Moodle - the world's open source learning platform
This report summarizes scanner evidence for moodle/moodle, a PHP project with 7,473 GitHub stars. SynthScan examined 9,097,130 lines of code across 59818 source files, recording 35388 pattern matches distributed across 17 syntactic categories. The legacy adjusted pattern signal is 4.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 35134 finding(s).
Are imports declared and package/API names verified? 243 finding(s).
Are wrappers, guards, and repeated structures necessary? 20956 finding(s).
Which changes need focused human review? 35388 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 35388 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .grunt/babel-plugin-add-module-to-define.js | 54 | function getModuleNameFromFileName(searchFileName) { | CODE |
| LOW | public/competency/tests/api_test.php | 4023 | protected function assertSuccessWithGradeCompetencyInCourse($courseid, $userid, $compid, $grade = 1) { | CODE |
| LOW | public/competency/tests/api_test.php | 4043 | protected function assertExceptionWithGradeCompetencyInCourse($exceptiontype, $exceptiontext, $courseid, $userid, $c | CODE |
| LOW | public/repository/s3/S3.php | 1530 | public static function listOriginAccessIdentities() | CODE |
| LOW | public/repository/s3/S3.php | 1641 | public static function getDistributionInvalidationList($distributionId) | CODE |
| LOW | public/course/format/amd/src/courseeditor.js | 44 | function dispatchStateChangedEvent(detail, target) { | CODE |
| LOW | public/course/format/amd/src/activitychooser.js | 122 | function getCoursePositionFromTarget(target) { | CODE |
| LOW | …ourse/format/amd/src/local/activitychooser/dialogue.js | 49 | export async function displayActivityChooserModal( | CODE |
| LOW⚡ | …min/tool/mfa/factor/totp/extlib/OTPHP/OTPInterface.php | 125 | public function isIssuerIncludedAsParameter(): bool; | CODE |
| LOW⚡ | …min/tool/mfa/factor/totp/extlib/OTPHP/OTPInterface.php | 130 | public function setIssuerIncludedAsParameter(bool $issuer_included_as_parameter): void; | CODE |
| LOW⚡ | …min/tool/mfa/factor/totp/extlib/OTPHP/OTPInterface.php | 132 | public function withIssuerIncludedAsParameter(bool $issuer_included_as_parameter): self; | CODE |
| LOW⚡ | public/admin/tool/mfa/factor/totp/extlib/OTPHP/OTP.php | 145 | public function isIssuerIncludedAsParameter(): bool | CODE |
| LOW⚡ | public/admin/tool/mfa/factor/totp/extlib/OTPHP/OTP.php | 150 | public function setIssuerIncludedAsParameter(bool $issuer_included_as_parameter): void | CODE |
| LOW⚡ | public/admin/tool/mfa/factor/totp/extlib/OTPHP/OTP.php | 155 | public function withIssuerIncludedAsParameter(bool $issuer_included_as_parameter): static | CODE |
| LOW | public/admin/tool/mfa/factor/totp/extlib/OTPHP/OTP.php | 431 | private function buildProvisioningUriLabel(): string | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 507 | protected function assertCourseCompetencyExists($course, $competency) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 518 | protected function assertCourseCompetencyNotExists($course, $competency) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 530 | protected function assertCourseCompetencyMigrated($course, $compfrom, $compto) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 555 | protected function assertCourseCompetencyNotMigrated($course, $compfrom, $compto) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 576 | protected function assertModuleCompetencyExists($cm, $competency) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 587 | protected function assertModuleCompetencyNotExists($cm, $competency) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 599 | protected function assertModuleCompetencyMigrated($cm, $compfrom, $compto) { | CODE |
| LOW | public/admin/tool/lpmigrate/tests/processor_test.php | 624 | protected function assertModuleCompetencyNotMigrated($cm, $compfrom, $compto) { | CODE |
| LOW | public/enrol/lti/classes/data_connector.php | 634 | public function getUserResultSourcedIDsResourceLink($resourcelink, $localonly, $idscope) { | CODE |
| LOW | public/enrol/lti/classes/data_connector.php | 812 | public function deleteResourceLinkShareKey($sharekey) { | CODE |
| LOW | public/enrol/lti/ims-blti/OAuthBody.php | 6 | function getLastOAuthBodyBaseString() { | CODE |
| LOW | public/question/type/ddimageortext/amd/src/question.js | 47 | function DragDropOntoImageQuestion(containerId, readOnly, places) { | CODE |
| LOW | public/lib/formslib.php | 3096 | function hardFreezeAllVisibleExcept($elementList) | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 3477 | public function setHeaderTemplateAutoreset($val=true) { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 7957 | protected function getInternalPageNumberAliases($a= '') { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 7978 | protected function getAllInternalPageNumberAliases() { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 7996 | protected function replaceRightShiftPageNumAliases($page, $aliases, $diff) { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 10387 | public function setDocModificationTimestamp($time) { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 10410 | public function getDocModificationTimestamp() { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 13664 | public function addEmptySignatureAppearance($x=0, $y=0, $w=0, $h=0, $page=-1, $name='') { | CODE |
| LOW | public/lib/tcpdf/tcpdf.php | 13682 | protected function getSignatureAppearanceArray($x=0, $y=0, $w=0, $h=0, $page=-1, $name='') { | CODE |
| LOW | public/lib/tcpdf/include/tcpdf_static.php | 1658 | public static function getTransformationMatrixProduct($ta, $tb) { | CODE |
| LOW | public/lib/tcpdf/include/tcpdf_filters.php | 150 | public static function decodeFilterASCIIHexDecode($data) { | CODE |
| LOW | public/lib/tcpdf/include/tcpdf_filters.php | 371 | public static function decodeFilterRunLengthDecode($data) { | CODE |
| LOW | public/lib/tcpdf/include/tcpdf_filters.php | 408 | public static function decodeFilterCCITTFaxDecode($data) { | CODE |
| LOW | public/lib/tcpdf/include/barcodes/qrcode.php | 1688 | protected function insertStructuredAppendHeader($items, $size, $index, $parity) { | CODE |
| LOW | public/lib/tcpdf/include/barcodes/datamatrix.php | 653 | protected function getSwitchEncodingCodeword($mode) { | CODE |
