invalidpersistenterror,core_competency +mediapluginswf,core_admin +mediapluginswfnote,core_admin diff --git a/lib/classes/check/manager.php b/lib/classes/check/manager.php index d32386f90c2..b8b52243dd8 100644 --- a/lib/classes/check/manager.php +++ b/lib/classes/check/manager.php @@ -126,7 +126,6 @@ class manager { new environment\publicpaths(), new environment\configrw(), new environment\preventexecpath(), - new security\mediafilterswf(), new security\embed(), new security\openprofiles(), new security\crawlers(), @@ -156,4 +155,3 @@ class manager { return $checks; } } - diff --git a/lib/classes/check/security/mediafilterswf.php b/lib/classes/check/security/mediafilterswf.php deleted file mode 100644 index 78632b99d70..00000000000 --- a/lib/classes/check/security/mediafilterswf.php +++ /dev/null @@ -1,83 +0,0 @@ -. - -/** - * Verifies sloppy swf embedding - this should have been removed long ago!! - * - * @package core - * @category check - * @copyright 2020 Brendan Heywood - * @copyright 2008 petr Skoda - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ - -namespace core\check\security; - -defined('MOODLE_INTERNAL') || die(); - -use core\check\check; -use core\check\result; - -/** - * Verifies sloppy swf embedding - this should have been removed long ago!! - * - * @copyright 2020 Brendan Heywood - * @copyright 2008 petr Skoda - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ -class mediafilterswf extends check { - - /** - * Get the short check name - * - * @return string - */ - public function get_name(): string { - return get_string('check_mediafilterswf_name', 'report_security'); - } - - /** - * A link to a place to action this - * - * @return action_link|null - */ - public function get_action_link(): ?\action_link { - return new \action_link( - new \moodle_url('/admin/settings.php?section=managemediaplayers'), - get_string('managemediaplayers', 'media')); - } - - /** - * Return result - * @return result - */ - public function get_result(): result { - $details = get_string('check_mediafilterswf_details', 'report_security'); - - $activefilters = filter_get_globally_enabled(); - - $enabledmediaplayers = \core\plugininfo\media::get_enabled_plugins(); - if (array_search('mediaplugin', $activefilters) !== false and array_key_exists('swf', $enabledmediaplayers)) { - $status = result::CRITICAL; - $summary = get_string('check_mediafilterswf_error', 'report_security'); - } else { - $status = result::OK; - $summary = get_string('check_mediafilterswf_ok', 'report_security'); - } - return new result($status, $summary, $details); - } -} - diff --git a/lib/classes/filetypes.php b/lib/classes/filetypes.php index 8d32b35c9d3..cea82ed1973 100644 --- a/lib/classes/filetypes.php +++ b/lib/classes/filetypes.php @@ -260,8 +260,8 @@ abstract class core_filetypes { 'svgz' => array('type' => 'image/svg+xml', 'icon' => 'image', 'groups' => array('image', 'web_image'), 'string' => 'image'), 'swa' => array('type' => 'application/x-director', 'icon' => 'flash'), - 'swf' => array('type' => 'application/x-shockwave-flash', 'icon' => 'flash', 'groups' => array('video', 'web_video')), - 'swfl' => array('type' => 'application/x-shockwave-flash', 'icon' => 'flash', 'groups' => array('video', 'web_video')), + 'swf' => array('type' => 'application/x-shockwave-flash', 'icon' => 'flash'), + 'swfl' => array('type' => 'application/x-shockwave-flash', 'icon' => 'flash'), 'sxw' => array('type' => 'application/vnd.sun.xml.writer', 'icon' => 'writer'), 'stw' => array('type' => 'application/vnd.sun.xml.writer.template', 'icon' => 'writer'), diff --git a/lib/classes/plugin_manager.php b/lib/classes/plugin_manager.php index be2741a4fef..810bbb3b21d 100644 --- a/lib/classes/plugin_manager.php +++ b/lib/classes/plugin_manager.php @@ -1725,6 +1725,7 @@ class core_plugin_manager { 'block' => array('course_overview', 'messages', 'community', 'participants'), 'cachestore' => array('memcache'), 'enrol' => array('authorize'), + 'media' => array('swf'), 'qformat' => array('webct'), 'message' => array('jabber'), 'quizaccess' => array('safebrowser'), @@ -1908,7 +1909,7 @@ class core_plugin_manager { ), 'media' => array( - 'html5audio', 'html5video', 'swf', 'videojs', 'vimeo', 'youtube' + 'html5audio', 'html5video', 'videojs', 'vimeo', 'youtube' ), 'message' => array( diff --git a/lib/db/install.php b/lib/db/install.php index c67a582675f..e1ba215072d 100644 --- a/lib/db/install.php +++ b/lib/db/install.php @@ -131,7 +131,7 @@ function xmldb_main_install() { 'filterall' => 0, // setting page, so have to be initialised here. 'texteditors' => 'atto,tinymce,textarea', 'antiviruses' => '', - 'media_plugins_sortorder' => 'videojs,youtube,swf', + 'media_plugins_sortorder' => 'videojs,youtube', 'upgrade_extracreditweightsstepignored' => 1, // New installs should not run this upgrade step. 'upgrade_calculatedgradeitemsignored' => 1, // New installs should not run this upgrade step. 'upgrade_letterboundarycourses' => 1, // New installs should not run this upgrade step. diff --git a/lib/db/upgrade.php b/lib/db/upgrade.php index 96e0dead125..b5207e87b04 100644 --- a/lib/db/upgrade.php +++ b/lib/db/upgrade.php @@ -2778,5 +2778,15 @@ function xmldb_main_upgrade($oldversion) { upgrade_main_savepoint(true, 2021091100.02); } + if ($oldversion < 2021091700.01) { + // Remove media_swf (unless it has manually been added back). + if (!file_exists($CFG->dirroot . '/media/player/swf/classes/plugin.php')) { + unset_all_config_for_plugin('media_swf'); + } + + // Main savepoint reached. + upgrade_main_savepoint(true, 2021091700.01); + } + return true; } diff --git a/lib/tests/medialib_test.php b/lib/tests/medialib_test.php index bd3ed759429..833fadbfb1b 100644 --- a/lib/tests/medialib_test.php +++ b/lib/tests/medialib_test.php @@ -142,10 +142,10 @@ class core_medialib_testcase extends advanced_testcase { $manager = core_media_manager::instance(); $this->assertSame('youtube, html5audio', $this->get_players_test($manager)); - // Test SWF and HTML5 media order. - \core\plugininfo\media::set_enabled_plugins('html5video,html5audio,swf'); + // Test HTML5 media order. + \core\plugininfo\media::set_enabled_plugins('html5video,html5audio'); $manager = core_media_manager::instance(); - $this->assertSame('html5video, html5audio, swf', $this->get_players_test($manager)); + $this->assertSame('html5video, html5audio', $this->get_players_test($manager)); // Make sure that our test plugin is considered installed. \core\plugininfo\media::set_enabled_plugins('test,html5video'); @@ -181,11 +181,6 @@ class core_medialib_testcase extends advanced_testcase { \core\plugininfo\media::set_enabled_plugins('html5video'); $manager = core_media_manager::instance(); $this->assertTrue($manager->can_embed_url($url)); - - // Only SWF. - \core\plugininfo\media::set_enabled_plugins('swf'); - $manager = core_media_manager::instance(); - $this->assertFalse($manager->can_embed_url($url)); } /** @@ -195,7 +190,6 @@ class core_medialib_testcase extends advanced_testcase { public function test_embed_url_fallbacks() { // Key strings in the embed code that identify with the media formats being tested. - $swf = ''; $html5video = ''; $html5audio = ''; $link = 'mediafallbacklink'; @@ -218,7 +212,7 @@ class core_medialib_testcase extends advanced_testcase { $this->assertStringContainsString($link, $t); // Enable media players that can play the same media formats. (ie. test & html5audio for mp3 files, etc.) - \core\plugininfo\media::set_enabled_plugins('test,html5video,html5audio,swf'); + \core\plugininfo\media::set_enabled_plugins('test,html5video,html5audio'); $manager = core_media_manager::instance(); // Test media formats that can be played by 2 or more players. @@ -234,13 +228,11 @@ class core_medialib_testcase extends advanced_testcase { $this->assertStringContainsString($test, $textwithlink); $this->assertStringNotContainsString($html5video, $textwithlink); $this->assertStringContainsString($html5audio, $textwithlink); - $this->assertStringNotContainsString($swf, $textwithlink); $this->assertStringContainsString($link, $textwithlink); $this->assertStringContainsString($test, $textwithoutlink); $this->assertStringNotContainsString($html5video, $textwithoutlink); $this->assertStringContainsString($html5audio, $textwithoutlink); - $this->assertStringNotContainsString($swf, $textwithoutlink); $this->assertStringNotContainsString($link, $textwithoutlink); break; @@ -248,13 +240,11 @@ class core_medialib_testcase extends advanced_testcase { $this->assertStringContainsString($test, $textwithlink); $this->assertStringContainsString($html5video, $textwithlink); $this->assertStringNotContainsString($html5audio, $textwithlink); - $this->assertStringNotContainsString($swf, $textwithlink); $this->assertStringContainsString($link, $textwithlink); $this->assertStringContainsString($test, $textwithoutlink); $this->assertStringContainsString($html5video, $textwithoutlink); $this->assertStringNotContainsString($html5audio, $textwithoutlink); - $this->assertStringNotContainsString($swf, $textwithoutlink); $this->assertStringNotContainsString($link, $textwithoutlink); break; @@ -266,10 +256,9 @@ class core_medialib_testcase extends advanced_testcase { /** * Test for embed_url. - * Check SWF works including the special option required to enable it + * SWF shouldn't be converted to objects because media_swf has been removed. */ public function test_embed_url_swf() { - \core\plugininfo\media::set_enabled_plugins('swf'); $manager = core_media_manager::instance(); // Without any options... @@ -280,7 +269,7 @@ class core_medialib_testcase extends advanced_testcase { // ...and with the 'no it's safe, I checked it' option. $url = new moodle_url('http://example.org/test.swf'); $t = $manager->embed_url($url, '', 0, 0, array(core_media_manager::OPTION_TRUSTED => true)); - $this->assertStringContainsString('', $t); + $this->assertStringNotContainsString('', $t); } /** diff --git a/lib/upgrade.txt b/lib/upgrade.txt index cf038f4d88b..32eceb15a20 100644 --- a/lib/upgrade.txt +++ b/lib/upgrade.txt @@ -89,6 +89,8 @@ information provided here is intended especially for developers. DB call on every request. * As the message_jabber notification plugin has been moved to the plugins database, the XMPPHP library (aka Jabber) has been completely removed from Moodle core too. +* The SWF media player has been completely removed (The Flash Player was deprecated in 2017 and officially discontinued +on 31 December 2020). === 3.11.2 === * For security reasons, filelib has been updated so all requests now use emulated redirects. diff --git a/media/classes/manager.php b/media/classes/manager.php index 2b24d866f90..7038d25d6cf 100644 --- a/media/classes/manager.php +++ b/media/classes/manager.php @@ -66,7 +66,8 @@ final class core_media_manager { * Option: Enable players which are only suitable for use when we trust the * user who embedded the content. * - * At present, this option enables the SWF player. + * In the past, this option enabled the SWF player (which was removed). + * However, this setting will remain because it might be used by third-party plugins. * * To enable, set value to true. */ diff --git a/media/player/swf/classes/plugin.php b/media/player/swf/classes/plugin.php deleted file mode 100644 index 939a6e41fa9..00000000000 --- a/media/player/swf/classes/plugin.php +++ /dev/null @@ -1,100 +0,0 @@ -. - -/** - * Main class for plugin 'media_swf' - * - * @package