by Michael de Raadt.  

Topic:	/enrol/externallib.php method core_enrol_external .get_enrolled_users() uses undefined $context and $coursecontext's in 3 has_capability() calls
Severity:	Major
Versions affected:	2.2 to 2.2.1+
Reported by:	Petr Škoda
Issue no.:	MDL-31178
CVE Identifier:	CVE-2012-1170
Changes (master):	http://git.moodle.org/gw?p=moo dle.git&a=search&h=HEAD &st=commit&s=MDL-31178

Description:

Capability checks in the external enrolment plugin were not being performed thoroughly enough.

by Michael de Raadt.  

Topic:	HTML5 apps cannot call Web services functions if an HTTP resource is retrieved from the Moodle installation
Severity:	Minor
Versions affected:	2.2 to 2.2.1+, 2.1 to 2.1.4+
Reported by:	Juan Leyva
Workaround:	Disable Web services
Issue no.:	MDL-30495
Changes (master):	http://git.moodle.org/gw?p=moo dle.git&a=search&h=HEAD &st=commit&s=MDL-30495

Description:

HTML5 apps were being sent cookies which, when sent in later access requests, would cause the Web services to block them.

by Michael de Raadt.  

Topic:	Adding Tag to an unavailable course makes it visible to students
Severity:	Minor
Versions affected:	2.2 to 2.2.1+, 2.1 to 2.1.4+
Reported by:	Ivo Šmelhaus
Workaround:	Don't enable block_tags_showcoursetags
Issue no.:	MDL-31466
CVE Identifier:	CVE-2012-1161
Changes (master):	http://git.moodle.org/gw?p=moo dle.git&a=search&h=HEAD &st=commit&s=MDL-31466

Description:

Courses identifiable by tags were being displayed in a tag search even when the courses were hidden.

by Michael de Raadt.  

Topic:	Not enrolled users (admins...) are able to subscribe/unsubscribe themselves via mod/forum/index.php
Severity:	Minor
Versions affected:	2.2 to 2.2.1+, 2.1 to 2.1.4+
Reported by:	Eloy Lafuente
Issue no.:	MDL-31426
CVE Identifier:	CVE-2012-1160
Changes (master):	http://git.moodle.org/gw?p=moo dle.git&a=search&h=HEAD &st=commit&s=MDL-31426

Description:

Administrators and managers were able to subscribe to forums in courses they were not involved in without a permission check.

by Michael de Raadt.  

Topic:	Overview report shows hidden courses
Severity:	Minor
Versions affected:	2.2 to 2.2.1+, 2.1 to 2.1.4+
Reported by:	Mark Nelson
Issue no.:	MDL-29892
CVE Identifier:	CVE-2012-1159
Changes (master):	http://git.moodle.org/gw?p=moo dle.git&a=search&h=HEAD &st=commit&s=MDL-29892

Description:

Users unable to see hidden courses were able to see them in the overview report.

by Martin Dougiamas.  

Hi all!

You may have seen the news that we are holding our first official Moodle conference dedicated to research on and around the Moodle platform:

    Moodle Research Conference - research.moodle.net
    14-15 September 2012    Heraklion, Crete

The purpose of the conference is to support networking and sharing among those who are researching Moodle and thinking about ways to improve it for different learning scenarios.   It will also directly inform the development of Moodle in the future.

We've had a good number of papers already submitted for the conference, so it's looking pretty exciting!  Submitted papers range from in-depth case studies of how Moodle can be applied and used in various environments to interface design experiments and the development of whole new modules to introduce new techniques.

(Personally I love detailed and rigorous case studies.  There are so many ways to apply even a stock Moodle but it's important to understand what patterns best achieve our goals of improving education and why they work)

We've had requests to extend the submission date a little, so we've done that.  You now have until 28th May to submit your papers!

If you had been undecided until now and missed the deadline this week, or have only just heard about it  - send in your paper and come along!   It's going to be two days of fascinating and meaningful discussions and debate!  And it's in a beautiful location too. 

I'd appreciate you spreading this message to any relevant communities of practice that you are part of - thank you!   You can send them to this URL:   http://goo.gl/eWcH2

by Helen Foster.  

Thanks to all the students who applied to work with Moodle for Google Summer of Code 2012. As in previous years, it was very difficult deciding which project proposals to accept.

Congratulations and welcome to the four students whom we choose, who will be working on Moodle projects over the next 3-4 months:

• Mayank Gupta - Improving SCORM 2004 Support
• Kanika Goyal - Plagiarism API improvements
• Isuru Madushanka Weerarathna - Email reminders for calendar events
• Ankit Gupta - Video/audio capture repository plugin

For details about the projects see GSOC/2012.

Please give our new Moodle developers help and encouragement wherever you can!

(Edited by Helen Foster to add profile link - original submission Tuesday, 24 April 2012, 11:54 AM)

by Michael de Raadt.  

Moodle 2.2.3, Moodle 2.1.6, Moodle 2.0.9 and Moodle 1.9.18 have been released.

In addition to a number of bug fixes and small improvements, security vulnerabilities have been discovered and fixed. As always, we recommend that you upgrade your sites to these latest versions as soon as possible. All admins of registered Moodle sites have been notified with security issue details.

Upgrading should be very straightforward. Full details about the releases can be found in the release notes:

• Moodle 2.2.3 release notes
• Moodle 2.1.6 release notes
• Moodle 2.0.9 release notes
• Moodle 1.9.18 release notes

The releases themselves are available via the Moodle download page as packages or direct from our CVS and Git repositories.

Please note that Moodle 2.0.9 and Moodle 1.9.18 are no longer fully supported. They are supported for security fixes only.

Good practice resource - Making the most of information and communication technology: South Devon College from OFSTED

South Orange-Maplewood Seventh Graders Enhance Lessons Through Technology from Christy Potter Kass, TheAlternativePress.com

Norwayne District Students log in to online texts from Amanda Rolik, The-Daily-Record.com