| LOW | public/lib/google2-auth/src/CredentialsLoader.php | 263 | public static function getDefaultClientCertSource() | CODE |
| LOW | public/lib/google2-auth/src/CredentialsLoader.php | 288 | public static function shouldLoadClientCertSource() | CODE |
| LOW | public/lib/google2-auth/src/CredentialsLoader.php | 296 | private static function loadDefaultClientCertSourceFile() | CODE |
| LOW | …lib/google2-auth/src/ApplicationDefaultCredentials.php | 268 | public static function getProxyIdTokenMiddleware( | CODE |
| LOW | public/lib/google2-auth/src/AccessToken.php | 350 | private function retrieveCertsFromLocation($url, array $options = []) | CODE |
| LOW | public/lib/google2-auth/src/AccessToken.php | 465 | private function getCacheKeyFromCertLocation($certsLocation) | CODE |
| LOW | public/lib/google2-auth/src/OAuth2.php | 589 | public function generateCredentialsRequest(?callable $httpHandler = null, array $headers = []) | CODE |
| LOW | public/lib/google2-auth/src/OAuth2.php | 827 | public function buildFullAuthorizationUri(array $config = []) | CODE |
| LOW | public/lib/google2-auth/src/MetricsTrait.php | 72 | protected function applyServiceApiUsageMetrics($metadata) | CODE |
| LOW | public/lib/google2-auth/src/MetricsTrait.php | 98 | protected function applyTokenEndpointMetrics($metadata, $authRequestType) | CODE |
| LOW | …google2-auth/src/CredentialSource/ExecutableSource.php | 168 | private function getCachedExecutableResponse(): ?array | CODE |
| LOW | …e2-auth/src/Credentials/ExternalAccountCredentials.php | 229 | private static function getServiceAccountImpersonationEmail(string $serviceAccountImpersonationUrl): string|null | CODE |
| LOW | …e2-auth/src/Credentials/ExternalAccountCredentials.php | 252 | private function getImpersonatedAccessToken(string $stsToken, ?callable $httpHandler = null): array | CODE |
| LOW | …e2-auth/src/Credentials/ExternalAccountCredentials.php | 447 | private function buildRegionalAccessBoundaryLookupUrl(string|null $clientName): string | CODE |
| LOW | …2-auth/src/Credentials/RegionalAccessBoundaryTrait.php | 28 | private function getRegionalAccessBoundary( | CODE |
| LOW | …2-auth/src/Credentials/RegionalAccessBoundaryTrait.php | 85 | private function updateRegionalAccessBoundaryMetadata( | CODE |
| LOW | …2-auth/src/Credentials/RegionalAccessBoundaryTrait.php | 111 | private function buildRegionalAccessBoundaryLookupUrl( | CODE |
| LOW | …2-auth/src/Credentials/RegionalAccessBoundaryTrait.php | 150 | private function lookupRegionalAccessBoundary( | CODE |
| 20885 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Gruntfile.js | 1 | // This file is part of Moodle - http://moodle.org/ | COMMENT |
| LOW | index.php | 1 | <?php | COMMENT |
| LOW | config-dist.php | 1 | <?php | COMMENT |
| LOW | config-dist.php | 21 | // // | COMMENT |
| LOW | config-dist.php | 61 | // default port | COMMENT |
| LOW | config-dist.php | 81 | // the VERSION function instead of the version | COMMENT |
| LOW | config-dist.php | 101 | // It is worth noting that for MySQL require and verify-full are the same | COMMENT |
| LOW | config-dist.php | 121 | // not a string! | COMMENT |
| LOW | config-dist.php | 161 | */ | COMMENT |
| LOW | config-dist.php | 181 | // Now you need a place where Moodle can save uploaded files. This | COMMENT |
| LOW | config-dist.php | 201 | COMMENT | |
| LOW | config-dist.php | 221 | // | COMMENT |
| LOW | config-dist.php | 241 | // See details at: http://php.net/manual/en/function.date-default-timezone-set.php | COMMENT |
| LOW | config-dist.php | 261 | // $CFG->includeuserpasswordsinbackup = true; | COMMENT |
| LOW | config-dist.php | 281 | // If you obtain user conflicts on restore, rather than enabling this setting | COMMENT |
| LOW | config-dist.php | 301 | // These variables define the specific settings for defined course formats. | COMMENT |
| LOW | config-dist.php | 321 | // Seconds for files to remain in caches. Decrease this if you are worried | COMMENT |
| LOW | config-dist.php | 341 | // | COMMENT |
| LOW | config-dist.php | 361 | // $CFG->session_memcached_acquire_lock_timeout = 120; | COMMENT |
| LOW | config-dist.php | 381 | // $CFG->session_redis_lock_retry = 100; // Optional wait between lock attempts in ms, default is 10 | COMMENT |
| LOW | config-dist.php | 401 | // | COMMENT |
| LOW | config-dist.php | 421 | // it may be also necessary to enable this when using port forwarding. | COMMENT |
| LOW | config-dist.php | 441 | // For example: if $CFG->customscripts/course/view.php exists then | COMMENT |
| LOW | config-dist.php | 461 | // and printout of the data | COMMENT |
| LOW | config-dist.php | 481 | // | COMMENT |
| LOW | config-dist.php | 501 | // the following statements. In the General part put: | COMMENT |
| LOW | config-dist.php | 521 | // | COMMENT |
| LOW | config-dist.php | 541 | // | COMMENT |
| LOW | config-dist.php | 561 | // $CFG->lang = 'yourlangcode'; // for example 'cs' | COMMENT |
| LOW | config-dist.php | 581 | // Use the following flag to completely disable the Available update notifications | COMMENT |
| LOW | config-dist.php | 601 | // whilst still showing the state of tasks. | COMMENT |
| LOW | config-dist.php | 621 | // file locking for SQLServer. If $CFG->preventfilelocking is set, then the | COMMENT |
| LOW | config-dist.php | 641 | // | COMMENT |
| LOW | config-dist.php | 661 | // 'extension' => 'frog', | COMMENT |
| LOW | config-dist.php | 681 | // password. | COMMENT |
| LOW | config-dist.php | 701 | // by default unless $CFG->alternateloginurl is set. | COMMENT |
| LOW | config-dist.php | 721 | // $CFG->taskruntimeerror = 24 * 60 * 60; | COMMENT |
| LOW | config-dist.php | 741 | // $CFG->enable_read_only_sessions_debug = true; | COMMENT |
| LOW | config-dist.php | 761 | // $CFG->maxcoursesincategory = 10000; | COMMENT |
| LOW | config-dist.php | 781 | // $CFG->h5pcrossorigin = 'anonymous'; | COMMENT |
| LOW | config-dist.php | 801 | // `progresspollinterval` config setting, to determine the interval (in seconds) at which the | COMMENT |
| LOW | config-dist.php | 821 | // Maximum character length for a user profile description. | COMMENT |
| LOW | config-dist.php | 841 | // $CFG->debug_developer_use_pretty_exceptions = true; | COMMENT |
| LOW | config-dist.php | 861 | // Prevent theme caching | COMMENT |
| LOW | config-dist.php | 881 | // $CFG->yuiloginclude = array( | COMMENT |
| LOW | config-dist.php | 901 | // $CFG->nosmsever = true; // NOT FOR PRODUCTION SERVERS! | COMMENT |
