Hi

If the quiz has a state not published, still is visible and can be taken by anonymous or logged users.
(create a quiz, set it as not published, copy its url into clipboard, and log off (or in another browser) go to this url as anonymous/logged users

Igor
somvprahe.sk

CommentFileSizeAuthor
#2 quiz_start_actions.patch773 byteskscheirer

Comments

greg_y’s picture

greg_y commented

Yes, found the same thing when looking at "track" for an unpublished quiz. An anonymous user had browsed through it.

Perhaps related -- when I log out and go to the quiz page, I see

You have already taken this Quiz 6 times.

... which the module shouldn't "know" if I'm logged out, right?

kscheirer’s picture

kscheirer
Primary language English
Location Vallejo
commented
Status: Active » Needs review
StatusFileSize
new quiz_start_actions.patch773 bytes

I think prevented people from taking unpublished quizzes is taken care of over here.

I think you're right though, that we shouldn't show the number of takes (or validate against it)
if you're an anonymous user. This patch should remove that check when you're not logged in.

kscheirer’s picture

kscheirer
Primary language English
Location Vallejo
commented
Status: Needs review » Fixed

commited to 5.x-1.x-dev

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)