Note: You are currently viewing documentation for Moodle 3.3. Up-to-date documentation for the latest stable version of Moodle is probably available here: XSS trusted users.

XSS trusted users

From MoodleDocs
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Make sure that you trust all the people on the XSS trusted users list, as they are the ones with permissions to potentially write XSS exploits in forums etc.

Some forms of rich Multimedia content, like embedding Flash applets, or bits of JavaScript, which teachers want to use to enhance their courses, use exactly the same technologies that evil people use for Cross-site scripting attacks.

If you were solely concerned with security, you would not allow this. However, Moodle is also concerned with education, so we have to make a compromise. Historically, the compromise was that teachers, course creators, and admins were trusted, and could post complex, but potentially risky content; while students and guests were not trusted, and anything they posted had the risky stuff stripped out.

These days, with configurable roles, it is a bit more complex, because there may be other roles, or the permissions of the standard roles may have been changed. This is why we have a column of risk items on the right of the define/override roles screen, so when you are editing the student role, you can be aware of the consequences of what you are doing.

See also