| LOW | config-dist.php | 921 | // $CFG->showcrondebugging = true; | COMMENT |
| LOW | config-dist.php | 941 | // Core settings are specified directly via assignment to $CFG variable. | COMMENT |
| LOW | config-dist.php | 961 | // | COMMENT |
| LOW | config-dist.php | 981 | // | COMMENT |
| LOW | config-dist.php | 1001 | // $CFG->behat_config = array( | COMMENT |
| LOW | config-dist.php | 1021 | // ), | COMMENT |
| LOW | config-dist.php | 1041 | // 'browser' => 'phantomjs', | COMMENT |
| LOW | config-dist.php | 1061 | // | COMMENT |
| LOW | config-dist.php | 1081 | // * a screenshot (JavaScript is required for the screenshot functionality, so not all browsers support this option) | COMMENT |
| LOW | config-dist.php | 1101 | // 'behat_wwwroot' => 'http://127.0.0.1/moodle', | COMMENT |
| LOW | config-dist.php | 1121 | // | COMMENT |
| LOW | config-dist.php | 1141 | // it's usage in production environments is not recommended; if it is used to create JMeter test plans | COMMENT |
| LOW | config-dist.php | 1161 | // Probably something like /usr/bin/php. If you enter this, cron scripts can be | COMMENT |
| LOW | config-dist.php | 1181 | // (Development->Profiling) built into Moodle. | COMMENT |
| 13991 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | public/repository/repository_callback.php | 95 | window.opener.M.core_filepicker.active_filepicker.list(); | CODE |
| CRITICAL | public/course/yui/src/dragdrop/js/section.js | 72 | var sectionid = Y.Moodle.core_course.util.section.getId(sectionnode); | CODE |
| CRITICAL | public/course/yui/src/dragdrop/js/section.js | 172 | dragnodeid = Y.Moodle.core_course.util.section.getId(dragnode), | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/section.js | 251 | if (Y.Moodle.core_course.util.section.getId(sectionlist.item(index - 1)) > | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/section.js | 252 | Y.Moodle.core_course.util.section.getId(sectionlist.item(index))) { | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/section.js | 253 | Y.log("Swapping " + Y.Moodle.core_course.util.section.getId(sectionlist.item(index - 1)) | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/section.js | 254 | " with " + Y.Moodle.core_course.util.section.getId(sectionlist.item(index))); | CODE |
| CRITICAL | public/course/yui/src/dragdrop/js/section.js | 267 | Y.Moodle.core_course.util.section.getId(sectionlist.item(index))); | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/resource.js | 164 | var cmid = Number(Y.Moodle.core_course.util.cm.getId(dragnode)); | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/resource.js | 173 | params.sectionId = Y.Moodle.core_course.util.section.getId(dropnode.ancestor(M.course.format.get_section_wrapper | CODE |
| CRITICAL⚡ | public/course/yui/src/dragdrop/js/resource.js | 176 | beforeid = Number(Y.Moodle.core_course.util.cm.getId(dragnode.next())); | CODE |
| CRITICAL | public/course/amd/src/actions.js | 144 | id = Y.Moodle.core_course.util.cm.getId(Y.Node(item)); | CODE |
| CRITICAL | public/course/amd/src/actions.js | 158 | name = Y.Moodle.core_course.util.cm.getName(Y.Node(element.get(0))); | CODE |
| CRITICAL | public/lib/form/yui/src/dateselector/js/calendar.js | 108 | var calendarimageelement = document.getElementById(M.form.dateselector.currentowner.calendarimage.get('i | CODE |
| CRITICAL | public/lib/jquery/jquery-3.7.1.js | 7975 | jQuery.each( jQuery.expr.match.bool.source.match( /\w+/g ), function( _i, name ) { | CODE |
| CRITICAL | public/lib/jquery/jquery-3.7.1.min.js | 2 | !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):f | CODE |
| CRITICAL | public/lib/jquery/ui-1.14.1/jquery-ui.min.js | 6 | (t=>{"function"==typeof define&&define.amd?define(["jquery"],t):t(jQuery)})(function(V){V.ui=V.ui||{};V.ui.version="1.14 | CODE |
| CRITICAL⚡ | …/lib/editor/tiny/js/tinymce/themes/silver/theme.min.js | 3 | function hk(e,t){(null==t||t>e.length)&&(t=e.length);for(var o=0,n=Array(t);o<t;o++)n[o]=e[o];return n}function fk(e,t){ | CODE |
| CRITICAL | public/h5p/h5plib/v128/joubel/core/js/h5p.js | 2894 | window.parent.H5P.externalDispatcher.trigger.call(this, event); | CODE |
| CRITICAL | public/h5p/h5plib/v128/joubel/core/js/jquery.js | 2 | !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):f | CODE |
| CRITICAL⚡ | …ib/v128/joubel/editor/scripts/h5peditor-image-popup.js | 270 | this.cropper.sections.tools.classList.add('hidden'); | CODE |
| CRITICAL⚡ | …ib/v128/joubel/editor/scripts/h5peditor-image-popup.js | 272 | this.cropper.sections.tools.classList.add('wait'); | CODE |
| CRITICAL⚡ | …ib/v128/joubel/editor/scripts/h5peditor-image-popup.js | 282 | this.cropper.sections.tools.classList.remove('hidden', 'wait'); | CODE |
| CRITICAL | public/mod/quiz/yui/src/util/js/slot.js | 191 | if (!Y.Moodle.mod_quiz.util.page.getPageFromSlot(slot)) { | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/util/js/slot.js | 236 | var page = Y.Moodle.mod_quiz.util.page.getPageFromSlot(slot); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/util/js/slot.js | 239 | if (!Y.Moodle.mod_quiz.util.page.isEmpty(page)) { | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/util/js/slot.js | 243 | Y.Moodle.mod_quiz.util.page.remove(page); | CODE |
| CRITICAL | public/mod/quiz/yui/src/util/js/slot.js | 338 | if (Y.Moodle.mod_quiz.util.page.isPage(nextitem)) { | CODE |
| CRITICAL | public/mod/quiz/yui/src/util/js/page.js | 227 | Y.Moodle.mod_quiz.util.slot.removePageBreak(previousslot); | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 195 | 'id': Y.Moodle.mod_quiz.util.slot.getId(element) | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 200 | Y.Moodle.mod_quiz.util.slot.remove(element); | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 278 | var slot = Y.Moodle.mod_quiz.util.slot.getSlotFromComponent(node); | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 280 | ids += Y.Moodle.mod_quiz.util.slot.getId(slot); | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 308 | Y.Moodle.mod_quiz.util.slot.remove(node.ancestor('li.activity')); | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 348 | 'id': Y.Moodle.mod_quiz.util.slot.getId(activity) | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 421 | 'id': Y.Moodle.mod_quiz.util.slot.getId(activity) | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 506 | 'id': Y.Moodle.mod_quiz.util.slot.getId(nextactivity), | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 513 | Y.Moodle.mod_quiz.util.page.add(activity); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 516 | Y.Moodle.mod_quiz.util.page.remove(page, true); | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 545 | 'id': Y.Moodle.mod_quiz.util.slot.getId(activity), | CODE |
