atutor/atutor

NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.

ATutor Readme:

About

ATutor is a learning management system to continue professional development for teachers, career developers, and academic research. It is written in PHP in a cross platform operating system.

Features

Two accessibility features in the system are text alternatives for all visual elements and keyboard access to all elements of the program. With these features, a blind person can listen to the entire interface of the system with the help of a screen reader, and he or she can access the system without needing a mouse. These features also allow ATutor to adapt to a wide variety of technologies including cell phones, personal data assistants (PDAs), and text-based Web browsers, to name a few. ATutor is also designed for adaptability to any of several teaching and learning scenarios. There are four main areas that reflect this design principle: themes, privileges, tool modules, and groups

Installation

To install ATutor, point your web browser to the installation directory where ATutor was extracted, and follow the Installer's instructions. e.g. http://localhost/ATutor

For full installation instructions see: https://atutor.github.io/atutor/docs/installation

Installing from a Github Clone

1. Fork ATutor into your own Github account, at: https://github.com/atutor/ATutor

2. Clone ATutor from the fork you created into the document root of your webserver (for convenience), with:git clone https://github.com/yourname/ATutor.git

3. Before running the Installer, create an empty config.inc.php file in the ATutor/include/ directory. If you have a command line to work from, while located in the ATutor directory, create the file with: touch include/config.inc.php

4. Follow the installation instructions at the link above.

5. Or, follow the instructions given by the ATutor Installer.

How to contribute

If you want to contribute to ATutor follow the instructions below or on https://atutor.github.io/atutor/docs/dev_with_github.html

1. Fork the repository and create clone
2. Create a new branch to work in
3. Edit and create new files within your new branch
4. Make sure your branch is up to date with the master branch
5. Merge pull requests into master branch

For additional ATutor documentation, see the ATutor Handbook in ATutor, or at the following links:

• Administrators https://atutor.github.io/atutor/handbook/admin.html

• Instructors: https://atutor.github.io/atutor/handbook/instructor.html

• Users: https://atutor.github.io/atutor/handbook/users.html

Developers

• Inclusive Design Research Centre
• OCAD University
• ATutorSpaces

License

GPL

Website Link

Report Issues

---

Have fun, and take it places!

-Greg

atutor's Issues

"Debugging boxes" showing on atutor 2.2.4

See attached files, thanks!

about homework

Why the students can't see the homework in the page of course?And there is the same situation in the test.

ATutor-Cross-Site Scripting (XSS)

Product: ATutor
Download: https://github.com/atutor/ATutor
Vunlerable Version: 2.2.2 and probably prior
Tested Version: 2.2.2
Author: ADLab of Venustech

Advisory Details:
Cross-Site Scripting (XSS) were discovered in“ATutor 2.2.2”, which can be exploited to execute arbitrary JS code.

The parameter "url" in the file /ATutor/mods/_standard/rss_feeds/edit_feed.php is unsafe, we can bypass the XSS filter.An attacker could execute arbitrary JS code in a browser in the context of the vulnerable website.
The exploitation examples below use the "alert()" JavaScript function to see a pop-up messagebox:
the poc is : =file%3A%2F%2F%2Fetc%2Fpasswd+%3C%3E%3Cimg+src%3Dxx+onerror%3Dalert%281%29%3E

Can't Create a course

Hello sir, the system is working fine on my local machine, but after hosting it online, i am experiencing this error when i try to create a course. Other actions such as updating profile, creating categories i am able to perform them, but when i create a course, i get the error!

"Forbidden
You don't have permission to access /mods/_core/courses/admin/create_course.php on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request."

Atutor can't login

Atutor can't login using other browsers except chrome on my mac. I can only login using google chrome. Other browsers such as safari, firefox are not working at all. Also i can't login with more than one users at the time. I am running Atutor version 2.2.3.

Unable to use Atutor Demo

Hello,

When login to Atutor 2.2.4 Demo at https://atutor.github.io/atutor/demo.html it returns me an error 405 Not Allowed.

Best regards.

