diff --git a/lib/db/access.php b/lib/db/access.php
index 8a7e75be250..7bdaa2e9f78 100644
--- a/lib/db/access.php
+++ b/lib/db/access.php
@@ -1,4 +1,4 @@
-<?php
+<?php  // $Id$
 //
 // Capability definitions for Moodle core.
 //
@@ -778,9 +778,7 @@ $moodle_capabilities = array(
     ),
 
     'moodle/question:import' => array(
-
-        'riskbitmask' => RISK_XSS,
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
@@ -791,7 +789,6 @@ $moodle_capabilities = array(
     ),
 
     'moodle/question:export' => array(
-
         'captype' => 'read',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
@@ -802,7 +799,7 @@ $moodle_capabilities = array(
     ),
 
     'moodle/question:managecategory' => array(
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
@@ -812,9 +809,7 @@ $moodle_capabilities = array(
     ),
 
     'moodle/question:manage' => array(
-
-        'riskbitmask' => RISK_XSS,
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_COURSE,
         'legacy' => array(
diff --git a/mod/quiz/db/access.php b/mod/quiz/db/access.php
index aecc9d9ee97..a539c6a175a 100644
--- a/mod/quiz/db/access.php
+++ b/mod/quiz/db/access.php
@@ -1,4 +1,4 @@
-<?php // $Id$
+<?php  // $Id$
 /**
  * Capability definitions for the quiz module.
  *
@@ -9,7 +9,6 @@ $mod_quiz_capabilities = array(
     // Ability to see that the quiz exists, and the basic information
     // about it, for example the start date and time limit.
     'mod/quiz:view' => array(
-
         'captype' => 'read',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -23,7 +22,6 @@ $mod_quiz_capabilities = array(
 
     // Ability to do the quiz as a 'student'.
     'mod/quiz:attempt' => array(
-
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -33,7 +31,7 @@ $mod_quiz_capabilities = array(
 
     // Edit the quiz settings, add and remove questions.
     'mod/quiz:manage' => array(
-
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -44,7 +42,6 @@ $mod_quiz_capabilities = array(
 
     // Preview the quiz.
     'mod/quiz:preview' => array(
-
         'captype' => 'write', // Only just a write.
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -56,7 +53,7 @@ $mod_quiz_capabilities = array(
 
     // Manually grade and comment on student attempts at a question.
     'mod/quiz:grade' => array(
-
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -68,7 +65,7 @@ $mod_quiz_capabilities = array(
 
     // View the quiz reports.
     'mod/quiz:viewreports' => array(
-
+        'riskbitmask' => RISK_PERSONAL,
         'captype' => 'read',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -80,7 +77,7 @@ $mod_quiz_capabilities = array(
 
     // Delete attempts using the overview report.
     'mod/quiz:deleteattempts' => array(
-
+        'riskbitmask' => RISK_DATALOSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
@@ -89,5 +86,4 @@ $mod_quiz_capabilities = array(
         )
     )
 );
-
 ?>