mahara-contributors team mailing list archive

[Richard Mansfield <618634@xxxxxxxxxxxxxxxxxx>]

Melissa,

They're probably the confirmation messages you get when you click the
enable/disable links, try it out on Site Administration->Administer
Extensions.

I'm still not 100% convinced the text should be show/hide, I think that
could be confusing too, so if you can think of something better, go for
it.  While you're on that page, I think it'd be good to add some text at
the top explaining that you cannot completely uninstall or disable a
plugin, you can only hide it in the interface.

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/618634

Title:
  Disabled features are still accessible by visiting their URI directly

Status in Mahara ePortfolio:
  In Progress

Bug description:
  If I disable a plugin (e.g. Resume), then the menu items for it disappear (correctly).
  However, if I visit the URI for that plugin (e.g. /artefact/resume) on my site, I can still access, view, modify and submit information stored within the artefact.

  Marking this as a security vulnerability because the plugin has been
  disabled but this is being circumvented.