Skip to content

Are users allowed to delete questions attempts by ajax or browser manipulation? #2124

Description

@marshel

I got a course ongoing, on the lp there is a exercise inside with 10 random questions with random answers.

I became in doubt on seeing the important activities list on https://www.....r/main/admin/statistics/index.php?report=activities .

There it showed some qst_attempt_deleted | exercise_a_q_id

2017-08-31 11_08_22-estatisticas
(there are more lines...)

on this file there is the code: chamilo-lms/main/inc/ajax/exercise.ajax.php

 // Deleting old attempt
                if (isset($attempt_list) && !empty($attempt_list[$my_question_id])) {
                    if ($debug) {
                        error_log("delete_attempt  exe_id : $exe_id, my_question_id: $my_question_id");
                    }
                    Event::delete_attempt(
                        $exe_id,
                        api_get_user_id(),
                        $course_id,
                        $session_id,
                        $my_question_id
                    );

So, Am I mistaken and the users are deleting its wrong attempts someway or,
they are just returning to a previous question and changing the value?

If it is the second, should the error log contain this strings ( qst_attempt_deleted | exercise_a_q_id) ? should not be better to change this?

If this is really a cheat attempt, should not be better to the Event::delete_attempt check if the user is a teacher or admin?

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions