Uploaded image for project: 'Sakai'
  1. Sakai
  2. SAK-40747

Samigo > can take quiz via /direct URL without required permissions

    Details

    • Type: Bug
    • Status: Verified
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 11.4, 12.4, 19.0
    • Fix Version/s: 12.5, 19.0
    • Labels:
      None
    • 12 status:
      Resolved
    • 11 status:
      Please Merge
    • Test Plan:
      Hide

      Steps to reproduce:

      1. Create and publish a quiz that is accessible to students
      2. Create an entity link to the quiz (via Announcements, Lessons, etc.)
      3. As admin, go to the Realms tool and edit the main realm for your site (ID)
      4. Edit the student/access role for the realm, and uncheck the permissions "assessment.submitAssessmentForGrade" and "assessment.takeAssessment"; save the realm
      5. Log in as a student in the site, and click the entity link to the quiz
        1. If bug is present, student will be able to take the quiz and submit despite not having the appropriate permissions to do so
        2. If bug is fixed, student will be presented with an error message stating they do not have permission to access the quiz
      Show
      Steps to reproduce: Create and publish a quiz that is accessible to students Create an entity link to the quiz (via Announcements, Lessons, etc.) As admin, go to the Realms tool and edit the main realm for your site (ID) Edit the student/access role for the realm, and uncheck the permissions "assessment.submitAssessmentForGrade" and "assessment.takeAssessment"; save the realm Log in as a student in the site, and click the entity link to the quiz If bug is present, student will be able to take the quiz and submit despite not having the appropriate permissions to do so If bug is fixed, student will be presented with an error message stating they do not have permission to access the quiz

      Description

      Anyone in a role that does not have the appropriate realm permissions to take and submit a quiz can still do so via a /direct URL to the quiz (entity linked).

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  bjones86 Brian Jones
                  Reporter:
                  bjones86 Brian Jones
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  4 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved:

                    Git Source Code