Note: You are currently viewing documentation for Moodle 3.3. Up-to-date documentation for the latest stable version of Moodle is probably available here: Risks.

Risks: Difference between revisions

From MoodleDocs
m (roles template)
(removing moodle/site:doanything link)
 
(12 intermediate revisions by 9 users not shown)
Line 1: Line 1:
{{Roles}}
{{Roles}}Careful consideration should be given to the risks involved in allowing different capabilities.
{{Moodle 1.7}}
This page describes the different types of risks that different capabilities can raise. (This page is incomplete and needs more information.)


==Configuration==
==Configuration==
Users could change site configuration and behaviour
Certain capabilities are intended for administrators and managers only, as they enable users to change the site configuration and behaviour.


==XSS (Cross-Site Scripting)==
==XSS (Cross-Site Scripting)==
Users could add files and texts that allow cross-site scripting.
Certain capabilities enable users to add non-checked files and HTML code containing JavaScript etc. This may be misused for cross-site scripting (XSS) purposes, with the potential to gain full admin access. These capabilities are intended for administrators and teachers only.
 
:''Tip'': The [[Security overview|Security overview report]] (''Administration > Reports > Security overview'') lists all [[XSS trusted users]].


==Privacy==
==Privacy==
Users could gain access to private information of other users
Certain capabilities enable users to gain access to private information of other users, for example non-public information in a user's profile. These capabilities are intended for administrators and teachers only.


==Spam==
==Spam==
Users could send spam to site users or others
Certain capabilities enable users to add content to site, for example forum posts, account creation, and send messages to other users. These capabilities may be misused for spamming purposes.
 
==Risks for predefined roles==
 
* Guest - only capabilities without any risks are allowed
* Student - certain capabilities with spam risks are allowed
* Teacher - certain capabilities with XSS and privacy risks are allowed
* Administrator - all capabilities are allowed


==See also==


{{stub}}
* [[Development:Hardening new Roles system]]
* [[Capabilities/moodle/site:trustcontent]]


[[Category:Administrator]]
[[es:Riesgos]]
[[Category:Roles]]
[[fr:Risques]]
[[ja:リスク]]
[[de:Risiken]]

Latest revision as of 08:21, 25 April 2012

Careful consideration should be given to the risks involved in allowing different capabilities.

Configuration

Certain capabilities are intended for administrators and managers only, as they enable users to change the site configuration and behaviour.

XSS (Cross-Site Scripting)

Certain capabilities enable users to add non-checked files and HTML code containing JavaScript etc. This may be misused for cross-site scripting (XSS) purposes, with the potential to gain full admin access. These capabilities are intended for administrators and teachers only.

Tip: The Security overview report (Administration > Reports > Security overview) lists all XSS trusted users.

Privacy

Certain capabilities enable users to gain access to private information of other users, for example non-public information in a user's profile. These capabilities are intended for administrators and teachers only.

Spam

Certain capabilities enable users to add content to site, for example forum posts, account creation, and send messages to other users. These capabilities may be misused for spamming purposes.

Risks for predefined roles

  • Guest - only capabilities without any risks are allowed
  • Student - certain capabilities with spam risks are allowed
  • Teacher - certain capabilities with XSS and privacy risks are allowed
  • Administrator - all capabilities are allowed

See also