| CRITICAL | public/mod/quiz/yui/src/toolboxes/js/resource.js | 551 | Y.Moodle.mod_quiz.util.slot.updateDependencyIcon(activity, response.requireprevious); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 565 | Y.Moodle.mod_quiz.util.slot.reorderSlots(); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 566 | Y.Moodle.mod_quiz.util.slot.reorderPageBreaks(); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 567 | Y.Moodle.mod_quiz.util.page.reorderPages(); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 568 | Y.Moodle.mod_quiz.util.slot.updateOneSlotSections(); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/toolboxes/js/resource.js | 569 | Y.Moodle.mod_quiz.util.slot.updateAllDependencyIcons(); | CODE |
| CRITICAL | public/mod/quiz/yui/src/dragdrop/js/section.js | 61 | var sectionid = Y.Moodle.core_course.util.section.getId(sectionnode); | CODE |
| CRITICAL | public/mod/quiz/yui/src/dragdrop/js/section.js | 128 | dragnodeid = Y.Moodle.core_course.util.section.getId(dragnode), | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/section.js | 209 | if (Y.Moodle.core_course.util.section.getId(sectionlist.item(index - 1)) > | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/section.js | 210 | Y.Moodle.core_course.util.section.getId(sectionlist.item(index))) { | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/section.js | 211 | Y.log("Swapping " + Y.Moodle.core_course.util.section.getId(sectionlist.item(index - 1)) | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/section.js | 212 | " with " + Y.Moodle.core_course.util.section.getId(sectionlist.item(index)), | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/resource.js | 132 | params.id = Number(Y.Moodle.mod_quiz.util.slot.getId(dragnode)); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/resource.js | 133 | params.sectionId = Y.Moodle.core_course.util.section.getId(dragnode.ancestor('li.section', true)); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/resource.js | 137 | params.previousid = Number(Y.Moodle.mod_quiz.util.slot.getId(previousslot)); | CODE |
| CRITICAL⚡ | public/mod/quiz/yui/src/dragdrop/js/resource.js | 142 | params.page = Number(Y.Moodle.mod_quiz.util.page.getId(previouspage)); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | UPGRADING.md | 3341 | You can check the contents of an email using the step `Then the email to "user@example.com" with subject containing "s | CODE |
| LOW | public/repository/url/locallib.php | 204 | * space. Examples: "example.com", "user@example.com", | COMMENT |
| LOW | public/course/editsection_form.php | 34 | 'placeholder' => $this->_customdata['defaultsectionname'], | CODE |
| LOW | public/course/tests/course_request_test.php | 51 | $data->summary_editor['text'] = 'Lorem Ipsum ©'; | CODE |
| LOW | public/course/tests/course_request_test.php | 110 | $data->summary_editor['text'] = 'Lorem Ipsum ©'; | CODE |
| LOW | public/course/tests/course_request_test.php | 213 | $data->summary_editor['text'] = 'Lorem Ipsum ©'; | CODE |
| LOW | …course/tests/reportbuilder/datasource/courses_test.php | 269 | 'course:summary_value' => 'Lorem ipsum', | CODE |
| LOW | public/auth/db/tests/db_test.php | 211 | $user3 = (object)array('name'=>'admin', 'pass'=>'heslo', 'email'=>'admin@example.com'); // Should be skipped. | CODE |
| LOW | public/reportbuilder/tests/local/report/base_test.php | 137 | $systemreport->add_base_condition_sql("email = :{$paramemail}", [$paramemail => 'admin@example.com']); | CODE |
| LOW | public/reportbuilder/tests/local/report/base_test.php | 141 | $this->assertEquals([$paramusername => 'admin', $paramemail => 'admin@example.com'], $params); | CODE |
| LOW | …er/tests/external/custom_report_data_exporter_test.php | 68 | 'columns' => ['Admin User', 'admin@example.com'], | CODE |
| LOW | …reportbuilder/tests/external/reports/retrieve_test.php | 82 | 'columns' => ['Admin User', 'admin@example.com'], | CODE |
| LOW | public/comment/classes/manager.php | 528 | 'placeholder' => get_string('addcomment'), | CODE |
| LOW | public/admin/classes/local/settings/autocomplete.php | 80 | 'placeholder', | CODE |
| LOW | public/admin/classes/local/settings/autocomplete.php | 187 | $context['placeholder'] = $this->placeholder; | CODE |
| LOW | public/admin/tool/capability/classes/settings_form.php | 58 | $form->addElement('text', 'search', $strsearch, ['data-action' => 'search', 'placeholder' => $strsearch]) | CODE |
| LOW | …lic/admin/tool/mfa/classes/local/form/reset_factor.php | 56 | ['placeholder' => get_string('resetfactorplaceholder', 'tool_mfa')]); | CODE |
| LOW | public/admin/tool/mfa/factor/totp/classes/factor.php | 174 | 'placeholder' => get_string('devicenameexample', 'factor_totp'), | CODE |
| LOW | public/admin/tool/mobile/settings.php | 632 | 'placeholder' => new lang_string('filetypeexclusionlistplaceholder', 'tool_mobile'), | CODE |
| LOW | public/admin/tool/mobile/tests/externallib_test.php | 126 | set_config('supportemail', 'test@test.com'); | CODE |
| LOW | public/admin/tool/mobile/tests/externallib_test.php | 186 | set_config('supportemail', 'test@test.com'); | CODE |
| LOW | …al/htmlchecker/common/checks/content_too_long_test.php | 40 | <p><span>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent accumsan, ante varius viverra aliquam, do | CODE |
| LOW | …al/htmlchecker/common/checks/content_too_long_test.php | 40 | <p><span>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent accumsan, ante varius viverra aliquam, do | CODE |
| LOW⚡ | …al/htmlchecker/common/checks/content_too_long_test.php | 52 | Sed lacinia nunc lobortis, vestibulum nisi dictum, pulvinar tellus. Lorem ipsum dolor sit amet, consectetur adipisci | CODE |
| LOW⚡ | …al/htmlchecker/common/checks/content_too_long_test.php | 52 | Sed lacinia nunc lobortis, vestibulum nisi dictum, pulvinar tellus. Lorem ipsum dolor sit amet, consectetur adipisci | CODE |
| LOW⚡ | …al/htmlchecker/common/checks/content_too_long_test.php | 61 | pharetra magna sed tristique. Pellentesque blandit elit ac neque lacinia finibus. Lorem ipsum dolor sit amet, consec | CODE |
