michael-milette/moodle-filter_filtercodes v3.1.0

FilterCodes Release 3.1.0 - 2026-10-12

on GitHub

Notice: Release 3.0.0+ drops support for Moodle LMS 2.7 through 3.10 and PHP 5.4 through 7.2. The minimum supported versions are now Moodle LMS 3.11 and PHP 7.3. For compatibility with Moodle 2.7 LMS to 3.11, see the final legacy release of FilterCodes. Both legacy and current releases are currently compatible with Moodle LMS 3.11.

[3.1.0] 2026-10-12

Added

• "Allowed URL schemes" setting so administrators can control which URL schemes (protocols) the {button} tag may link to, one per line, instead of them being hard-coded. Defaults to http, https, mailto, tel and sms; javascript and other script-capable schemes can be added but are intentionally excluded by default.
• "Describe hidden courses" setting, controlling whether tags which accept a course ID may describe hidden courses.
• Missing tags {coursesactive}, {courseunenrolurl}, {menulanguages} to README.md.
• {scrape}: New headinglevel option to change the level of the headings in the scraped content so they fit the page, e.g. headinglevel="+1" turns h1 into h2 and h2 into h3. See README.md.

Updated

• {menudev}: Dev docs now links to moodledev.io.
• {menudev}: Adminer link now uses its current URL address.
• {menudev}: Page builder now links to build.layoutit.com.
• {menudev}: Corrected the documentation. The menu is shown to site administrators regardless of the debugging level.
• {menudev}: Removed the Screen recorder link.
• {menudev}: Removed Moodle Development School link - no longer exists.
• {menudev} and {menuadmin}: Page builder/Layitout links now open in the current window starting in Moodle 5.3 due to its new React-based menu.
• {menudev}: Photo editor link now opens in the current window starting in Moodle 5.3 due to its new React-based menu.
• {menudev}: Layoutit link now opens in the current window starting in Moodle 5.3 due to its new React-based menu.
• Fixed stylelint errors for @Property and aspect-ratio on Moodle 3.11 and 4.0. The fix in 3.0.1 only worked on Moodle 4.1 and later.
• {button} tag no longer links to ftp:, irc:, nntp:, news:, rtsp:, rtmp:, teamspeak:, gopher: or mms: addresses by default. Administrators who still need any of these can add them to the "Allowed URL schemes" setting.
• CI: Failing PHP Lint, Grunt and PHPUnit steps now fail the build.
• CI: Updated actions/checkout to v5, which runs on Node.js 24.
• CI: Only start the database each job needs.

Security

• {qrcode} tag now limits HTML attributes.
• {coursename id} no longer accepts a course ID of a course that is hidden from the user. Sites upgrading from an earlier version are not affected: the "Describe hidden courses" setting is enabled for them.
• {coursesummary id} no longer accepts a course ID when the course is hidden from the user. Sites upgrading from an earlier version are not affected: the "Describe hidden courses" setting is enabled for them.
• {coursestartdate id} no longer accepts a course ID when the course is hidden from the user. Sites upgrading from an earlier version are not affected: the "Describe hidden courses" setting is enabled for them.
• {courseenddate id} no longer accepts a course ID when the course is hidden from the user. Sites upgrading from an earlier version are not affected: the "Describe hidden courses" setting is enabled for them.
• {scrape}: When an allowed hosts list is configured, every address a page redirects to must also be on the list, except a redirect between a site's bare and www address (e.g. example.com to www.example.com). If the list is empty, redirects are not restricted.
• {scrape}: The code option is now cleaned like other HTML, unless Moodle leaves the text it is in uncleaned (e.g. Pages, activity descriptions, labels, Text blocks) or it is in a site policy document shown on the Policies tool pages. Elsewhere, such as in forum posts, scripts, styles and event handlers such as onclick, are removed. If you used JavaScript in code to adjust headings, use the new headinglevel option instead. W
• {button} tag no longer supports unwanted HTML attributes and unsafe links.
  • IMPORTANT: {button} no longer supports javascript links: (e.g. {button javascript:window.print()}). These buttons are still displayed, but do nothing when clicked. If your site relies on them, go to Site Administration > Plugins > Filters > Filter Codes and add javascript on its own line in the "Allowed URL schemes" setting. Only do this if you trust everyone who can edit content on your site.
  • Extra attributes other than target, rel, title, id, class, aria-label, download and data-bs-toggle/data-toggle="modal" are now ignored. This includes onclick and style.