AChecker errors out when trying to check Wordpress pages

AChecker errors out when trying to check Wordpress pages. Running a check results in the error "achecker.ca is currently unable to handle this request. HTTP ERROR 500".

Note, the error does not appear when checking a basic HTML/HTML5 page.

Can I delete export folder in atutor

Hi, I have ATutor 2.1 and my content/export folder is too big (2.4 T). Do I need this folder or I can delete it?

Unable to create a course or lesson categories

When I try to create a new category, it requires that I enter a "parent category," since this is a new install, there isn´t one, and I am unable to create a parent category. I have looked but cannot find documentation on how to do so. Is this a glitch, or a documentation issue?
Thanks.

Know if I need to update ATutor version .2 to .3-b1

Dear Greg,

I am using version 2.2.2 from the date of its release. There are some details that have been left poendientes to solve for "future updates". Please, I need to know if it's worth it in my case install the new version 2.2.3-b1

I consult if these problems that I have in my installation (2.2.2) are solved in the new update 2.2.3-b1:

1. Subject treated at http://www.atutor.ca/view/7/26216/1.html on 2017-03-29

Is it resolved in 2.2.3-1b as it says http://www.atutor.ca/atutor/mantis/view.php?id=5779? In "VIEW STATUS" it continues to appear as "OPEN"

2. Subject treated on 2017-02-27 at http://www.atutor.ca/view/7/26178/1.html

The "patch 10" has not solved the problem of the quotes.

Is it solved, according to what you see in www.atutor.ca/atutor/mantis/view.php?id=5762? Keep figuring as

I, at least, do not find other problems in version 2.2.2 but they are important for me because these are issues that are used a lot in my courses and I usually have students confused with these problems.

3. Can I install the Spanish language pack "atutor_2_2_2_es-es.zip" that I have exported from my current installation to my PC? During the last months I was making several adjustments with the editor of the language that I would like to avoid having to do again in the new installation.

4. Will the version of ATutor 2.2.3-b1 work well, although the version of PHP that I am using in my vps is 5.3.3?

I wish you a very happy year 2018!

Best Regards,

Mario

Fresh install NoGo with zip pgk got info screen this time.

with the tar.gz all I got was couldn't access database screen install went thru
with zip i got info screen all went well with the install script
see attached
infoscreen.txt

ATutor Backup Arbitrary File uploads

Dear ATutor,

I have found an issue with ATutor 2.2.4 and prior that allows users to upload arbitrary files and can result in remote code execution. The specific method that I have found uses the instructor account and the Backup function. https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-File I realize there is a similar issue in CVE-2019-11446 but I just wanted to make sure that you are aware.

Best regards

Error 500 when install any new module

Hi, so I tried to install openmeeting and certify modules, but whenever I had uploaded these zip files through GUI module installation of Atutor, pressed Yes to install and things started to go wrong.
Here is the screenshot:

I hope that this will be previewed and helped as soon as possible. Thank you very much

Fill-in-the-blank questions

Somebody asked me to do this for their installation of ATutor. Would there be interest in this? I'd gladly offer a pull request...

Potential security issue

Hi, I think I have found a potential security issue in your codebase. Have you got an email address I can contact you on rather than disclosing it publicly? Thanks.

Possible bug in source code (CWE-480)

Hello!

We've checked your code with AppChecker static analyzer and found possible bug:

ATutor/themes/mobile/admin/index.tmpl.php

Line 1 in ded49bd

<?php global $_config; $_config_defaults;?>

ATutor/themes/simplified_desktop/admin/index.tmpl.php

Line 1 in ded49bd

<?php global $_config; $_config_defaults;?>

<?php global $_config; $_config_defaults;?>

$_config_defaults is not in global section, it's on its own.

Possible defect was found by Echelon Team with AppChecker static analyzer

Two 'case' with same condition

Hi!
Please look this fragment:

switch($name) {
...
			case 'setvar':
				$this->attributes[$this->item_num][$name]['varname'] = $attributes['varname'];
				break;
....
			case 'setvar':
				$this->attributes[$this->item_num][$name]['varname'] = $attributes['varname'];
				$this->attributes[$this->item_num][$name]['action'] = $attributes['action'];
				break;
...
}

It's suspicious that 'setvar' is checked twice.