| LOW⚡ | …al/htmlchecker/common/checks/content_too_long_test.php | 61 | pharetra magna sed tristique. Pellentesque blandit elit ac neque lacinia finibus. Lorem ipsum dolor sit amet, consec | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 47 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 47 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 78 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 78 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 109 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 109 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 140 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 140 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 171 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 171 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 202 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 202 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 233 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …s/local/htmlchecker/common/checks/no_headings_test.php | 233 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ut varius elit, vel euismod neque. Nunc vulputate | CODE |
| LOW | …onentlibrary/content/moodle/components/search-input.md | 82 | "placeholder": "Search settings", | CODE |
| LOW | …n/tool/componentlibrary/content/moodle/themes/grids.md | 23 | Lorem ipsum dolor sit amet | CODE |
| LOW | …n/tool/componentlibrary/content/moodle/themes/grids.md | 23 | Lorem ipsum dolor sit amet | CODE |
| LOW | public/admin/tool/policy/classes/form/policydoc.php | 80 | ['maxlength' => 1333, 'placeholder' => $default]); | CODE |
| LOW | …ic/admin/tool/customlang/classes/output/translator.php | 77 | $string->placeholderhelp = $output->help_icon('placeholder', 'tool_customlang', | CODE |
| LOW | …blic/admin/tool/customlang/lang/en/tool_customlang.php | 85 | $string['placeholder'] = 'Placeholders'; | CODE |
| LOW | public/enrol/lti/tests/helper_test.php | 347 | $this->assertStringContainsString('Test course 1 Lorem ipsum dolor sit amet', $description); | CODE |
| LOW | public/enrol/lti/tests/helper_test.php | 347 | $this->assertStringContainsString('Test course 1 Lorem ipsum dolor sit amet', $description); | CODE |
| LOW | …ti/tests/local/ltiadvantage/lti_advantage_testcase.php | 58 | 'email' => 'smithj@example.org' | CODE |
| LOW | …ge/amd/src/message_drawer_view_conversation_patcher.js | 1204 | [loadingFirstMessages, {type: 'placeholder'}], | CODE |
| LOW | …ge/amd/src/message_drawer_view_conversation_patcher.js | 1241 | return {type: 'placeholder'}; | CODE |
| LOW | …e/amd/src/message_drawer_view_conversation_renderer.js | 431 | messageTextArea.prop('placeholder', string); | CODE |
| LOW | …e/amd/src/message_drawer_view_conversation_renderer.js | 473 | messageTextArea.removeAttr('placeholder'); | CODE |
| LOW | …e/amd/src/message_drawer_view_conversation_renderer.js | 1017 | case 'placeholder': | CODE |
| LOW | public/user/tests/fields_test.php | 285 | 'city' => 'C1', 'department' => 'D1', 'email' => 'e1@example.org', | CODE |
| LOW | public/user/tests/fields_test.php | 288 | 'city' => 'C2', 'department' => 'D2', 'email' => 'e2@example.org', | CODE |
| LOW | public/user/tests/fields_test.php | 482 | 'profile_field_a' => 'A1', 'email' => 'e1@example.org']; | CODE |
| LOW | public/user/tests/externallib_test.php | 456 | $USER->email = "admin@example.com"; | CODE |
| LOW | …lic/user/tests/reportbuilder/datasource/users_test.php | 54 | $this->assertEquals(['Admin User', 'admin', 'admin@example.com'], $adminrow); | CODE |
| 122 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | public/lang/en/ai.php | 96 | $string['contentwatermark'] = 'Generated by AI'; | CODE |
| HIGH | public/theme/boost/lib.php | 74 | // Add a watermark to indicate the image is AI generated, but only for the default image. | COMMENT |
| HIGH | …ement/courseassist/classes/external/summarise_text.php | 137 | 'The text generated by AI.', | CODE |
| HIGH | …acement/courseassist/classes/external/explain_text.php | 137 | 'The text generated by AI.', | CODE |
| HIGH | …ai/placement/editor/classes/external/generate_text.php | 132 | 'The text generated by AI.', | CODE |
| HIGH | public/lib/tcpdf/tcpdf.php | 17822 | // the last line must be shifted to be aligned as requested | COMMENT |
| HIGH | public/lib/tcpdf/tcpdf.php | 18773 | // the last line must be shifted to be aligned as requested | COMMENT |
| HIGH | public/lib/jquery/ui-1.14.1/jquery-ui.js | 8524 | // Format a name, short or long as requested | COMMENT |
| HIGH⚡ | …lic/lib/google2-service/src/AndroidPublisher/Image.php | 27 | * The content is not generated by AI. | COMMENT |
| HIGH⚡ | …lic/lib/google2-service/src/AndroidPublisher/Image.php | 31 | * The content is generated by AI and attested by the developer. | COMMENT |
| HIGH⚡ | …lic/lib/google2-service/src/AndroidPublisher/Image.php | 35 | * Optional. Whether the image was generated by AI. Attested by the developer. | COMMENT |
| HIGH | …lic/lib/google2-service/src/AndroidPublisher/Image.php | 66 | * Optional. Whether the image was generated by AI. Attested by the developer. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/course/classes/output/actionbar/initials_selector.php | 52 | // template expects HTML in its respective context properties. Ideally, children of comboboxsearch would leverag | COMMENT |
| MEDIUM | …blic/course/classes/output/actionbar/user_selector.php | 51 | // template expects HTML in its respective context properties. Ideally, children of comboboxsearch would leverag | COMMENT |
| MEDIUM | …lic/course/classes/output/actionbar/group_selector.php | 54 | // template expects HTML in its respective context properties. Ideally, children of comboboxsearch would leverag | COMMENT |
| MEDIUM | public/message/classes/api.php | 560 | // - subname: Essentially a subtitle for the conversation. So you'd have "name: subname". | COMMENT |
| MEDIUM | …ic/question/type/ddimageortext/tests/question_test.php | 98 | // check the calculation is robust to it. | COMMENT |
| MEDIUM | …heet/phpspreadsheet/src/PhpSpreadsheet/Reader/Xlsx.php | 883 | // But in some cases, this attribute isn't set; so we need to delve a level | COMMENT |
| MEDIUM | …c/lib/xhprof/xhprof_html/jquery/jquery.autocomplete.js | 342 | // try to leverage ajaxQueue plugin to abort previous requests | COMMENT |
| MEDIUM | …lic/lib/yuilib/3.18.1/datatable-sort/datatable-sort.js | 492 | // FIXME: Declaring inline override to leverage closure vs | COMMENT |
