Note: You are currently viewing documentation for Moodle 1.9. Up-to-date documentation for the latest stable version is available here: Moodle 1.9.7 release notes.

Moodle 1.9.7 release notes: Difference between revisions

From MoodleDocs
m (Added info about Workshop fixes)
(→‎Security issues: security advisory links added)
 
(25 intermediate revisions by 4 users not shown)
Line 1: Line 1:
Release date: Not yet released
Release date: 25th November 2009
 
'''Important:'''  Upgrading is very highly recommended!
 
Here is [http://tracker.moodle.org/browse/MDL/fixforversion/10360 the full list of fixed issues in 1.9.7].


===Highlights===
===Highlights===


* MDL-20591 - [[IMS Common Cartridge import]] (requires enabling in ''Site Administration > Miscellaneous > [[Experimental]]'')
* MDL-20591 - [[IMS Common Cartridge import]] (requires enabling in ''Site Administration > Miscellaneous > [[Experimental]]'')
* MDL-13049 [[Workshop module]] finally pushes grades into Gradebook during [[grade/edit/simple_tree/index#Synchronize_legacy_grades|Synchronize legacy grades]] procedure
* MDL-13049 - [[Workshop module]] finally pushes grades into Gradebook during [[grade/edit/simple_tree/index#Synchronize_legacy_grades|Synchronize legacy grades]] procedure
* Miscellaneous Workshop module fixes (MDL-20668, MDL-7218, MDL-20827)
* Miscellaneous Workshop module fixes (MDL-20668, MDL-7218, MDL-20827)
===Functional changes===
* To force users to use stronger passwords that are less susceptible to being cracked the [[Password policy|password policy]] is enabled by default in new installs, and switched on when upgrading to 1.9.7.
:Admins can review their password policy in ''Site Administration > Security > [[Site policies]]''. The default policy requires passwords of at least 8 characters long and containing at least 1 digit, 1 lower case letter, 1 upper case letter and 1 non-alphanumeric character.
* After upgrading to 1.9.7, admins will be asked to change their passwords next time they log in (manual or email based self-registration accounts only).
* To reduce the risk of password theft, a [[Password salting|password salt]] is set in ''config.php'' in new installs and for upgrades, admins are sent an email recommending that they do so.
* Teachers lose permission to include ANY user data in a course backup or restore a course including user data due to new capabilities  [[Capabilities/moodle/backup:userinfo|moodle/backup:userinfo]] and [[Capabilities/moodle/restore:userinfo|moodle/restore:userinfo]] which are not set for the default role of teacher.  Sites with custom roles should check permissions carefully.  Admins can restore those permissions but are informed of the risks in doing so.
* Hashed user passwords are no longer saved in backup files containing user data. If a backup is restored to a new site, users will be asked to go through the "forgot my password" routine the first time they log in.
* Moodle will no longer serve any uploaded Flash files to browsers with old Flash plugins. Admins can set the minimum required Flash player version in ''Site Administration > Security > HTTP Security''.


===Security issues===
===Security issues===


This release contains a lot of security and privacy fixes related to the handling of user data and passwords in Moodle backups, MDL-20851 (currently with security level setting which restricts access).
* [http://moodle.org/mod/forum/discuss.php?d=139100 MSA-09-0022] - Multiple CSRF problems fixed
 
