User Able to Reset Course Progress When They Shouldn't Be Allowed

Created on 8 August 2024, 4 months ago
Updated 9 August 2024, 4 months ago

Setup a new learning path with 2 modules, each module set to 1 attempt only.

After a user completes the learning path they are redirected to the group homepage (i.e. /group/1).

If the user at this point uses the browsers back button to return to the previous activity (the last activity in the last module) the system first does a check to see if there is an existing learning path attempt, but since the attempt has been completed one doesn't exist.

The system then creates a new LP attempt and dumps the user into the first activity of the first module. The user should not be allowed to attempt the content again, as we've got the modules set to 1 attempt. Even if they don't do the first module, due to the new LP attempt their progress is reset and it now appears that the course has not been completed.

/opigno_learning_path/src/Controller/LearningPathStepsController.php's function "start" (around line 246) first checks if a $current_attempt exits and if it doesn't blindly creates one (around line 256). It should check first if it can create one and only then do so. If it can't it should redirect.

🐛 Bug report
Status

Active

Version

3.1

Component

Code

Created by

🇨🇦Canada 2gendevs

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @2gendevs
  • 🇨🇦Canada 2gendevs

    This patch should correct the issue.

    Before attempting to create a new LP attempt, we check to see if there is a module within the LP that the user is allowed to do. If there isn't we redirect to the LP homepage.

Production build 0.71.5 2024