by Helen Foster.  

Topic:	Potential Cross Site Request Forgery in Quiz reports
Severity/Risk:	Major
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Petr Skoda
Issue no.:	MDL-21688
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	apply patch http://cvs.moodle.org/moodle/m od/quiz/report/overview/report. php?r1=1.98.2.50&r2=1.98.2. 51

Description:
Only limited validation was being done for one of the parameters, allowing unauthorised deletion of attempts in some instances.

by Helen Foster.  

Topic:	KSES Security Filter Bypassing vulnerability
Severity/Risk:	Critical
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Sascha Herzog
Issue no.:	MDL-22042
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	apply patch http://cvs.moodle.org/moodle/l ib/weblib.php?r1=1.812.2.114&am p;r2=1.812.2.115 http://cvs.moodle.org/moodle/l ib/weblib.php?r1=1.970.2.171&am p;r2=1.970.2.172

Description:
Sascha Herzog reported a critical vulnerability in KSES text cleaning filter may allows registered users to launch persistent cross-site scripting (XSS) attacks.

by Helen Foster.  

Topic:	Cross Site Scripting vulnerability in blog/index.php
Severity/Risk:	Critical
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Emmanuel Bouillon
Issue no.:	MDL-22631
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	apply patch or disable blogs http://cvs.moodle.org/moodle/b log/lib.php?r1=1.80.2.20&r2 =1.80.2.21 http://cvs.moodle.org/moodle/b log/lib.php?r1=1.62.2.9&r2= 1.62.2.10

Description:
Some parameters were not being properly cleaned on the blog index page, allowing non-persistent cross-site scripting (XSS) attacks.

by Helen Foster.  

Topic:	Persistent Cross Site Scripting vulnerability in the MNET access control interface
Severity/Risk:	Minor
Versions affected:	<1.8.13 and <1.9.9
Reported by:	Sascha Herzog
Issue no.:	MDL-22040
Solution:	upgrade to 1.8.13 or 1.9.9
Workaround:	disable MNET or uncheck Allow extended characters in usernames

Description:
Sasha Herzog reported a cross site scripting vulnerability in the MNET access control interface when server allows extended characters in usernames.

by Petr Skoda (skodak).  

Topic:	Session fixation prevention now turned on by default
Severity/Risk:	Major
Versions affected:	1.8.x and <1.9.8
Reported by:	Sascha Herzog
Issue no.:	MDL-21788
Solution:	upgrade to 1.9.8 and confirm the enabling of session id regeneration

Description:
Enabling of "Regenerate session id during login" setting is now strongly recommended for all production servers. It is now compatible with all official authentication plugins including mnet.

by Helen Foster.  

Samaritans has developed a series of e-learning courses in Moodle to provide a cost-effective and convenient way for volunteers to be trained in their own homes.

Samaritans is a registered UK charity, with over 18,000 volunteers, which offers 24-hour confidential support to anyone in emotional distress.

E-learning offers great value for money, and can be organised to fit in with volunteers' personal schedules, as it can be carried out from any Internet-enabled computer, 24 hours a day, seven days a week.

Nigel Ross, Training and Development Officer for Samaritans, explains: "We extensively researched the industry standard for e-learning platforms and chose the open source learning management system Moodle because we were impressed by the robust and continually evolving platform that it offers as well as its large user base, including the Open University, NHS, local government and defence."

Moodle Partner HowToMoodle is providing Moodle consultancy, training, customisation and hosting for Samaritans.

For further details of how Samaritans are using Moodle to provide e-learning for volunteers, see the HowToMoodle Case Study - Samaritans.

Moodle Partners are a worldwide group of authorised service companies committed to financially supporting the open source Moodle project. They provide a range of optional commercial services for Moodle users around the world.

by Helen Foster.  

Our Moodle Books database now contains over 30 books and manuals in various languages.

Recently added titles include Estratégias Pedagógicas e Estudos de Casos (free download) by Lynn Alves, Daniela Barros and Alexandra Okada, plus a number of books from Packt Publishing:

• Moodle 1.9 Extension Development by Jonathan Moore and Mike Churchward
• Moodle 1.9 Theme Design: Beginner's Guide by Paul James Gadson
• Moodle 1.9 for Design and Technology by Paul Taylor
• Moodle 1.9: The English Teacher's Cookbook by Silvina P. Hillar
• Moodle 1.9 for Teaching Special Education Children (5-10): Beginner's Guide by Vanesa S. Olsen

Packt Publishing are kindly offering Moodlers 20% off the price of all their Moodle books and 25% off selected books. See the entries in the Moodle Books database for discount codes.

Remember that buying a book from the Moodle Books database helps support Moodle development, since a percentage of all sales goes to the Moodle Trust.

by Helen Foster.  

Thanks to everyone who took part in the Moodle 2 Theme Contest and congratulations to Caroline Kennedy for designing the winning theme, Splash.

Splash is cleanly coded, makes creative use of the Moodle 2 theme engine and was highly rated by the community.

Caroline’s theme will be included in Moodle 2.0 together with other cool Moodle 2 Theme Contest submissions.

Many thanks to Moodle PartnerNewSchool Learning for sponsoring and running the contest.

New course management program to replace WebCT from Adelle Whitefoot, The North Wind

High school from home from Bridget Jones, Auburn Journal

U New England in Australia Adds Moodle to LMS Lineup from Dian Schaffhauser, Campus Technology