Tekst źródłowy strony Risks

{{Roles}}Careful consideration should be given to the risks involved in allowing different capabilities.

==Configuration==
Certain capabilities are intended for administrators and managers only, as they enable users to change the site configuration and behaviour.

==XSS (Cross-Site Scripting)==
Certain capabilities enable users to add non-checked files and HTML code containing JavaScript etc. This may be misused for cross-site scripting (XSS) purposes, with the potential to gain full admin access. These capabilities are intended for administrators and teachers only.

:''Tip'': The [[Security overview|Security overview report]] (''Administration > Reports > Security overview'') lists all [[XSS trusted users]].

==Privacy==
Certain capabilities enable users to gain access to private information of other users, for example non-public information in a user's profile. These capabilities are intended for administrators and teachers only.

==Spam==
Certain capabilities enable users to add content to site, for example forum posts, account creation, and send messages to other users. These capabilities may be misused for spamming purposes.

==Risks for predefined roles==

* Guest - only capabilities without any risks are allowed
* Student - certain capabilities with spam risks are allowed
* Teacher - certain capabilities with XSS and privacy risks are allowed
* Administrator - all capabilities are allowed

==See also==

* [[Development:Hardening new Roles system]]
* [[Capabilities/moodle/site:trustcontent]]

[[es:Riesgos]]
[[fr:Risques]]
[[ja:リスク]]
[[de:Risiken]]