| MEDIUM | …b/yuilib/3.18.1/datatable-sort/datatable-sort-debug.js | 492 | // FIXME: Declaring inline override to leverage closure vs | COMMENT |
| MEDIUM | …ib/3.18.1/event-custom-base/event-custom-base-debug.js | 1779 | // TODO: More robust regex, accounting for category | COMMENT |
| MEDIUM | …b/yuilib/3.18.1/event-custom-base/event-custom-base.js | 1767 | // TODO: More robust regex, accounting for category | COMMENT |
| MEDIUM | public/lib/yuilib/3.18.1/view/view.js | 216 | // TODO: Make this more robust by using lazy-binding: | COMMENT |
| MEDIUM | public/lib/yuilib/3.18.1/view/view-debug.js | 216 | // TODO: Make this more robust by using lazy-binding: | COMMENT |
| MEDIUM | public/lib/jquery/jquery-3.7.1.js | 10665 | // understands anonymous AMD modules. A named AMD is safest and most robust | COMMENT |
| MEDIUM | …b/aws-sdk/src/data/appconfig/2019-10-09/api-2.json.php | 3 | return [ 'version' => '2.0', 'metadata' => [ 'apiVersion' => '2019-10-09', 'endpointPrefix' => 'appconfig', 'jsonVersion | CODE |
| MEDIUM | public/lib/amd/src/adapter.js | 1843 | // This is an ugly hack, but at the same time is way more robust than | COMMENT |
| MEDIUM | public/lib/htmlpurifier/HTMLPurifier/Generator.php | 230 | // Essentially, Internet Explorer, when calculating | COMMENT |
| MEDIUM | public/lib/htmlpurifier/HTMLPurifier/ChildDef/List.php | 71 | // ToDo: Make this more robust in the case of not ol/ul | COMMENT |
| MEDIUM⚡ | public/lib/editor/tiny/js/tinymce/tinymce.min.js | 10 | !function(){"use strict";var e=function(e){if(null===e)return"null";if(void 0===e)return"undefined";var t=typeof e;retur | CODE |
| MEDIUM⚡ | public/lib/editor/tiny/js/tinymce/tinymce.min.js | 10 | !function(){"use strict";var e=function(e){if(null===e)return"null";if(void 0===e)return"undefined";var t=typeof e;retur | CODE |
| MEDIUM | …blic/h5p/h5plib/v128/joubel/core/js/h5p-hub-sharing.js | 41 | */var r=n(0),o=n(15),a=n(40);function i(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<a | COMMENT |
| MEDIUM | …blic/h5p/h5plib/v128/joubel/core/js/h5p-hub-sharing.js | 41 | */var r=n(0),o=n(15),a=n(40);function i(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<a | COMMENT |
| MEDIUM | …h5p/h5plib/v128/joubel/core/js/h5p-hub-registration.js | 29 | */var r=n(0),i=n(7),o=n(21);function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<ar | COMMENT |
| MEDIUM | …h5p/h5plib/v128/joubel/core/js/h5p-hub-registration.js | 29 | */var r=n(0),i=n(7),o=n(21);function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<ar | COMMENT |
| MEDIUM | …/h5plib/v128/joubel/editor/ckeditor/translations/pt.js | 1 | !function(e){const a=e.pt=e.pt||{};a.dictionary=Object.assign(a.dictionary||{},{"(may require <kbd>Fn</kbd>)":"(pode exi | CODE |
| MEDIUM | …5p/h5plib/v128/joubel/editor/scripts/h5p-hub-client.js | 41 | */var r=n(0),a=n(22),i=n(36);function o(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<a | COMMENT |
| MEDIUM | …5p/h5plib/v128/joubel/editor/scripts/h5p-hub-client.js | 41 | */var r=n(0),a=n(22),i=n(36);function o(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<a | COMMENT |
| MEDIUM | public/mod/wiki/diff/difflib.php | 551 | // Yep! Definitely deleted. | COMMENT |
| MEDIUM | lib/bundles/react-dom/client.js | 15 | `).replace(fh,"")}function Qv(l,t){return t=J0(t),J0(l)===t}function Z(l,t,a,u,n,e){switch(a){case"children":typeof u==" | CODE |
| MEDIUM | lib/bundles/react-dom/client.development.js | 15 | `).replace(jS,"")}function g2(l,t){return t=zy(t),zy(l)===t}function j(l,t,a,u,n,c){switch(a){case"children":typeof u==" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | public/course/dndupload.js | 309 | * image we need to check if all the dataTransfers types are files. | COMMENT |
| LOW | public/admin/tool/usertours/amd/src/tour.js | 872 | // First, we need to check if the step's content contains any images. | COMMENT |
| LOW | public/admin/tool/mobile/classes/external.php | 535 | // We need to check if the functions being called are included in the service of the current token. | COMMENT |
| LOW | public/message/externallib.php | 3435 | // User is not a contact, so we need to check if the user is allowed to see the profile or not. | COMMENT |
| LOW | public/message/classes/api.php | 2089 | // We need to check if they are in the same course. | COMMENT |
| LOW | public/message/amd/src/message_drawer.js | 349 | // We need to check if we are on the message/index page. | COMMENT |
| LOW | public/message/amd/src/message_drawer_view_settings.js | 224 | // we need to check if this processor has been locked by the admin. | COMMENT |
| LOW | public/user/amd/src/comboboxsearch/user.js | 38 | // Register a couple of events onto the document since we need to check if they are moving off the component. | COMMENT |
| LOW | …blic/question/bank/managecategories/classes/helper.php | 56 | * category may appear empty. The purpose of this function is to detect the questions that | COMMENT |
| LOW | public/question/type/ordering/amd/src/drag_reorder.js | 270 | // After we have potentially moved the item, we need to check if the order has changed. | COMMENT |
| LOW | public/question/format/blackboard_six/formatqti.php | 800 | // The ddmatch question type is not part of core, so we need to check if it is defined. | COMMENT |
| LOW | public/question/format/blackboard_six/formatpool.php | 392 | // The ddmatch question type is not part of core, so we need to check if it is defined. | COMMENT |
| LOW | public/lib/accesslib.php | 983 | // So we need to check if the user has been marked as dirty or not in the cache directly. | COMMENT |
| LOW⚡ | public/lib/completionlib.php | 1377 | // Step 1: Exclude activities hidden from the user on the course page. | COMMENT |
| LOW⚡ | public/lib/completionlib.php | 1382 | // Step 2: Check if the user is excluded by group or grouping style restrictions. | COMMENT |
| LOW | public/lib/upgradelib.php | 1295 | // Now, we need to check if services were removed, in that case we need to remove the function from them. | COMMENT |
| LOW⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 171 | # Step 5: Create the list of signed headers. This lists the headers | COMMENT |
| LOW⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 181 | # Step 6: Create payload hash (hash of the request body content). For GET | COMMENT |
| LOW⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 185 | # Step 7: Combine elements to create canonical request | COMMENT |
