Moodle 1.8.11 release notes

Release date: 25th November 2009

Important: Upgrading is very highly recommended!

Here is the full list of fixed issues in 1.8.11.

Functional changes

• After upgrading, admins will be asked to change their passwords next time they log in (manual or email based self-registration accounts only).
• To reduce the risk of password theft, a password salt is set in config.php in new installs and for upgrades, admins are sent an email recommending that they do so.
• Teachers lose permission to include ANY user data in a course backup or restore a course including user data due to new capabilities moodle/backup:userinfo and moodle/restore:userinfo which are not set for the default role of teacher. Sites with custom roles should check permissions carefully.
• Hashed user passwords are no longer saved in backup files containing user data. If a backup is restored to a new site, users will be asked to go through the "forgot my password" routine the first time they log in.
• In Moodle 1.8.11+ weekly from 23/12/09 onwards: Moodle will no longer serve any uploaded Flash files to browsers with old Flash plugins. Admins can set the minimum required Flash player version in Site Administration > Security > HTTP Security.

Security issues

• MSA-09-0022 - Multiple CSRF problems fixed
• MSA-09-0023 - Fixed user account disclosure in LAMS module
• MSA-09-0024 - Fixed insufficient access control in Glossary module
• MSA-09-0025 - Unneeded MD5 hashes removed from user table
• MSA-09-0026 - Fixed invalid application access control in MNET interface
• MSA-09-0027 - Ensured login information is always sent secured when using SSL for logins
• MSA-09-0028 - Passwords and secrets are no longer ever saved in backups, new backup capabilities moodle/backup:userinfo and moodle/restore:userinfo for controlling who can backup/restore user data
• MSA-09-0029 - Enabling a password salt in encouraged in config.php and admins are forced to change password after the upgrade
• MSA-09-0031 - Fixed SQL injection in SCORM module
• In Moodle 1.8.11+ weekly from 23/12/09 onwards: MSA-09-0030 - New detection of insecure Flash player plugins, Moodle won't serve Flash to insecure plugins