media_swf - * @copyright 2016 Marina Glancy - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ - -defined('MOODLE_INTERNAL') || die(); - -/** - * Media player for Flash SWF files. - * - * This player contains additional security restriction: it will only be used - * if you add option core_media_player_swf::ALLOW = true. - * - * Code should only set this option if it has verified that the data was - * embedded by a trusted user (e.g. in trust text). - * - * @package media_swf - * @copyright 2016 Marina Glancy - * @author 2011 The Open University - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ -class media_swf_plugin extends core_media_player { - public function embed($urls, $name, $width, $height, $options) { - self::pick_video_size($width, $height); - - $firsturl = reset($urls); - $url = $firsturl->out(true); - - $fallback = core_media_player::PLACEHOLDER; - $output = << - - - - - - - - - - - - - - - - - - - -$fallback - - - - - -OET; - - return $output; - } - - public function get_supported_extensions() { - return array('.swf'); - } - - public function list_supported_urls(array $urls, array $options = array()) { - // Not supported unless the creator is trusted. - if (empty($options[core_media_manager::OPTION_TRUSTED])) { - return array(); - } - return parent::list_supported_urls($urls, $options); - } - - /** - * Default rank - * @return int - */ - public function get_rank() { - return 30; - } -} diff --git a/media/player/swf/classes/privacy/provider.php b/media/player/swf/classes/privacy/provider.php deleted file mode 100644 index 579b3298609..00000000000 --- a/media/player/swf/classes/privacy/provider.php +++ /dev/null @@ -1,46 +0,0 @@ -. - -/** - * Privacy provider implementation for media_swf. - * - * @package media_swf - * @copyright 2018 Mihail Geshoski - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ - -namespace media_swf\privacy; - -defined('MOODLE_INTERNAL') || die(); - -/** - * Privacy provider implementation for media_swf. - * - * @copyright 2018 Mihail Geshoski - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ -class provider implements \core_privacy\local\metadata\null_provider { - - /** - * Get the language string identifier with the component's language - * file to explain why this plugin stores no data. - * - * @return string - */ - public static function get_reason() : string { - return 'privacy:metadata'; - } -} diff --git a/media/player/swf/lang/en/media_swf.php b/media/player/swf/lang/en/media_swf.php deleted file mode 100644 index c5862a0c046..00000000000 --- a/media/player/swf/lang/en/media_swf.php +++ /dev/null @@ -1,27 +0,0 @@ -. - -/** - * Strings for plugin 'media_swf' - * - * @package media_swf - * @copyright 2016 Marina Glancy - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ - -$string['pluginname'] = 'Flash animation'; -$string['pluginname_help'] = 'For security reasons this format is only embedded within trusted text.'; -$string['privacy:metadata'] = 'The Flash animation media plugin does not store any personal data.'; diff --git a/media/player/swf/pix/icon.png b/media/player/swf/pix/icon.png deleted file mode 100644 index 01a9d3cfa39..00000000000 Binary files a/media/player/swf/pix/icon.png and /dev/null differ diff --git a/media/player/swf/tests/player_test.php b/media/player/swf/tests/player_test.php deleted file mode 100644 index e5d2f96f641..00000000000 --- a/media/player/swf/tests/player_test.php +++ /dev/null @@ -1,151 +0,0 @@ -. - -/** - * Test classes for handling embedded media. - * - * @package media_swf - * @copyright 2016 Marina Glancy - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ - -defined('MOODLE_INTERNAL') || die(); - -/** - * Test script for media embedding. - * - * @package media_swf - * @copyright 2016 Marina Glancy - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ -class media_swf_testcase extends advanced_testcase { - - /** - * Pre-test setup. Preserves $CFG. - */ - public function setUp(): void { - global $CFG; - parent::setUp(); - - // Reset $CFG and $SERVER. - $this->resetAfterTest(); - - // We need trusttext for embedding swf. - $CFG->enabletrusttext = true; - - // Consistent initial setup: all players disabled. - \core\plugininfo\media::set_enabled_plugins('swf'); - - // Pretend to be using Firefox browser (must support ogg for tests to work). - core_useragent::instance(true, 'Mozilla/5.0 (X11; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0 '); - } - - - /** - * Test that plugin is returned as enabled media plugin. - */ - public function test_is_installed() { - $sortorder = \core\plugininfo\media::get_enabled_plugins(); - $this->assertEquals(['swf' => 'swf'], $sortorder); - } - - /** - * Test embedding without media filter (for example for displaying file resorce). - */ - public function test_embed_url() { - global $CFG; - - $url = new moodle_url('http://example.org/1.swf'); - - $manager = core_media_manager::instance(); - $embedoptions = array( - core_media_manager::OPTION_TRUSTED => true, - core_media_manager::OPTION_BLOCK => true, - ); - - $this->assertTrue($manager->can_embed_url($url, $embedoptions)); - $content = $manager->embed_url($url, 'Test & file', 0, 0, $embedoptions); - - $this->assertMatchesRegularExpression('~mediaplugin_swf~', $content); - $this->assertMatchesRegularExpression('~~', $content); - $this->assertMatchesRegularExpression('~width="' . $CFG->media_default_width . '" height="' . - $CFG->media_default_height . '"~', $content); - - // Repeat sending the specific size to the manager. - $content = $manager->embed_url($url, 'New file', 123, 50, $embedoptions); - $this->assertMatchesRegularExpression('~width="123" height="50"~', $content); - - // Not working without trust! - $embedoptions = array( - core_media_manager::OPTION_BLOCK => true, - ); - $this->assertFalse($manager->can_embed_url($url, $embedoptions)); - $content = $manager->embed_url($url, 'Test & file', 0, 0, $embedoptions); - $this->assertDoesNotMatchRegularExpression('~mediaplugin_swf~', $content); - } - - /** - * Test that mediaplugin filter replaces a link to the supported file with media tag. - * - * filter_mediaplugin is enabled by default. - */ - public function test_embed_link() { - global $CFG; - $url = new moodle_url('http://example.org/some_filename.swf'); - $text = html_writer::link($url, 'Watch this one'); - $content = format_text($text, FORMAT_HTML, ['trusted' => true]); - - $this->assertMatchesRegularExpression('~mediaplugin_swf~', $content); - $this->assertMatchesRegularExpression('~~', $content); - $this->assertMatchesRegularExpression('~width="' . $CFG->media_default_width . '" height="' . - $CFG->media_default_height . '"~', $content); - - // Not working without trust! - $content = format_text($text, FORMAT_HTML); - $this->assertDoesNotMatchRegularExpression('~mediaplugin_swf~', $content); - } - - /** - * Test that mediaplugin filter adds player code on top of ~', $content); - $this->assertDoesNotMatchRegularExpression('~assertDoesNotMatchRegularExpression('~Unsupported text~', $content); - $this->assertDoesNotMatchRegularExpression('~ tag. - $text = ''; - $content = format_text($text, FORMAT_HTML, ['trusted' => true]); - $this->assertMatchesRegularExpression('~mediaplugin_swf~', $content); - $this->assertMatchesRegularExpression('~~', $content); - $this->assertMatchesRegularExpression('~width="123" height="35"~', $content); - } -} diff --git a/media/player/swf/version.php b/media/player/swf/version.php deleted file mode 100644 index 38de7ed5d8f..00000000000 --- a/media/player/swf/version.php +++ /dev/null @@ -1,29 +0,0 @@ -. - -/** - * Version details - * - * @package