Moodle 1.9.7 release notes

Release date: Not yet released

Highlights

• MDL-20591 - IMS Common Cartridge import (requires enabling in Site Administration > Miscellaneous > Experimental)
• MDL-13049 - Workshop module finally pushes grades into Gradebook during Synchronize legacy grades procedure
• Miscellaneous Workshop module fixes (MDL-20668, MDL-7218, MDL-20827)

Security issues

• MDL-20841 - Some versions of the Adobe Flash plugin are known to be vulnerable to attacks from malicious Flash content. A new setting in Administration > Security > HTTP security enables admins to set a required Flash player version.

The following security and privacy fixes relate to the handling of user data and passwords in Moodle backups. (Note that the tracker issues have a security level setting which restricts access.)

• MDL-20838 - Hashed user passwords are no longer saved in backup files containing user data.

If anyone really needs passwords to be saved (in rare case of restoring a backup with user data to a different site) $CFG->includeuserpasswordsinbackups may be added to config.php.

• MDL-20846 - Restore has been fixed to cope with missing user password hashes in backups containing new user data. It will set the password to a special value that prevents login. The next time that user tries to log in with their username on this new site they get an explanation and are led through the standard password recovery process.
• MDL-18807 - To greatly reduce the risk of password theft, a password salt is set in config.php when installing 1.9.7 and for upgrades, a notification message strongly recommends admins to set a password salt. In addition, the security overview report gives a warning if no password salt has been set.
• MDL-20834 - A new capability moodle/backup:userinfo allows admins to choose whether teachers can include user data in a course backup. The capability is allowed for the default admin role only. The security overview report warns of roles with the capability allowed.
• MDL-20849 - A new capability moodle/restore:userinfo allows admins to choose whether teachers can restore user data from a course backup (including the possible creation of new users). The capability is allowed for the default admin role only.
• MDL-20854 - To remove possible passwords hidden in existing backups, we have implemented a cleanup script to process existing backup files in moodledata and delete all password hashes from them.
• MDL-18006 - To improve password quality and reduce the chance of md5 lookup attack, the password policy is enabled by default in new installs, and switched on during upgrade to 1.9.7.

Tip: The password policy may be reviewed in Administration > Security > Site policies. The default policy requires passwords of at least 8 characters long and containing at least 1 digit, 1 lower case letter, 1 upper case letter and 1 non-alphanumeric character.

• MDL-20853 - To protect sites from old backups that are not accessible to Moodle, after upgrading to 1.9.7, admins are prompted to change their password on next login.
• MDL-19608 - To assist admins who might want to force their users to reset their passwords, a force password change option is available in Bulk user actions.
• MDL-9251 - The option to backup a course with all users on the site is only available to users with the capability moodle/site:backup in the system context. Similarly, the option to restore a course with all users on the site is only available to users with the capability moodle/site:restore in the system context.

New language pack

• Dhivehi - Ahmed Shareef, Moosa Ali, Amir Hussein

(See Translation credits for additional details.)

See also

• Moodle 1.9.6 release notes