Note: You are currently viewing documentation for Moodle 3.1. Up-to-date documentation for the latest stable version of Moodle is probably available here: Upgrade key.

Difference between revisions of "Upgrade key"

From MoodleDocs
m (Added link to spanish translation of page)
Line 14: Line 14:
[[es:Clave al actualizar]]
[[es:Clave al actualizar]]

Revision as of 09:55, 19 November 2015

New feature
in Moodle 3.1!

Upgrade key protects your Moodle site during the upgrade.

Upgrade key required - the user must provide the key defined in the config.php to trigger the upgrade

When the Moodle site is being upgraded as a result of the Moodle core update and/or a plugin installation/update, no authentication and authorization mechanisms are reliable. Any anonymous visitor of your site can potentially trigger the upgrade process by navigating their browser to your admin page. This can be seen as a security risk because a lot of sensitive information (server environment, plugin versions etc) are available at the upgrade screens.

To improve the protection of your site during the upgrade, it is recommended to configure the upgrade key in your main config.php file:

$CFG->upgradekey = 'put_some_shared_secret_here';

If the upgrade key is defined in the config.php file, its value must be provided to access the admin pages during the site upgrade.

Do not use your admin user password as the upgrade key.