media_swf - * @copyright 2016 Marina Glancy - * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later - */ - -defined('MOODLE_INTERNAL') || die(); - -$plugin->version = 2021052500; // The current plugin version (Date: YYYYMMDDXX). -$plugin->requires = 2021052500; // Requires this Moodle version. -$plugin->component = 'media_swf'; // Full name of the plugin (used for diagnostics). diff --git a/report/security/lang/en/deprecated.txt b/report/security/lang/en/deprecated.txt new file mode 100644 index 00000000000..cc725afe394 --- /dev/null +++ b/report/security/lang/en/deprecated.txt @@ -0,0 +1,4 @@ +check_mediafilterswf_details,report_security +check_mediafilterswf_error,report_security +check_mediafilterswf_name,report_security +check_mediafilterswf_ok,report_security diff --git a/report/security/lang/en/report_security.php b/report/security/lang/en/report_security.php index 291638654a3..e031725784f 100644 --- a/report/security/lang/en/report_security.php +++ b/report/security/lang/en/report_security.php @@ -82,10 +82,6 @@ $string['check_guestrole_error'] = 'The guest role "{$a}" is incorrectly defined $string['check_guestrole_name'] = 'Guest role'; $string['check_guestrole_notset'] = 'Guest role is not set.'; $string['check_guestrole_ok'] = 'Guest role definition is OK.'; -$string['check_mediafilterswf_details'] = '

Automatic swf embedding is very dangerous - any registered user may launch an XSS attack against other server users. Please disable it on production servers.

'; -$string['check_mediafilterswf_error'] = 'Flash media filter is enabled - this is very dangerous for the majority of servers.'; -$string['check_mediafilterswf_name'] = 'Enabled .swf media filter'; -$string['check_mediafilterswf_ok'] = 'Flash media filter is not enabled.'; $string['check_nodemodules_details'] = '

The directory {$a->path} contains Node.js modules and their dependencies, typically installed by the NPM utility. These modules may be needed for local Moodle development, such as for using the grunt framework. They are not needed to run a Moodle site in production and they can contain potentially dangerous code exposing your site to remote attacks.

It is strongly recommended to remove the directory if the site is available via a public URL, or at least prohibit web access to it in your webserver configuration.

'; $string['check_nodemodules_info'] = 'The node_modules directory should not be present on public sites.'; $string['check_nodemodules_name'] = 'Node.js modules directory'; @@ -147,3 +143,9 @@ $string['pluginname'] = 'Security checks'; $string['security:view'] = 'View security report'; $string['timewarning'] = 'Data processing may take a long time, please be patient...'; $string['privacy:metadata'] = 'The Security overview plugin does not store any personal data.'; + +// Deprecated since Moodle 4.0. +$string['check_mediafilterswf_details'] = '

Automatic swf embedding is very dangerous - any registered user may launch an XSS attack against other server users. Please disable it on production servers.

'; +$string['check_mediafilterswf_error'] = 'Flash media filter is enabled - this is very dangerous for the majority of servers.'; +$string['check_mediafilterswf_name'] = 'Enabled .swf media filter'; +$string['check_mediafilterswf_ok'] = 'Flash media filter is not enabled.'; diff --git a/version.php b/version.php index 4135a3e9e6b..502ae758dab 100644 --- a/version.php +++ b/version.php @@ -29,7 +29,7 @@ defined('MOODLE_INTERNAL') || die(); -$version = 2021091700.00; // YYYYMMDD = weekly release date of this DEV branch. +$version = 2021091700.01; // YYYYMMDD = weekly release date of this DEV branch. // RR = release increments - 00 in DEV branches. // .XX = incremental changes. $release = '4.0dev (Build: 20210917)'; // Human-friendly version name