Chamilo 1.11.10
15 May 2019
Chamilo version 1.11.10 is now available (security release).
Upgrading to Chamilo 1.11.10
Chamilo 1.11.10 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply Chamilo updates as new versions are released, or use Installatron's Clone feature to duplicate an existing Chamilo install to test the 1.11.10 upgrade prior to applying it live. Get started managing your Chamilo installations with Installatron
What's New in Chamilo 1.11.10
Security
- (c245b033) Security: Use "clean_up_files_in_zip" function before extracting content Blocks php/htaccess files
- (53c0dc4a) Security: Remove folder main/inc/lib/nanogong after composer update
- (2164d36f) Security: Remove nanogong files (deprecated).
- (1c82459f) Security: Protect lp_upload.php to avoid malicious uploads by unauthenticated users #security
- (e4637751) Security: Avoid showing user popup to non authenticated users if user is not a course teacher #security
- (48126729) Security: Block anon users
- (662dbd62) Security fixes, add int casting
- (297f7809) Security fixes, add int casting
- (6968fb57) Security fixes, add int casting
- (33e2692a) Security: Fix XSS in social network and one extended access to tickets
- (5700b37b) Security: Remove double-escaping of SQL in previous paranoid commit
- (bec1fd16) Security: Fix suspected XSS vulnerability in tickets
- (54d05c11) Security: Fix suspected XSS/SQL injections vulnerabilities in tickets
- (ae7f2d5b - GH#2757) Remove XSS
- (bfa1eccf) Security: Fix SQL injection and likely future similar issues
- (814049e5 - GH#2746) Escape gradebook name in gradebook_list.php to avoid XSS
- (15e49c17 - GH#2746) Add default value for search_users (path disclosure)
- (da8a93ee - GH#2746) Remove warning + notice messages in agenda (path disclosure)
- (5e61c2b0 - GH#2746) Remove XSS from social groups page
- (d9c37bf1) Security: Remove "Security::remove_XSS", fix htmleditor get value Related: https://github.com/chamilo/chamilo-lms/commit/099ec4117ed4aa6bd966f1928718fe69a0773723
- (d13365c1) Security - Add Database:escape_string and remove_XSS
- (099ec411) Security: Fix XSS vulnerability in agenda - see security report 28 - additions
- (a248539a) Remove XSS when registering user See https://packetstormsecurity.com/files/149711/chamilolms1118fn-xss.txt
- Security: Protect agenda events using Security::remove_XSS
For end-users, teachers and Chamilo admins
- (94b7ca55 - BT#15579) Quiz: Add "Unanswered" status for unique questions, showing on the quiz results page
- The IMS/LTI plugin now fully supports LTI 1, 1.1, 1.1.1, Outcomes and Deep Linking
- (f8d91f9c - BT#15534) Quiz: Allow editing questions that are not inside an exercise
- (c68ccd9f - CT#7683) Display: Improvement in user summary (tracking)
- (f2b8f733 - BT#15535) Quiz: If random show also the total number of questions
- (6153de7e - BT#15389) Quiz: Show icon to indicate when exercises is embeddable in videos
- (a3d00fdb) Documentation: Indicate support reduced to IE11+
- (ed0cba3c - BT#15234) Quiz: Add course setting "quiz_question_limit_per_day"
- (f25743cb - BT#15394) Calendar: Add calendar for training sessions planning
- (7c93e972 - BT#15233) Quiz: Add new "result disable" option in exercises "Show only correct answer" BT#15233
- (bde49a2b - BT#15281) Plugin: Add ExportSurvey CSV plugin
- (8cbcfe93 - GH#2788) Quiz: Add new Ranking mode to show a ranking table on the results page
- (63fde0cd - BT#15232) Quiz: Add "SCORE" support in aiken
- (373427b5 - BT#15033) Add questions multiplication in surveys, based on classes (allows for teachers deliberations)
- (ad1ecb2b) PDF view with viewerjs in LP
- (4733577f - BT#14957) Add survey type to agree on a schedule (doodle-type)
- (f50ecb71 - BT#15017) Add certificate link + download certificate in a zip
- (0d0d48fd - GH#2717) Add statistical charts in course reports
- (f9eda9b2) Plugin: Add Card game plugin
- (bfd41371 - BT#14880) Admin and teacher can see a blocked exercise
- (ac72f87b - BT#14882) Change behaviour when adding a user to a session BT#14882 There's only one action that will be done, only add new users. The old behaviour that implied add and remove users still exists in the unused file "add_edit_users_to_session.php" It requires some tests and validations.
