jleyva/moodle-block_configurablereports 5.3.2

on GitHub

Requires PHP 8.0 or later.

Security

Several security fixes from a review of the whole plugin by MDL Shield. Upgrading
is recommended. Permissions are now checked in the course the report belongs to,
editing and importing reports require a sesskey and, for SQL reports, the
managesqlreports capability, imported reports are validated, report output is
escaped, every filter binds its values as SQL parameters, and fetching reports
from GitHub verifies TLS certificates.

Changes to check when upgrading:

• %%FILTER_VAR%% is now bound as a value, so it can be used anywhere a value is
  valid, such as WHERE cm.id = %%FILTER_VAR%%, and the URL can no longer add
  SQL. Reports that passed a whole condition in the URL have to move it into the
  query: AND u.city = %%FILTER_VAR%% with filter_var=Madrid (CONTRIB-10669).
• With SQL security enabled, the keyword and semicolon check also runs when a
  report runs, so imported or older reports that break it stop running.
• Password, secret and sesskey columns are never shown or used in conditions and
  filters, and ?debug=1 only shows the query to users who can manage SQL reports.
• Emails sent from a report only go to active users enrolled in its course.
• manageownreports is now flagged with the personal data, spam and XSS risks.

Fixes

• GitHub issues #121, #145, #190, #191, #220, #228, #232, #233, #242, #259, #266,
  #267, #278, #281, #299 and #300.
• Tracker issues CONTRIB-4159, CONTRIB-4937, CONTRIB-8676, CONTRIB-8780,
  CONTRIB-9739, CONTRIB-9932 and CONTRIB-10669.
• Embedded report columns are scoped to the course again and no longer crash when
  the embedded report has no conditions, and the custom SQL page no longer throws
  a JavaScript error when no remote repository is set.
• Several filter and column bugs found while adding tests, such as the course
  categories filter leaving out the courses in subcategories, and the user and
  course statistics columns failing with a date range or with no roles selected.

Other changes

• Scheduled SQL reports run from a scheduled task, as Moodle no longer runs the
  legacy block cron.
• Events are logged when reports are viewed, created, updated, deleted and
  exported.
• Every chart is drawn with pChart2, so the unmaintained pChart 1.x is gone, and
  the bundled Tahoma font was replaced with the OFL licensed Cairo font.
• PHPUnit and Behat tests cover every report type, the filters, the import path,
  the web service and the security fixes, and run in GitHub Actions together with
  the AMD build and stylelint checks.
• Deprecated core APIs such as xmlize() and lib/externallib.php were replaced,
  and thirdpartylibs.xml lists the bundled libraries with their real versions
  and licences.
• Releases are packaged from the tag and published to the Moodle plugins directory
  by a GitHub workflow.
• README.txt was split into README.md and this changelog.