| LOW | public/lib/classes/output/icon_system_fontawesome.php | 616 | // If the icon is not mapped, we need to check if it is deprecated. | COMMENT |
| LOW | public/lib/classes/navigation/global_navigation.php | 357 | // However we need to check if there is more content that can yet be loaded for the specific module | COMMENT |
| LOW | public/lib/classes/external/action_link_exporter.php | 100 | // If the text is a renderable, we need to check if it can be exported. | COMMENT |
| LOW | public/lib/grade/grade_category.php | 1331 | // We need to check if the grademax/min was adjusted per user because of excluded items. | COMMENT |
| LOW | public/lib/amd/src/local/reactive/debugpanel.js | 446 | // Step 1: Add all overrides newStateData. | COMMENT |
| LOW | public/lib/amd/src/local/reactive/debugpanel.js | 471 | // Step 2: delete unnecesary data from currentStateData. | COMMENT |
| LOW | …editor/tiny/plugins/aiplacement/classes/plugininfo.php | 131 | // For generate image, we need to check if the user has the capability to upload files. | COMMENT |
| LOW | public/lib/editor/tiny/plugins/premium/settings.php | 46 | // If the self-hosted package is selected, we need to check if the standalone path is set. | COMMENT |
| LOW | …ditor/tiny/plugins/media/amd/src/embed/embedhelpers.js | 331 | // So in order to check if attr="true", we need to check if the attribute exists and if the value is empty or true. | COMMENT |
| LOW | public/lib/editor/tiny/js/tinymce/models/dom/model.js | 6729 | * Because the resizers were moved into the editor for inline mode, we need to check if the event target | COMMENT |
| LOW | public/filter/tex/texdebug.php | 201 | // Step 3: Set convert or dvisvgm command. | COMMENT |
| LOW | public/h5p/classes/framework.php | 183 | * The purpose of this function is to map the strings used in the core h5p methods | COMMENT |
| LOW | public/mod/quiz/tests/lib_test.php | 215 | // Step 1: Create one course and a user with editing teacher capabilities. | COMMENT |
| LOW | public/mod/quiz/tests/backup/repeated_restore_test.php | 516 | // Step 1: Create two courses and a user with editing teacher capabilities. | COMMENT |
| LOW⚡ | public/mod/quiz/tests/backup/repeated_restore_test.php | 559 | // Step 2: Backup the quiz | COMMENT |
| LOW⚡ | public/mod/quiz/tests/backup/repeated_restore_test.php | 566 | // Step 3: Import the backup into the same course. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1248 | // Step 1: Verify no overrides initially. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1253 | // Step 2: Create an user override with both due date and cutoff date. | COMMENT |
| LOW | public/mod/assign/tests/external/overrides_test.php | 1270 | // Step 3: Get and verify override exists with correct properties. | COMMENT |
| LOW | public/mod/assign/tests/external/overrides_test.php | 1282 | // Step 4: Update the override (change due date, remove cutoff date). | COMMENT |
| LOW | public/mod/assign/tests/external/overrides_test.php | 1297 | // Step 5: Verify update took effect. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1318 | // Step 6: Delete the override. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1327 | // Step 7: Verify deleted from both API and database. | COMMENT |
| LOW | …lasses/external/get_h5pactivity_access_information.php | 76 | // For mod/h5pactivity:submit we need to check if tracking is enabled in the h5pactivity for the current use | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | public/lib/completionlib.php | 1377 | // Step 1: Exclude activities hidden from the user on the course page. | COMMENT |
| LOW⚡ | public/lib/completionlib.php | 1382 | // Step 2: Check if the user is excluded by group or grouping style restrictions. | COMMENT |
| LOW⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 171 | # Step 5: Create the list of signed headers. This lists the headers | COMMENT |
| LOW⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 181 | # Step 6: Create payload hash (hash of the request body content). For GET | COMMENT |
| LOW⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 185 | # Step 7: Combine elements to create canonical request | COMMENT |
| LOW | public/lib/amd/src/local/reactive/debugpanel.js | 446 | // Step 1: Add all overrides newStateData. | COMMENT |
| LOW | public/lib/amd/src/local/reactive/debugpanel.js | 471 | // Step 2: delete unnecesary data from currentStateData. | COMMENT |
| LOW | public/filter/tex/texdebug.php | 201 | // Step 3: Set convert or dvisvgm command. | COMMENT |
| LOW | public/backup/cc/cc_lib/cc_convert_moodle2.php | 76 | //Step 1 - Get the list and order of sections/topics | COMMENT |
| LOW | public/mod/quiz/tests/lib_test.php | 215 | // Step 1: Create one course and a user with editing teacher capabilities. | COMMENT |
| LOW | public/mod/quiz/tests/backup/repeated_restore_test.php | 516 | // Step 1: Create two courses and a user with editing teacher capabilities. | COMMENT |
| LOW⚡ | public/mod/quiz/tests/backup/repeated_restore_test.php | 559 | // Step 2: Backup the quiz | COMMENT |
| LOW⚡ | public/mod/quiz/tests/backup/repeated_restore_test.php | 566 | // Step 3: Import the backup into the same course. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1248 | // Step 1: Verify no overrides initially. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1253 | // Step 2: Create an user override with both due date and cutoff date. | COMMENT |
| LOW | public/mod/assign/tests/external/overrides_test.php | 1270 | // Step 3: Get and verify override exists with correct properties. | COMMENT |
| LOW | public/mod/assign/tests/external/overrides_test.php | 1282 | // Step 4: Update the override (change due date, remove cutoff date). | COMMENT |
| LOW | public/mod/assign/tests/external/overrides_test.php | 1297 | // Step 5: Verify update took effect. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1318 | // Step 6: Delete the override. | COMMENT |
| LOW⚡ | public/mod/assign/tests/external/overrides_test.php | 1327 | // Step 7: Verify deleted from both API and database. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | public/competency/tests/task/task_test.php | 88 | // The template is now hidden, and I've added a user with a missing plan. Nothing should happen. | COMMENT |
| HIGH | public/competency/tests/task/task_test.php | 195 | // The template is now hidden, and I've added a user with a missing plan. Nothing should happen. | COMMENT |
