Moodle LMS 3.11.5

17 January 2022

Moodle LMS version 3.11.5 is now available (security release).

Upgrading to Moodle LMS 3.11.5

What's New in Moodle LMS 3.11.5

• MSA-22-0001 SQL injection risk in code fetching h5p activity user attempts
  
• MSA-22-0002 calendar:manageentries capability allows CRUD access to all calendar events
  
• MSA-22-0003 Capability gradereport/user:view not always respected when navigating to a user's course grade report
  
• MSA-22-0004 CSRF risk in badge alignment deletion
  

• Workshop skips scheduled allocation
  
• H5P attempts not recorded when multiple users have same email address
  
• mod_quiz: Or all available attempts completed setting value lost
  
• Adhoc tasks for backup and restore are stuck in endless fail delay loop
  
• OAuth2 does not pass in all user mapped settings into new account
  
• retry interval in milliseconds for redis session cache is far too high
  
• Custom course field content for new course not found in global search
  
• SVG files do not support the preview mode
  
• You should not be able to add more than one instance of most blocks to your Dashboard
  
• Forum grading separate group filter shows discussion topics in the other groups
  
• Impossible to turn on only "Enable web services" from site admin page
  
• File upload limits not always enforced if there are many simultaneous uploads in progress
  
• Lack of files reported during upgrade to 3.9 when $CFG->admin differs from 'admin'
  
• HTML5 video in the mediaplugin fails when using .MOV files
  
• PHP Notices detected in web server logs (mod_lti)
  
• File upload: Uncaught TypeError from JavaScript when uploading a single file
  
• mod_url: Error makes course/view.php unreachable if an invalid URL is saved
  
• $CFG->scheduled_tasks has incorrect order for dayofweek and months in cron spec
  
• Expand unit test coverage defaults
  
• Image caption warning for external badges
  
• Essay qtype: Error message is displayed when Allow attachments field is reset to 'No'
  
• Disabling "Require email verification" doesn't persist properly the first time
  
• User profile fields are broken when having uppercase in shortname
  
• External badge image not displayed in some cases
  
• Cannot enter feedback from grader report when feedback was previously deleted from assign grader
  
• Can't delete course category
  
• JS exception filtering course participants for keyword containing quotes
  
• Admin bookmarks block is too aggressive at cleaning bookmarked section
  
• Quiz attempt navigation buttons misaligned
  
• Double encoding of site/course name in course download
  
• Badly formatted lists in the grade history report
  
• Data request email breaks organisation signature
  
• Admin mobile certificate check can return errors on valid certificate
  
• Improve filtering by component in eventlist report
  
• Purge all caches only purges the selected cache if selected
  
• Course autocomplete duplicated in report condition/filter
  
• User Participants filter leaves invalid group filter row if no groups are present
  

• The WCAG (cynthia.exe) validator links in the footer is no longer available
  
• Focus outline for modal close button is clipped and has insufficient colour contrast
  
• Need a Mustache helper method for html entities
  
• File extension in Essay accepted file type list is failing accessibility color contrast limits
  

• Add behat generators for glossary entries and categories
  
• Add behat generators for forum discussions and posts
  
• Create default block generator for testing
  
• Add PHP version and required/optional extensions to composer.json
  

• New helper function for cleaning SQL ORDER BY clauses
  
• sesskey is exposed in url for /user/managetoken.php