---

This possible defect found by AppChecker
References:
CWE-561: Dead Code

Atutor 2.2.4 module install issue

I have recently downloaded ATutor 2.2.4 and installation went successfully. There were no errors. Now as an admin I want to install scorm_package module to support scorm courses. I downloaded the package from ATutor website and try to install it. I got the following errors every time when I hit the install button.

How to solve this error?

Is ATutor and ATutorSpaces Closing?

ATutor is not closing, though its changing. atutor.ca is moving to atutor.github.io

ATutorSpaces is closing as of July 31, 2018.

If you have questions or comments, this is the place to post them

about Atutor installation

when the installation go to the step 1,I choose the button "I agree".But there is a blank page on the screen.What should I do? By the way ,on the step 0,all the condition have been satisfied

Cómo hago esta configuración? Ayuda, Please.

Buenas noches, un placer saludarles. La presente es para comunicarles que realice todos los pasos de instalación de Atutor 2.2.4 y al final cuando inicio sesión como administrador me sale este mensaje: La configuración del correo no está configurada correctamente. Es posible que no pueda enviar correos electrónicos. Quisiera que me orientaran por favor para solucionar este problema, muchas gracias de antemano.

WCAG 2.1 Accessibility Criteria

Does ATutor comply with the following Success Criteria? Thanks in advance.

Success Criterion 2.1.4 Character Key Shortcuts (Level A): If a keyboard shortcut is implemented in content using only letter (including upper- and lower-case letters), punctuation, number, or symbol characters, then at least one of the following is true:
Turn off
A mechanism is available to turn the shortcut off;
Remap
A mechanism is available to remap the shortcut to use one or more non-printable keyboard characters (e.g. Ctrl, Alt, etc);
Active only on focus
The keyboard shortcut for a user interface component is only active when that component has focus.

Success Criterion 1.4.12 Text Spacing (Level AA): In content implemented using markup languages that support the following text style properties, no loss of content or functionality occurs by setting all of the following and by changing no other style property:
• Line height (line spacing) to at least 1.5 times the font size;
• Spacing following paragraphs to at least 2 times the font size;
• Letter spacing (tracking) to at least 0.12 times the font size;
• Word spacing to at least 0.16 times the font size.

File manager does not retrieve upload imagenes

Hi everyone.
I am novice in ATutor and my first language is not English.

This is the only place i found to ask for help. If not, I apologize.

I am experiencing a problem when editing a new course. When I am trying to upload a image using File Manager, the image is successfully uploaded however the file is not accesible in preview view. The link reads something like /atutor/get.php/filename.png As result, I can't use any file uploaded in my course.

For example the links reads:
http://localhost/atutor/get.php/filename.jpg
However, the imagen is located(The file was successfully uploaded) in the next directory:
define('AT_CONTENT_DIR', 'C:\xampp\htdocs\atutor\content\\');

I used XAMPP to install ATutor in Windows, the features are:

ATutor Version: 2.2.3(unknown - 2018-01-17 19:55:56). Check Latest Version.
PHP Version: 7.1.12
MySQL Version: 10.1.29-MariaDB
OS: Windows NT 6.1

Feel free to answer me.

Public checker offline

Been down for months according to wayback machine: http://www.achecker.ca

ATutor password reset link vulnerability

Hello,

I've found a vulnerability in the password reset link functionality, using a weak calculated hash based on a few guessable parameters. This leads to hijacking student/course accounts.
Would like to share the details: how would you like to receive these?

Security Vulnerability

Hi where can i report security Vulnerabilities?

I can't install the ATutor database on ubuntu 20.04

Hi, everybody.

I'm installing ATutor on a virtual machine with Ubuntu Server 20.04, I got an error with UTF8, I checked a previous thread but it doesn't give the solution to the problem, can you help me please?

I made the database with code, it didn't work, I created it with PhpMyAdmin, it didn't work either, in both cases the database was created successfully, I send you the images, of the error and the creation of the database with PhpMyAdmin.
The Server version: Apache/2.4.41 (Ubuntu), Server built: 2020-04-13T17:19:17
The mysql Ver 8.0.20-0ubuntu0.20.04.1 for Linux on x86_64 ((Ubuntu))

Regards

Persistent cross site scripting and file upload attacks possible in course management

Persistent cross site scripting and file upload attacks possible in course management

Course management is lacking input validation in many places that allows stored XSS attacks and malicious file upload.
Following are the vulnerable regions:

1. Create course:
   The course name is not validated that allows to inject a javascript query into the name field.
   Steps to reproduce:

• Instructor A creates a course with a script in course name as follows: <script>alert('CourseAlert');</script>
• Another script in banner. <script>alert('BannerAlert');</script>
• Login as admin.
• When you click on courses, the ‘CourseAlert’ pops up.
• Every time the course profile is checked by the student, the ‘BannerAlert’ also pops up.
  Severity is high as admin could be attacked with a malicious script.

2. File Upload in course
   There are illegal file extensions mentioned where all the executable files are checked. But a file without any extension is accepted. This could be a binary executable file.
   Filename - It is possible to mount a javascript into this variable. Filename is not validated.
   File content - An attacker can write a malicious script into the file content and upload.

Steps to reproduce:

• Instructor A goes to his course and then go to file storage.
• Clicks on create a new file.
• The file name is given as : <script>alert('File1');</script>
• The file content is given as <script>alert('Filecontent');</script>
• Now a student/Admin logs in. As soon as a page displaying file name comes, the script File1 gets popped up even without clicking on it.
• If the content is downloaded, the alert Filecontent pops up.

This is of very high severity as this allows an instructor to post a virus as a file upload. Every student gets attacked. Even the administrator while accessing the course get attacked if the attack is mounted.

Solution:
Against XSS: Input validation using htmlspecialchars()
Against file upload: Use a white list of extensions that are allowed to be uploaded rather than extensions that are not allowed (black list).

xml_parse PHP7 fails

PHP7 returns a string of first letters from each question, where an array of questions was returned for earlier versions of PHP.

ATutor/mods/_core/imsqti/classes/QTIParser.class.php

Line 70 in 4a98b97

xml_parse($this->parser, $xml_data, TRUE);

Stored XSS in "Real Name" field - My Account

Description -
There's no escape being done before printing out the value of Real Name in the My Account page.

ATutor version - v2.2.4

Steps to reproduce -

• Navigate to http://localhost/atutor/mods/_core/users/admins/my_edit.php & add the below-shared payload as the value to the Real Name field.
  Payload -admin<img src=xss onerror=alert(1)>

• Visit page http://localhost/atutor/mods/_core/users/admins/index.php, the payload will be triggered.

Reflected XSS

I found Reflected XSS:
http://pwnme.me/atutor/browse.php?access=&search=%3Cscript%3Ealert(1);%3C/script%3E

atutor trial version

Hi ! I'm student on Informatics and with some colleague we work on creating course in atutor but we can't work with your demo which is given in atutor page , can you please give us some trial version to work on our project ?

I got the following error while browsing courses with private, public and protected access.

I am using ATutor 2.2.4 version and when I try to browse a course from the public side with private, protected and public access, it displays the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''public' AND cat_id <>-1 AND 1 AND hide=0 ORDER BY title' at line 1
SELECT * FROM hcp_courses WHERE access ='public' AND cat_id <>-1 AND 1 AND hide=0 ORDER BY title (AT_ERROR_DB_QUERY)

// I tried a lot to fix it but I do nothing. please help me. Thank you in advance for your time to fix this issue.
Regards,
Sirak

Arbitrary password reset of any account possible!

Hi there,

I found a critical security vulnerability in your software and would like to speak to someone to tell you what I found and how I think this can be fixed.

False Javascript fail test

If the ". in include_path" test fails, it automatically means, that also the "Javascript Enabled?" test fails, but this is false result, because Javascript is enabled in the browser. If you enable ". in include_path", both tests are OK.
I suggest either change the test for the Javascript so it is not dependent on the ". in inluclude_path", or don't show the Javascript test result if the ". in include_path" fails.

CVE-2015-7711

Is this vulnerability already fixed?

http://karmainsecurity.com/KIS-2015-07

Fresh install NoGo

I just tried a fresh install of 2.2.4
Debian 8 MYSQL client api ver 5.5.60 MYSQLI client api ver 5.5.60
pdo_mysql client API version | 5.5.60

The following errors occurred:
ATutor was unable to access the database. If the problem persists, please report this to an Administrator with this date reference (08/04/2018 05:23:52 am )

The install script completed successfully and the database tables were all successful.
tried twice, first time setting database up with atutor as user p/w and again via root user same result.
letting you know

There are no languages installed!

A fresh ATutor installation succeeds, but when I try to access the login page the only message displayed is the one listed in the title above. (There are no languages installed!)

I checked the language table and language_text table, they're both populated. The language table has only en, and the language_text table has plenty of en keyed rows.

The environment is:
Win10
IIS8
PHP7.1.7
MySQL 5.7.19
There is no public access address to provide, as this is a local test instance to decide whether Atutor will work for our needs.

I debugged a little, but was unfortunately able to figure out what was going on without spending more time than I have. PHP errorlog attached.
PHP71x64_errors.zip

Proper use of COUNT(*) in queryDB

Hi,

If I run a command-

queryDB("SELECT COUNT(*) FROM ...", array(...), true), I get the following response.

array(1) {
  ["COUNT(*)"]=>
  string(1) "1"
}

Is there a way to get just the result of the query as the response?

uninstall

how could I uninstall the ATutor,and install a new version?

Achecker issue

This issue was moved here:

inclusive-design/AChecker#102

Problems installing ATutor

I'm getting problems with many PHP warnings. Failing at step 3 connecting to the database. I've tried numerous PHP versions and not working. Tried 7.3, 7.2, 7.1, 5.1.

This is ATutor 2.24

I keep getting;
Warning: mysqli::__construct(): (HY000/1045): Access denied for user 'USERAT'@'172.16.30.150' (using password: YES) in /misc/2/000/251/769/7/user/web/hte-academy.com/include/lib/mysql_connect.inc.php on line 18

Warning: mysqli::set_charset(): Couldn't fetch mysqli in /misc/2/000/251/769/7/user/web/hte-academy.com/include/lib/mysql_connect.inc.php on line 20

Warning: mysqli::query(): Couldn't fetch mysqli in /misc/2/000/251/769/7/user/web/hte-academy.com/include/lib/mysql_connect.inc.php on line 333

Fatal error: Uncaught Error: Call to a member function fetch_assoc() on bool in /misc/2/000/251/769/7/user/web/hte-academy.com/include/lib/mysql_connect.inc.php:334 Stack trace: #0 /misc/2/000/251/769/7/user/web/hte-academy.com/include/install/install.inc.php(426): at_db_version(Object(mysqli)) #1 /misc/2/000/251/769/7/user/web/hte-academy.com/install/include/step2.php(19): create_and_switch_db('sqlXX.bravehost...', '3306', 'USER', 'PASS', NULL, 'DBNAMET_XXX', true) #2 /misc/2/000/251/769/7/user/web/hte-academy.com/install/install.php(45): require('/misc/2/000/251...') #3 {main} thrown in /misc/2/000/251/769/7/user/web/hte-academy.com/include/lib/mysql_connect.inc.php on line 334

I've removed my usernames, passwords, etc.

Custom course icons when browsing

Custom course icons are not showing up on the browse page in ATutor. They whowup ok on my start page.

Encuesta

A continuación se le presenta una encuesta en la cual se le solicita que responda cada una de las preguntas con una X dentro de los corchetes.

                                                    LA TECNOLOGÍA EN EL SIGLO XXI

1. ¿Cuál de los siguientes artefactos posee en su casa?

   [ ] PC` de escritorio
   [ ] NotebookS
   [ ] Netbook
   [ ] Reproductor de DVD
   [ ] Grabador/Reproductor de VHS

2. Si posee PC, Notebook o Netbook: ¿Posee conexión a Internet en su casa?
   [ ] SI [ ] NO

3. ¿Hace cuánto tiempo adquirió su PC o Notebook?
   [ ] Menos de un mes
   [ ] entre uno y tres meses
   [ ] entre tres meses y un año
   [ ] más de un año
   [ ] Otro (Por favor especifique)

4. ¿Quienes de los siguientes habitantes del hogar utilizan con mayor frecuencia la PC?
   [ ] Niños entre 5 y 10 años
   [ ] Niños entre 11 y 13 años
   [ ] Adolescentes entre 13 y 17 años
   [ ] Jóvenes entre 18 y 25 años
   [ ] Mayores de 25 años

5. ¿Controla los hábitos de navegación por internet de sus hijos?
   [ ] SI
   [ ] NO
   [ ] NO, no lo considero necesario
   [ ] NO, considero que no debo controlarlos

                                                                      GRACIAS 
   

Level headings

Hello everyone

Im trying to provide descriptive headings in the text editor so I am using the format option for level heading: Header 2, Header 3, ....., and paragrah

My problem: In the visualization of the content, the Page Contents area don`t show correctly the html code (levels and paragrahps).

I atach the pictures to describe the error.

Thanks a lot for help me.

Image 1: HTML Code

Image 2: Visualization Page Content area (Not Ok - it is my problem)

Image 3: Visualization Body area (Ok)

downloaded file from atutor.ca shows this error

This fatal error can be quite discouraging for newcomers of this software...
Fatal error: Call to a member function fetch_array() on boolean in F:\xampp\htdocs\atutor\include\lib\mysql_connect.inc.php on line 153
--I don't seem to figure out why this error is popping out??
But, the STRANGEST THING is that:
the github file when installed & run, doesn't show this error.

---

Still I want to know why this error (as solving errors is good) is showing??
my Action: I've merged the github 'mysql_connect.inc.php' file to the atutor.ca file, but no work yet !!

Step 3 error message

Unable to connect to DB error in step 3 of ATutor 2.2.3 installation may be caused by the following change in the installer

0f5c184

problem in farsi language pack

Hi. I have upgraded from ATutor 2.1.1 to ATutor 2.2.2 and installed atutor-2-2-2-fa as a second language. But my farsi courses are not showing correctly. I also change my database charset to utf8 with no change. Would you please let me know what should I do as most of our courses is in farsi language and converting them manually is so hard and time consuming.

Error deleting/remaning files

Hi everyone.

I upload some files (pictures *.png, *.jpg) through file manager.

The problem: I can not delete or rename these files. I atach the images to support it.

I am using:

ATutor 2.2.2
XAMPP 5.6.33: Apache 2.4.29, MariaDB 10.1.30, PHP 5.6.33

1. Delete file YES/NO

2. Error message

ATutor – Multiple Cross-Site Scripting (XSS)

Product: ATutor
Download: https://github.com/atutor/ATutor
Vunlerable Version: 2.2.2 and probably prior
Tested Version: 2.2.2
Author: ADLab of Venustech

Advisory Details:
Multiple Cross-Site Scripting (XSS) were discovered in“ATutor 2.2.2”, which can be exploited to execute arbitrary code.
The vulnerabilities exist due to insufficient filtration of user-supplied data in the “lang_code” HTTP GET parameter passed to “ATutor-master/themes/default/admin/system_preferences/language_edit.tmpl.php” ，“ATutor-master/themes/mobile/admin/system_preferences/language_edit.tmpl.php” and “ATutor-master/themes/simplified_desktop/admin/system_preferences/language_edit.tmpl.php”urls. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
The exploitation examples below use the "alert()" JavaScript function to see a pop-up messagebox:
Poc:
(1)
http://localhost/.../ATutor-master/themes/default/admin/system_preferences/language_edit.tmpl.php?lang_code=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22
(2)
http://localhost/.../ATutor-master/themes/mobile/admin/system_preferences/language_edit.tmpl.php?lang_code=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22
(3)
http://localhost/.../ATutor-master/themes/simplified_desktop/admin/system_preferences/language_edit.tmpl.php?lang_code=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22