by Helen Foster.  

Topic:	Potential Cross Site Request Forgery in Quiz reports
Severity/Risk:	Major
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Petr Skoda
Issue no.:	MDL-21688
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	apply patch http://cvs.moodle.org/moodle/m od/quiz/report/overview/report. php?r1=1.98.2.50&r2=1.98.2. 51

Description:
Only limited validation was being done for one of the parameters, allowing unauthorised deletion of attempts in some instances.

by Helen Foster.  

Topic:	KSES Security Filter Bypassing vulnerability
Severity/Risk:	Critical
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Sascha Herzog
Issue no.:	MDL-22042
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	apply patch http://cvs.moodle.org/moodle/l ib/weblib.php?r1=1.812.2.114&am p;r2=1.812.2.115 http://cvs.moodle.org/moodle/l ib/weblib.php?r1=1.970.2.171&am p;r2=1.970.2.172

Description:
Sascha Herzog reported a critical vulnerability in KSES text cleaning filter may allows registered users to launch persistent cross-site scripting (XSS) attacks.

by Helen Foster.  

Topic:	Cross Site Scripting vulnerability in blog/index.php
Severity/Risk:	Critical
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Emmanuel Bouillon
Issue no.:	MDL-22631
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	apply patch or disable blogs http://cvs.moodle.org/moodle/b log/lib.php?r1=1.80.2.20&r2 =1.80.2.21 http://cvs.moodle.org/moodle/b log/lib.php?r1=1.62.2.9&r2= 1.62.2.10

Description:
Some parameters were not being properly cleaned on the blog index page, allowing non-persistent cross-site scripting (XSS) attacks.

by Helen Foster.  

Topic:	Persistent Cross Site Scripting vulnerability in the MNET access control interface
Severity/Risk:	Minor
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Sascha Herzog
Issue no.:	MDL-22040
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	disable MNET or uncheck Allow extended characters in usernames

Description:
Sasha Herzog reported a cross site scripting vulnerability in the MNET access control interface when server allows extended characters in usernames.

by Petr Skoda (skodak).  

Topic:	Session fixation prevention now turned on by default
Severity/Risk:	Major
Versions affected:	1.8.x and <1.9.8
Reported by:	Sascha Herzog
Issue no.:	MDL-21788
Solution:	upgrade to 1.9.8 and confirm the enabling of session id regeneration

Description:
Enabling of "Regenerate session id during login" setting is now strongly recommended for all production servers. It is now compatible with all official authentication plugins including mnet.

by Helen Foster.  

Thanks to everyone who took part in the Moodle 2 Theme Contest and congratulations to Caroline Kennedy for designing the winning theme, Splash.

Splash is cleanly coded, makes creative use of the Moodle 2 theme engine and was highly rated by the community.

Caroline’s theme will be included in Moodle 2.0 together with other cool Moodle 2 Theme Contest submissions.

Many thanks to Moodle PartnerNewSchool Learning for sponsoring and running the contest.

by Martin Dougiamas.  

Hi all!

I thought it was time to crawl out of my cave and post a little update here on how things are going with Moodle 2.0.

All of us working on Moodle 2.0 core are still plugging away hard on development. We're responding to all the feedback from people helping to test the series of Moodle 2.0 Preview Releases we've been doing (eg see the notes for Preview Release 4), and fixing hundreds of bugs and rough edges in the new features.

(I'd also like to announce that we are launching our first formal cycle of functional QA testing today, which is a great milestone for us. See Helen's recent post in Testing and QA forum and the QA testing page in the docs for details.)

If all goes well, it's looking like we should be able to hit a usable and feature-complete state for Moodle 2.0 in a couple of weeks, around July 20. You can follow the the main blockers in the tracker to see progress towards this. Unfortunately, I don't think we can call that a final release yet, because the testing period for much of it has not been long enough, so at this point we'll call it Moodle 2.0 Release Candidate 1 (RC1).

This code will still not be a recommended upgrade for all sites, but if you are an experienced Moodle admin able to dive into PHP if required, and you urgently require the Moodle 2 features, and you find it works well enough for your particular use of Moodle, then the risk will be manageable. The APIs and Database will be completely frozen and most issues should be relatively cosmetic.

Testing and polishing will continue for probably another month or two, focusing on consistency, correctness and performance. This will also be a great window for developers to update their contributed plugins, as we'll be improving the documentation for core APIs with more examples of best practice for the new Moodle 2 platform.

Thanks for your patience everyone! We are getting close!

Cheers,
Martin (Founder and Lead Developer)

by Helen Foster.  

There are lots of Moodle conferences, or MoodleMoots as they are often called, coming up in the next 6 months:

• 6th French MoodleMoot - Troyes, France, 28-30 June (#mootfr10)
• MoodleMoot Italia 2010 - Bari, Italy, 2-3 July (#mootIT10)
  
• MoodleMoot AU 2010 - Melbourne, Australia, 11-14 July (#mootau10)
• US West Coast MoodleMoot 2010 - San Jose, CA, USA, 20-23 July
• US Midwest MoodleMoot - Goshen, IN, USA, 26-28 July (#mootusin10)
• MoodleMoot Austin - Austin, Texas, USA, 2-3 August (#atxmoot10)
• Moodlemoot Colombia 2010 - Bogotá, Colombia, 17-18 August
  
• International Moodle Conference - Essen, Germany, 16-17 September (#mootDE10e)
• Polish MoodleMoot - Czestochowa, Poland, 4-5 November (#mootPL10)
• MoodleMoot Spain 2010 - La Rioja, Spain, 11-13 November

If you're organising a Moodle event and would like it added to the moodle.org calendar, please let me know and/or post in the announcements forum in the Moodle Conference Centre.

(Edited by Helen Foster to add additional dates - original submission Wednesday, 23 June 2010, 02:29 PM)

Bexley College: Firing up Moodle at Bexley College from JISC RSC London on behalf of the Excellence Gateway

Anywhere, Anytime Teaching: Lifeway College On Adopting Moodle from Voxy News Engine

Datatel Releases Moodle-Based ERP/LMS Application from Dian Schaffhauser, Campus Technology