Security FAQ
From MoodleDocs
How can I report a security issue?
Please "Create a new issue" in the Moodle Tracker describing the problem (and solution if possible) in detail. Make sure you set the Security Level accurately to make sure that the security team sees it. Bugs classified as a "Serious security issue" will be hidden from the general public until the security team (led by Petr Skoda) is able to resolve it and publish fixes to registered Moodle sites (see below).
How can I keep my site secure?
- The usual way is to update your whole Moodle to the latest stable release of the version you are using. It is very safe to go from 1.8.1 to 1.8.2+, for example, at any time. CVS is a very easy way to do this.
- Many of the notices will include patch information. If you are fairly confident with editing scripts, then it may be easier for you to just patch the affected file.
How can I keep track of recent security issues?
- Register your Moodle sites with moodle.org (visit admin/index.php in your installation to see the registration button), making sure to enable the option of being notified about security issues and updates. After your registration is accepted, your email address will be automatically added to our low-volume securityalerts mailing list.
- Eventually, all important security issues are published to the general public via the Moodle Security forum. You can subscribe to the forum RSS feed to automatically add new issues in your favourite feed reader or portal.
