Moodle 1.9 – Potential Vulnerability

I recently wrote a small article for CMS Report about Moodle 1.9. One of the site’s contributors has let me know that there is a cross-site request forgery (CSRF) vulnerability that hackers have used on older builds of Moodle. According to The Register:

Twenty schools' sites have fallen victim to the spoofed or defaced web page porn assault, the Times Educational Supplement reports. Many of the sites use Moodle, an open source content management system that is used to create online learning sites, sparking the theory that flaws in older versions of the package have been used to mount the attacks.

The Register article continues:

If vulnerabilities in Moodle are indeed the cause of the attack then … a Moodle script insertion and cross-site request forgery flaw (here) as the likely candidate. Another Moodle bug (here) is another possibility.

Moodle.org are taking this very seriously. According to their Security page, this is a Sev Critical issue, and they recommend that all Moodle users install the latest Moodle package from http://moodle.org/mod/data/view.php?d=13&rid=448.

Be warned…

--

A reliable and straightforward guide to using Moodle 1.9

I opened my copy of Moodle 1.9 E-Learning Course Development by William Rice with a high expectation that it would be an informative and practical reference text. Why? I was about to upgrade to Moodle 1.9. Did it meet my expectations?

Now read on...

Using open source software can be a daunting experience, regardless of your technical or business experience, and this text's purpose is to shorten users' path to competency in the application. Broadly speaking, the text covers four Moodle-related activities:

• Installing and configuring Moodle 1.9
• E-Learning course development and delivery
• E-Learning course management
• Moodle administration and maintenance

The author assumes zero previous knowledge of the application, and begins by describing Moodle’s Social-Constructionist approach to learning, before bringing the reader on a whistle-stop tour of Moodle 1.9’s features and functionality– a very good idea indeed, as this goes some way to providing an understanding of why Moodle 1.9 looks and works the way it does for newcomers, acts as a pertinent reminder for experienced Moodlers, and sets the context for the course creation sections later in the book.

The book is structured in a logical and linear fashion: the author aims to guide you through the full application implementation and course development process. The text seems to be aimed primarily at teachers and trainers and the author spends the majority of the manual discussing – in detail and very effectively - the processes, “how-to’s” and “gotchas” of using Moodle from a teaching and training perspective. I must point out that something strange must have happened during the editing process of the book, as there’s some glaring typos (and even a whole word omitted from the back cover of the text) which are a distraction, but do not deter from the usability of the manual.

Moodle at Michael Hanley Consulting

As I mentioned at the beginning of this review, this book was my companion through a recent upgrade from Moodle 1.6 to 1.9, and it did not let me down. As an experienced Moodle user, I used the book very much as a “just enough, just in time” resource rather than as an end-to-end guide through the application. My experience was that the text works very well when used in this fashion. Some other positive aspects of my “user experience” of the text included the author’s accessible and direct writing style and use of web-based resources like a downloadable Moodle Project Plan. In my view this text is a straightforward and reliable companion for those who seek to find out more about – and use – Moodle 1.9.

As a taster for the text, click here to download a chapter from the book (requires Adobe Acrobat Reader).

_____________

References:

Rice, W. (2008) Moodle 1.9 E-Learning Course Development Packt Publishing Ltd. Birmingham, UK.

--

Martin Dougiamas says: Moodle 1.9 now released! Hurrah!!

Like the man in the title said, Moodle 1.9 has been released.
Headline features include:

• Gradebook - Completely rewritten from scratch for speed and flexibility. The new gradebook consists of plugins for reports, imports and exports. There are a number of standard reports which are useful for graders, students etc. The grader report allows you to treat the gradebook much more like a spreadsheet with manual editing, calculations, aggregations, weighting, locking, hiding, textual notes and so on.
  
  
• Outcomes - You can also now develop a list of expected outcomes (competencies) and connect these to courses and activities. You can even grade against multiple outcomes at once (i.e. Rubrics).
  
  
• Events API - The new Events API provides a way for any code to "hook" into events in a clean, loosely coupled way. A lot of events in Moodle (such as adding a user or a course) now trigger events that developers can hook into.
  
  
• Scalability and performance improvements - A complete overhaul of the Roles implementation for correctness and scalability. Large sites with thousands of courses and users now load quickly and behave well under heavy traffic, thanks to reworked code for Roles. Additional boost for sites using PHP pre-compilers and significant improvements in the database access code for all databases. Many other parts of Moodle have been optimised to cope better with large numbers of courses and students. Overall performance is very noticeably increased.
  
  
• Moodle Network - Moodle 1.9 and Mahara E-portfolio v0.9 now do transparent Single Sign On - one to one, one to many, many to many. Students can maintain their personal E-portfolios in Mahara.
  
  
• Tags - Allows users to describe their own interests in terms of tags, which creates interest pages around those tags, bringing information together from a variety of sources (Blogs, Flickr, Youtube etc)
  
  
• Improved question bank - Allows questions to be shared by the whole site, a course category, a single course, or be kept private to a single module. More control over who can do what to each question. Improved file management for files linked to by questions.
  
  
• Notes - Detailed notes can be kept about individual users (for example teachers might want to keep and share notes about students in their class).
  
  
• Bulk user actions - Administrators can perform bulk user actions, such as the mass deletion of user accounts. Extended features in the bulk user upload script to allow generation of user fields based on templates.
  
  
• Custom corners theme - Beautiful and curvy (in all browsers).

Find out more here [links to Moodle.org]

--