| HIGH | public/theme/yui_combo.php | 339 | // I've added this as a separate regex so it can be easily removed once | COMMENT |
| HIGH | public/theme/yui_combo.php | 356 | // I've added this as a separate regex so it can be easily removed once | COMMENT |
| HIGH | public/filter/urltolink/classes/text_filter.php | 55 | // I've added img tags to this list of tags to ignore. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | public/lib/js/esm/tests/deprecated.test.ts | 47 | // ── Validation ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/deprecated.test.ts | 75 | // ── Plain-text message ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/deprecated.test.ts | 116 | // ── Toast notification ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/deprecated.test.ts | 186 | // ── Final deprecation ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 81 | // ── request() ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 206 | // ── performGet ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 239 | // ── performHead ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 250 | // ── performPost ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 262 | // ── performPut ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 274 | // ── performPatch ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | public/lib/js/esm/tests/fetch.test.ts | 286 | // ── performDelete ───────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | public/lib/graphlib.php | 57 | 'title_font' => 'default.ttf', // title text font. don't forget to set 'path_to_fonts' above. | CODE |
| LOW | public/lib/graphlib.php | 66 | 'label_font' => 'default.ttf', // label text font. don't forget to set 'path_to_fonts' above. | CODE |
| LOW | public/lib/graphlib.php | 122 | 'axis_font' => 'default.ttf', // axis text font. don't forget to set 'path_to_fonts' above. | CODE |
| LOW | public/lib/graphlib.php | 145 | 'legend_font' => 'default.ttf', // legend text font. don't forget to set 'path_to_fonts' above. | CODE |
| MEDIUM | public/lib/dmllib.php | 35 | * (feel free to modify, improve and document such page, thanks!) | COMMENT |
| LOW | public/lib/form/listing.php | 47 | * Don't forget to escape your HTML as soon as one string comes from an input/external source. | COMMENT |
| LOW | public/lib/bennu/iCalendar_rfc2445.php | 233 | --$len; // Don't forget to update this! | CODE |
| LOW | public/lib/table/classes/sql_table.php | 76 | * After calling this function, don't forget to call close_recordset. | COMMENT |
| MEDIUM | …/src/SA360/GoogleAdsSearchads360V23ErrorsErrorCode.php | 8109 | * The plan is not enabled and API cannot provide mutation, forecast or stats. | COMMENT |
| MEDIUM | …2-service/src/DLP/GooglePrivacyDlpV2TimespanConfig.php | 125 | * tables#ingestion_time), you can use any of the following pseudo-columns as | COMMENT |
| MEDIUM | …lic/lib/google2-service/src/CustomSearchAPI/Search.php | 27 | * search/docs/refinements#create) (refinements) you can use for refining a | COMMENT |
| MEDIUM | …lic/lib/google2-service/src/CustomSearchAPI/Search.php | 57 | * search/docs/refinements#create) (refinements) you can use for refining a | COMMENT |
| MEDIUM | …blic/mod/glossary/formats/TEMPLATE/TEMPLATE_format.php | 102 | // Anyway, you can modify this to use your own print format!! | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …or/tiny/plugins/html/amd/src/beautify/beautify-html.js | 373 | // but still return True as though you had | COMMENT |
| HIGH | …/editor/tiny/plugins/html/amd/src/beautify/beautify.js | 1919 | // but still return True as though you had | COMMENT |
| HIGH | …tor/tiny/plugins/html/amd/src/beautify/beautify-css.js | 363 | // but still return True as though you had | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …lib/aws-sdk/src/data/bedrock/2023-04-20/api-2.json.php | 3 | return [ 'version' => '2.0', 'metadata' => [ 'apiVersion' => '2023-04-20', 'auth' => [ 'aws.auth#sigv4', 'smithy.api#htt | CODE |
| MEDIUM | …ganizationsLocationsWorkloadIdentityPoolsWellKnown.php | 36 | * discovery-1_0.html#ProviderConfigurationResponse). For now, only agentic | COMMENT |
| MEDIUM | …/OrganizationsLocationsWorkloadIdentityPoolsOpenid.php | 35 | * 7517](https://tools.ietf.org/html/rfc7517). For now, only agentic system | COMMENT |
| MEDIUM | …ource/ProjectsLocationsWorkloadIdentityPoolsOpenid.php | 35 | * 7517](https://tools.ietf.org/html/rfc7517). For now, only agentic system | COMMENT |
| MEDIUM | …ce/ProjectsLocationsWorkloadIdentityPoolsWellKnown.php | 36 | * discovery-1_0.html#ProviderConfigurationResponse). For now, only agentic | COMMENT |
| MEDIUM | public/lib/php-di/invoker/README.md | 136 | #### Built-in support for dependency injection | COMMENT |
| MEDIUM | public/lib/php-di/php-di/change-log.md | 255 | * [#162](https://github.com/PHP-DI/PHP-DI/pull/162) Added `Container::call()` to call functions with dependency injectio | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 159 | # Create a date for headers and the credential string in ISO-8601 format | COMMENT |
| MEDIUM⚡ | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 163 | # Create the canonical headers and signed headers. Header names | COMMENT |
| MEDIUM | …/google2-auth/src/CredentialSource/AwsNativeSource.php | 203 | # Create the signing key using the function defined above. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | public/lib/google2/README.md | 258 | POST https://datastore.googleapis.com/v1beta3/projects/YOUR_PROJECT_ID:runQuery?key=YOUR_API_KEY | CODE |
| HIGH | …blic/lib/editor/tiny/plugins/premium/readme_moodle.txt | 7 | The URL looks like this: https://cdn.tiny.cloud/1/YOUR_API_KEY/tinymce/VERSION/plugins.min.js | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | public/grade/edit/tree/index.php | 125 | //TODO: implement autosorting based on order of mods on course page, categories first, manual items last | COMMENT |
| LOW | public/lib/yuilib/3.18.1/dom-base/dom-base.js | 198 | // TODO: implement multipe select | COMMENT |
| LOW | public/lib/yuilib/3.18.1/dom-base/dom-base-debug.js | 200 | // TODO: implement multipe select | COMMENT |
| LOW | public/lib/grade/tests/grade_category_test.php | 722 | // TODO: implement detailed tests. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | public/lib/jquery/jquery-3.7.1.js | 4139 | function getData( data ) { | CODE |