* [http://moodle.org/mod/forum/discuss.php?d=139102 MSA-09-0023] - Fixed user account disclosure in [[LAMS module]]
* MDL-20838 Hashed user passwords are no longer saved in backup files containing user data
* [http://moodle.org/mod/forum/discuss.php?d=139103 MSA-09-0024] - Fixed insufficient access control in [[Glossary module]]
:If anyone really needs passwords to be saved (in rare case of restoring a backup with user data to a different site)  <code>$CFG->includeuserpasswordsinbackups</code> may be added to ''config.php''.
* [http://moodle.org/mod/forum/discuss.php?d=139105 MSA-09-0025] - Unneeded MD5 hashes removed from user table
* MDL-20846 Restore has been fixed to cope with missing user password hashes in backups containing new user data. It will set the password to a special value that prevents login. The next time that user tries to log in with their username on this new site they get an explanation and are led through the standard password recovery process.
* [http://moodle.org/mod/forum/discuss.php?d=139106 MSA-09-0026] - Fixed invalid application access control in MNET interface
* MDL-20844 We no longer include course+group enrolment keys in backups, unless 'includecoursepasswordsinbackup' is set. Instead, put in a marker to show that there was a key at some point.
* [http://moodle.org/mod/forum/discuss.php?d=139107 MSA-09-0027] - Ensured login information is always sent secured when using SSL for logins
* MDL-20866 Restore is fixed to cope with missing course+group enrolment keys. The restore routine will now inform the user about it and ask them to type in new keys.
* [http://moodle.org/mod/forum/discuss.php?d=139110 MSA-09-0028] - Passwords and secrets are no longer ever saved in backups, new backup capabilities [[Capabilities/moodle/backup:userinfo|moodle/backup:userinfo]] and [[Capabilities/moodle/restore:userinfo|moodle/restore:userinfo]] for controlling who can backup/restore user data, new checks in the [[Security overview|security overview report]] help admins identify dangerous backup permissions
* MDL-18807 We try to ensure that $CFG->passwordsaltmain is set in config.php, so that passwords are stored more securely in the database. (We can't save the salt itself in the database, in case it got hacked and changed, so we need the admin to add it manually). We do this during install in the automatic config.php, and also by annoying the admin to add it to config.php, via messaging, security report, upgrade notice etc. I'd stop short of making the site dead until it's added, though it's an option.
* [http://moodle.org/mod/forum/discuss.php?d=139111 MSA-09-0029] - A strong [[Password policy|password policy]] is now enabled by default, enabling [[Password salting|password salt]] in encouraged in ''config.php'', admins are forced to change password after the upgrade and admins can force password change on other users via [[Bulk user actions]]
* MDL-20834 For privacy, we now allow admins to choose whether teachers can export user data. We implemented a new capability to allow teachers to include any user data in backups at all, called moodle/backup:userinfo. This is not allowed by default, so that admin needs to turn it on explicitly. It should be labelled with risks, and the security report should also warn about roles that have it.
* [http://moodle.org/mod/forum/discuss.php?d=139119 MSA-09-0030] - New detection of insecure Flash player plugins, Moodle won't serve Flash to insecure plugins
* MDL-20849 We have implemented a new capability to allow teachers to restore user data (including creation of new users if required), called moodle/restore:userinfo. Not allowed by default, as above.
* [http://moodle.org/mod/forum/discuss.php?d=139120 MSA-09-0031] - Fixed SQL injection in [[SCORM module]]
* MDL-20854 To remove possible passwords hidden in existing backups, we have implemented a cleanup script to process existing backup files in moodledata and delete all password hashes from them.
* MDL-18006 To improve password quality and reduce the chance of md5 lookup attack, the [[Password policy|password policy]] is enabled by default in new installs, and switched on during upgrade to 1.9.7.
* MDL-20853 To protect sites from old backups that are not accessible to Moodle, all admins are forced to recreate their passwords after upgrade to 1.9.7 or later. This is done by setting auth_forcepasswordchange of those users, so that they are prompted to change their passwords on the next login (with the new password policy and hopefully salt).
* MDL-19608 To assist admins who might want to force their users to reset their passwords, a force password change option is available in [[Bulk user actions]]


===New language pack===
===New language pack===
Line 37: Line 47:


[[fr:Notes de mise à jour de Moodle 1.9.7]]
[[fr:Notes de mise à jour de Moodle 1.9.7]]
[[de:Moodle 1.9.7 Versionsinformationen]]
[[es:Notas de Moodle 1.9.7]]

Latest revision as of 21:18, 1 December 2009

Release date: 25th November 2009

Important: Upgrading is very highly recommended!

Here is the full list of fixed issues in 1.9.7.

Highlights

Functional changes

  • To force users to use stronger passwords that are less susceptible to being cracked the password policy is enabled by default in new installs, and switched on when upgrading to 1.9.7.
Admins can review their password policy in Site Administration > Security > Site policies. The default policy requires passwords of at least 8 characters long and containing at least 1 digit, 1 lower case letter, 1 upper case letter and 1 non-alphanumeric character.
  • After upgrading to 1.9.7, admins will be asked to change their passwords next time they log in (manual or email based self-registration accounts only).
  • To reduce the risk of password theft, a password salt is set in config.php in new installs and for upgrades, admins are sent an email recommending that they do so.
  • Teachers lose permission to include ANY user data in a course backup or restore a course including user data due to new capabilities moodle/backup:userinfo and moodle/restore:userinfo which are not set for the default role of teacher. Sites with custom roles should check permissions carefully. Admins can restore those permissions but are informed of the risks in doing so.
  • Hashed user passwords are no longer saved in backup files containing user data. If a backup is restored to a new site, users will be asked to go through the "forgot my password" routine the first time they log in.
  • Moodle will no longer serve any uploaded Flash files to browsers with old Flash plugins. Admins can set the minimum required Flash player version in Site Administration > Security > HTTP Security.

Security issues

New language pack

  • Dhivehi - Ahmed Shareef, Moosa Ali, Amir Hussein

(See Translation credits for additional details.)

See also

Retrieved from "https://docs.moodle.org/19/en/index.php?title=Moodle_1.9.7_release_notes&oldid=66198"
Powered by MediaWiki