Security report on default user role: Difference between revisions
Helen Foster (talk | contribs) (security overview report template) |
Helen Foster (talk | contribs) (Default user role is incorrectly defined when site enabled for Moodle Mobile) |
||
| Line 1: | Line 1: | ||
{{Security overview report}} | {{Security overview report}} | ||
==Default role for all users== | |||
In general the default role for all users should be set to authenticated user. Normally all permissions for the role of authenticated user should be left as default. | |||
==Default user role is incorrectly defined== | |||
If the security overview report shows the default role for all users with status 'Critical' and states that 'The default user role "Authenticated user" is incorrectly defined!' it means that one or more risky capabilities are allowed for the role. | |||
If your site is enabled for [[Moodle Mobile]] app access, then [[Mobile web services|mobile web services]] are enabled and the capabilities webservice/xmlrpc:use and webservice/rest:use are allowed for the authenticated user role. The security overview report will show the default role for all users with status 'Critical' in this case. | |||
==Reviewing authenticated user role permissions== | |||
The permissions for the role of authenticated user can be reviewed as follows: | |||
# Go to ''Administration > Site administration > Users > Permissions > Define roles'' | |||
# In the role column, click the link 'Authenticated user' | |||
# Browse the permissions column | |||
If there is no reason for changing permissions from default, for example if nobody is using the Moodle Mobile app to access your site, then the role can be reset by clicking the reset button at the top of the page. | |||
After resetting the authenticated user role, the security overview report will show the default role for all users with status OK. | |||
==See also== | ==See also== | ||
* Using Moodle [http://moodle.org/mod/forum/view.php?id=7301 Security and Privacy forum] | * Using Moodle [http://moodle.org/mod/forum/view.php?id=7301 Security and Privacy forum] | ||
Revision as of 10:13, 10 June 2015
Default role for all users
In general the default role for all users should be set to authenticated user. Normally all permissions for the role of authenticated user should be left as default.
Default user role is incorrectly defined
If the security overview report shows the default role for all users with status 'Critical' and states that 'The default user role "Authenticated user" is incorrectly defined!' it means that one or more risky capabilities are allowed for the role.
If your site is enabled for Moodle Mobile app access, then mobile web services are enabled and the capabilities webservice/xmlrpc:use and webservice/rest:use are allowed for the authenticated user role. The security overview report will show the default role for all users with status 'Critical' in this case.
Reviewing authenticated user role permissions
The permissions for the role of authenticated user can be reviewed as follows:
- Go to Administration > Site administration > Users > Permissions > Define roles
- In the role column, click the link 'Authenticated user'
- Browse the permissions column
If there is no reason for changing permissions from default, for example if nobody is using the Moodle Mobile app to access your site, then the role can be reset by clicking the reset button at the top of the page.
After resetting the authenticated user role, the security overview report will show the default role for all users with status OK.
See also
- Using Moodle Security and Privacy forum
