Олег Давидович: 1 версия импортирована

2024-10-18T06:44:55Z

1 версия импортирована

← Предыдущая версия	Версия от 06:44, 18 октября 2024
(нет различий)

1>Tsala: de inter-wiki link

2020-01-23T14:21:49Z

de inter-wiki link

Новая страница

{{Security}}
==How do I report a security issue?==

See [[:dev:Moodle security procedures|Moodle security procedures]] in the dev docs for details on how to report a security issue.

Previously fixed security issues are listed in the [http://moodle.org/security/ Moodle.org Security news]. If you are unsure whether a problem has been fixed or not, it's best to report it anyway.

==How can I keep my site secure?==

It's good practice to always use the latest stable release of the version you are using. It is safe to upgrade to a more recent version on the branch you are using, say from Moodle 2.X.1 to the latest version on the 2.X branch. [[Git for Administrators|Downloading via Git]] makes it very easy way to do this.

==How do I keep track of recent security issues?==

* [[Site registration | Register your Moodle site with moodle.org]], making sure to enable the option of being notified about security issues and updates. After your registration is accepted, your email address will be automatically added to our low-volume security alerts mailing list.

* Eventually, all important security issues are published to the general public via the [http://moodle.org/mod/forum/view.php?f=996 Moodle Security forum]. You can subscribe to the forum or [http://twitter.com/moodlesecurity follow moodlesecurity on Twitter].

==Who is able to view security issues in the Tracker?==

Depending upon the security level of a Tracker issue, access is restricted to developers, testers or members of the security team. Specific details are available in the [[dev:Tracker guide#When_creating_an_issue|Security Level field description in the Tracker guide]].

==Which versions of Moodle are supported?==

Currently supported versions are listed on [http://download.moodle.org/ download.moodle.org].

==My site was hacked. What do I do?==

See [[Hacked site recovery]].

==How can I reduce spam in Moodle?==

See [[Reducing spam in Moodle]].

==How can I increase privacy in Moodle?==

See [[Increasing privacy in Moodle]].

==How do I enable reCAPTCHA?==

To add spam protection to the [[Email-based self-registration]] new account form with a CAPTCHA element:

#Obtain a reCAPTCHA key from http://recaptcha.net by [https://admin.recaptcha.net/accounts/signup/?next= signing up for an account] (free) then entering a domain.
#Copy and paste the public and private keys provided into the ''recaptchapublickey'' and ''recaptchaprivatekey'' fields in the manage authentication common settings in ''Administration > Plugins > Authentication > [[Manage authentication]]''.
#Click the "Save changes" button at the bottom of the page.
#Follow the settings link for email-based self-registration in ''Administration > Plugins > Authentication > Manage authentication'' and enable the reCAPTCHA element.
#Click the "Save changes" button at the bottom of the page.

==How can I run the security overview report?==

To run the [[Security overview|security overview report]], go to ''Administration > Site administration > Reports > Security overview''.

== I have discovered Cross Site Scripting (XSS) is possible with Moodle ==

Some forms of rich content used by teachers to enhance their courses use the same technologies that malicious users can use for cross-site scripting attacks. If Moodle was solely concerned with security, it would not allow this. However, Moodle is also concerned with education and so a balance has to be struck between securing the system and supporting teachers with their needs.

In order to strike a balance between authoring rich educational content and securing the system, access to post XSS-capable content is controlled by capabilites flagged with the 'XSS risk' - see [[Risks]]. In general this means that admins and teachers can post XSS-capable content, but students can not - see [[XSS_trusted_users]].

Occasionally security bugs are discovered in Moodle's handling of XSS capable content and we are greatful to the community for reporting these through [https://docs.moodle.org/dev/Moodle_security_procedures responsible disclosure]. Before reporting an XSS bug to Moodle, please ensure that the user posting the XSS content does not have capabilities flagged with the XSS risk.

==See also==

* Using Moodle [http://moodle.org/mod/forum/view.php?id=7301 Security and Privacy forum]

[[Category:FAQ]]

[[de:Sicherheit FAQ]]
[[es:Seguridad FAQ]]
[[fr: FAQ sur la sécurité]]

Security FAQ - История изменений

Олег Давидович: 1 версия импортирована

1>Tsala: de inter-wiki link