- (03aeb0be - BT#14882) Add new page to subscribe new users to a session-course directly page: add_users_to_session_course.php
- (8397a1d2 - BT#14750) Allow upload xlsx files to import exercise
- (7b95d607 - BT#14824) Add "preview" button before sending an announcement To see the list of users and groups that will be sent BT#14824
- (260549e9 - BT#14824) Add option "SendAnnouncementCopyToMyself" in announcement
For developers and sysadmins
- (82697e63 - BT#15533) Learnpath: Optimize query to get media player
- (14112742 - BT#15327) Language: Include extra language file main/lang/xxx/custom.php if exists
- (09b447d1 - BT#15362) Session: Allow session admin to upload files to BasicCourseDocuments folder
- (efcd6d14 - BT#14357) Admin: Add configuration setting "allow_gradebook_stats" to improve gradebook speed
- (4cb8f2e1 - BT#15437) Admin: Add configuration setting "block_editor_file_manager_for_students" to block student's access to the course documents when using the ckeditor "Browse server" button
- (9af667f5 - BT#15393) Admin: Add configuration setting "social_enable_likes_messages" (requires high level of customization to enable)
- (89cbc14c - BT#15280) Admin: Add configuration setting "survey_anonymous_show_answered" to enable showing who answered or not an anonymous survey (requires a minimum of 2 submissions to show)
- (399d7ce6 - BT#15265) Plugin: QuestionOptionsEvaluation: Add questionoptionsevaluation plugin
- (0de2668a - BT#15265) Admin: Add configuraiton setting "exercise_additional_teacher_modify_actions" to enable more actions for teachers
- (6a758d8a - GH#2699) Admin: Add configuration setting "mail_no_reply_avoid_reply_to" - Avoid add a reply-to header when a no-reply address is set.
- (73d802a6 - BT#15176) Social: Add social map, requires to add geolocation extra fields and configuration setting $_configuration['allow_social_map_fields'] = ['fields' => ['terms_villedustage', 'terms_ville']];
- (a31c5df0 - BT#15173 - BT#15309) Admin: Add new configuration settings "allow_forum_post_revisions", "community_managers_user_list" and "global_forums_course_id"
- (c2f9db3d - BT#15326) Registration: Add configuration setting "required_extra_fields_in_inscription" - Set extra fields as required in the inscription.php page + Add forum_post, forum_category extra fields
- (28657267 - BT#15317) Forum: Add configuration setting "forum_fold_categories" to fold forum categories by default
- (35483952 - BT#15318) Admin: Hide course graph reports with configuration setting $_configuration['hide_course_report_graph'] = false;
- (ebe2eb11 - BT#15281) Admin: Add configuration setting survey_additional_teacher_modify_actions
- (8a21d41d - GH#2796) Admin: Add configuration setting "admin_chamilo_announcements_disable". Disable Chamilo.org announcements at the top of the admin page
- (e226292b - BT#15252) LP: Add setting lp_minimum_item, depends in the course and session extra field "new_tracking_system". It should be turned on in order to process the new stats, otherwise it will load the legacy stats
- (eca05ce7 - BT#15270) Admin: Add configuration setting "jq_grid_default_row" for default row values for jQGrid
- (70242077 - BT#15270) Admin: Add configuration setting "jq_grid_row_list" to change the jqgrid row list //$_configuration['jq_grid_row_list'] = ['options' => [50, 100, 200, 500]];
- (dc213538 - BT#15230) Admin: Add configuration setting "show_question_id" config to show question ID in the exercises + Add DESCRIPTION option when importing exercises with AIKEN
- (a1e9e3f2 - BT#15235) Admin: Add configuration setting that limits teachers rights in exercise $_configuration['limit_exercise_teacher_access']
- (a7fbce40 - BT#11784) Admin: Add configuration setting "quiz_show_description_on_results_page" to control whether the test description is shown on the results page or not
- (f4653e53 - BT#15208) Admin: Add configuration setting 'quiz_prevent_copy_paste' to prevent copying questions/answers text with the keyboard or the right-click menu
- (ec1faa53 - BT#15010) Admin: Add configuration setting 'hide_social_media_links'
- (244f36b3 - GH#2701) Documents: Add Accept-Range HTTP header for pseudo-streaming
- (d2e4aa42) Add indexes for gradebook tables in optimization guide
- (625ed0b9) Add script to check if the default extra fields are present in the platform. See BT# 13954 If a default extra field doesn't exists then it will be created. Extra field list as in 1.11.8 Requires to manually remove an "exit".
- (c51a213e) Allow performing actions from plugin when deleting user/course/session
- (a681bf55 - GH#2708) Remove limit_session_admin_role from conf file and use setting
- (dbc571c7 - BT#15095) Admin: Add configuration setting 'allow_session_admin_login_as_teacher'
- (c1cdf0a8 - BT#15126) Admin: Add configuration setting 'allow_user_session_collapsable'
- (3520689c - BT#15126) Admin: Add configuration setting 'allow_user_course_category_collapsable'
- (237f9bb6 - GH#2717) Admin: Add charts for several statistics pages
- (676d2c17 - BT#15020) Admin: Add configuration setting $_configuration['allow_track_complete'] = false; Allows more detail user tracking
- (74964fc2 - BT#15095) Admin: Add configuration setting 'session_admins_edit_courses_content'
- (0d5b3441 - BT#15020) Add table track_e_access_complete creation
- (fe196167 - BT#15020) Admin: Add configuration setting $_configuration['lp_minimum_time'] = false; Add AccumulateWorkTime (a.k.a lp min time)
- (c2435563 - BT#15102) Add proxy.php needed when using setting "lp_fix_embed_content"
- (a9a28498 - BT#14357) Improve speed when rendering gradebook student reports. Using Doctrine APCU cache Setting: $_configuration['gradebook_use_apcu_cache']
- (3292b3c1 - BT#15081) Admin: Add configuration setting "user_import_settings"
- (ed38dc27 - BT#15091) Admin: Add configuration setting "exercises_disable_new_attempts"
- (e30fb0df) DRH can see visible announcement (allow_drh_access_announcement option)
- (ba6bffcc - BT#15081) Admin: Add configuration setting "session_import_settings"
- (5178a591 - GH#2738) Improve composer update speed
- (eb0c06dc) Admin: Add configuration setting "allow_my_files_link_in_homepage" Allow my personal files link in the homepage
- (3bfab64c - BT#15072) Admin: Add configuration setting 'allow_drh_access_announcement'
- (156bcf86 - BT#15044) Admin: Add configuration setting to activate view with ViewerJS PDF LP
- (4c7dc3ce - BT#14813) Admin: Add configuration setting importOpenSessions
- (0d517226 - BT#14976) Admin: Add configuration setting in BBB plugin "disable_download_conference_link"
- (40dcc1e7 - BT#14972) Admin: Add configuration setting "hide_gradebook_percentage_user_result" + fix rank column - Hide percentage in best/average gradebook results
- (26d6fb48 - BT#15028) Admin: Add configuration setting "allow_only_one_student_publication_per_user"
- (744479d6 - BT#14938) Add option to setting to hide lp navigation with arrows
- (ed0d11a7 - BT#15003) Admin: Add configuration setting 'limit_session_admin_list_users'
- (0c144607 - BT#14894) Admin: Add configuration setting "mail_template_system"
- (54a8d0d0 - BT#14987) Admin: Add configuration setting 'block_student_publication_score_edition'. Teachers can't edit student score once the score was set. Admins can still edit those values
- (501dcbe3 - BT#14986) Admin: Add configuration setting "block_student_publication_add_documents". Block "add documents" in student publication feature
- (59d8aec7 - BT#14894) Admin: Add Mail template manager (requires specific activation process)
- (53f18dca - BT#14985) Admin: Add configuration setting "block_student_publication_edition"
- (60eaebf0 - BT#14906) Admin: Add configuration setting "hide_complete_name_in_whoisonline" To hide name from whoisonline
- (5603615d - BT#14910) Admin: Add configuration setting "session_list_show_count_users" show only students
- (cd9460d7 - BT#14372) Admin: Add configuration setting $_configuration['hide_flag_language_switcher'] = false; Hide country flags in the language switcher + fix login form.
- (4c603d54) Admin: Add configuration setting "gradebook_multiple_evaluation_attempts". Add the possibility to add more attempts to the gradebook evaluation tool. Requires a DB change.
- (7b6f760c - BT#14769) Admin: Add configuration setting 'hide_username_in_course_chat'
- (afba2a6f - BT#14769) Admin: Add configuration setting 'hide_username_with_complete_name'
- (f23fa4b9 - BT#14747) Scripts: Add multiple-access-urls conversion script allowing for the conversion of an existing single-url portal to the secondary url of a multiple-access-url portal