mahara-contributors team mailing list archive

[Melissa Draper <melissa@xxxxxxxxxxxxx>]

There are 3 other strings that use the same language (enable/disable)

$string['pluginenabled'] = 'Plugin enabled';
$string['plugindisabled'] = 'Plugin disabled';
$string['pluginnotenabled'] = 'Plugin not enabled.  You must enable the %s plugin first.';

I'm leaning towards changing them for consistency, but I'd like
agreement from others who know the system better.

** Changed in: mahara
     Assignee: (unassigned) => Melissa Draper (melissa)

** Changed in: mahara
       Status: Confirmed => In Progress

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/618634

Title:
  Disabled features are still accessible by visiting their URI directly

Status in Mahara ePortfolio:
  In Progress

Bug description:
  If I disable a plugin (e.g. Resume), then the menu items for it disappear (correctly).
  However, if I visit the URI for that plugin (e.g. /artefact/resume) on my site, I can still access, view, modify and submit information stored within the artefact.

  Marking this as a security vulnerability because the plugin has been
  disabled but this is being circumvented.