Totara Release Notes

Emergency release of 2.9.1.1, 2.7.9.1, 2.6.26.1, and 2.5.33.1

Security releases for Totara 2.9.2, 2.7.10, 2.6.27, 2.5.34, 2.4.37, and 2.2.44 released 15th December 2015
Totara 2.9.3, 2.7.11, 2.6.28, 2.5.35, and 2.4.38 released 18th January 2016

Emergency release

A regression has been found that was introduced in 2.9.1, 2.7.9, 2.6.26, and 2.5.33 by TL-6981.
This regression is of high impact and scale, as such an emergency release is now being prepared.
This release will contain ONLY the fix for this regression, all other scheduled fixes will be left until the minor release next week.
Details of the regression will follow.
We strongly recommend that any customer using one of these releases upgrades as soon as possible.
If you have not yet upgraded please skip the current 2.9.1, 2.7.9, 2.6.26 and 2.5.33 releases.

As soon as the 2.9.1.1, 2.7.9.1, 2.6.26.1, and 2.5.33.1 packages have been made available for download the old 2.9.1, 2.7.9, 2.6.26, and 2.5.33 packages will be removed to avoid accidental deployment of these releases.

Description of TL-8096:

In the following situation when the user completes the first activity in a course all other activities in the course will be incorrectly marked as complete.

The above occurs when:

The course contains multiple activities.
The course does NOT contain the course completion status block. (this condition was included originally in error - existence of the block does not prevent this issue)
One or more activities are required for course completion.
The user completes the first activity by completing all criteria.
It occurs if the completion criteria for the activity leads to a grade being written for the activity. If the activity requires the user view the activity or requires the user manual self completion then the issue will not be experienced.

Then all activities in the course will be incorrectly marked complete.

Due to the how course can require activity completion in order to be complete, and likewise how programs and certifications require courses to complete the effect of incorrectly completing all activities can affect course completion, program completion and certification completion:

If the course requires one or more activities to be complete and does not have any other criteria then as all activities have now being marked complete the course will also be marked complete.
If the course is part of a program or certification and the user who has now incorrectly complete there course was working on a course set in which this was the only course or all other courses in the course set had been completed then the course set would be considered complete.
If this was the only course set in the program or certification or if this was the last course set in the program or certification that the user had to complete then the program or certification would be marked complete.

Solution:

The wrong variable was used in two places when fixing TL-6981. To fix the issue we substitute the current variable being used for the correct variable, the variable that was supposed to have been used.
To ensure this does not happen again unit tests have been extended to cover this case, improving our automated test coverage activity completion.

Using the wrong variable was leading the the user cache containing incorrect information.

For those affected:

Incorrect activity completion and incorrect course completion can be reset by giving the user an RPL for the activity/course and then immediately removing the RPL.
- Browse to Course administration -> Reports -> Course completion
- Mark the activity or course complete by RPL
- Remove the RPL
- Refresh the page and the state will have corrected itself.
Incorrect programs and certifications cannot currently be corrected. We are working on a tool that will be integrated to the affected stable branches that will allow the admin to manipulate the completion state for a user. If you have affected programs/certifications please let us know so that we can advise you when the tool has been released and so that we are aware of the scope of this problem.

Affected versions:

2.9.1. 2.7.9. 2.6.26. 2.5.33 released 16th November 2015.

Fixed versions:

2.9.1.1, 2.7.9.1, 2.6.26.1, 2.5.33.1 released 8th December 2015.

Patch:

Kind regards
Sam Hemelryk

(Edited by Simon Coggins (CTO) - original submission Wednesday, 9 December 2015, 4:19 AM)

Permanente link

The Totara 2.9.1.1, 2.7.9.1, 2.6.26.1, and 2.5.33.1 emergency releases have now been made.

Details of the issue that lead to this emergency release can be found in the post above.
We strongly recommend any sites using the affected versions upgrade immediately.

The change logs are as follows:

Release 2.9.1.1 (9th December 2015):

Bug fixes:

    TL-8096        Fixed course module completion calculation

                   This fixes a regression introduced by TL-6981 in 2.9.1, 2.7.9, 2.6.26, and
                   2.5.33 in which the calculation of course module completion would lead to
                   all activities being marked complete incorrectly for a user.
                   The problem occurs when the user completes the first activity in the
                   course. It occurs if the user manually marks themselves complete, achieves
                   the completion criteria (with the exception of "Student must view this
                   activity to complete it"), or is marked complete by a trainer. The user
                   must then log out and log back in again in order to see the problem.
                   The problem will not occur if it is not the first activity in the course.
                   When this occurs all activities in the course will be marked complete,
                   regardless of which section or order they are within the course and
                   regardless of whether they are required for course completion or not.

Release 2.7.9.1 (9th December 2015):

Bug fixes:

    TL-8096        Fixed course module completion calculation

                   This fixes a regression introduced by TL-6981 in 2.9.1, 2.7.9, 2.6.26, and
                   2.5.33 in which the calculation of course module completion would lead to
                   all activities being marked complete incorrectly for a user.
                   The problem occurs when the user completes the first activity in the
                   course. It occurs if the user manually marks themselves complete, achieves
                   the completion criteria (with the exception of "Student must view this
                   activity to complete it"), or is marked complete by a trainer. The user
                   must then log out and log back in again in order to see the problem.
                   The problem will not occur if it is not the first activity in the course.
                   When this occurs all activities in the course will be marked complete,
                   regardless of which section or order they are within the course and
                   regardless of whether they are required for course completion or not.

Release 2.6.26.1 (9th December 2015):

Bug fixes:

    TL-8096        Fixed course module completion calculation

                   This fixes a regression introduced by TL-6981 in 2.9.1, 2.7.9, 2.6.26, and
                   2.5.33 in which the calculation of course module completion would lead to
                   all activities being marked complete incorrectly for a user.
                   The problem occurs when the user completes the first activity in the
                   course. It occurs if the user manually marks themselves complete, achieves
                   the completion criteria (with the exception of "Student must view this
                   activity to complete it"), or is marked complete by a trainer. The user
                   must then log out and log back in again in order to see the problem.
                   The problem will not occur if it is not the first activity in the course.
                   When this occurs all activities in the course will be marked complete,
                   regardless of which section or order they are within the course and
                   regardless of whether they are required for course completion or not.

Release 2.5.33.1 (9th December 2015):

Bug fixes:

    TL-8096        Fixed course module completion calculation

                   This fixes a regression introduced by TL-6981 in 2.9.1, 2.7.9, 2.6.26, and
                   2.5.33 in which the calculation of course module completion would lead to
                   all activities being marked complete incorrectly for a user.
                   The problem occurs when the user completes the first activity in the
                   course. It occurs if the user manually marks themselves complete, achieves
                   the completion criteria (with the exception of "Student must view this
                   activity to complete it"), or is marked complete by a trainer. The user
                   must then log out and log back in again in order to see the problem.
                   The problem will not occur if it is not the first activity in the course.
                   When this occurs all activities in the course will be marked complete,
                   regardless of which section or order they are within the course and
                   regardless of whether they are required for course completion or not.

Kind regards
Sam

Permanente link | Ouder tonen

It has been reported that the recently provided emergency release packages for 2.9.1.1, 2.7.9.1, 2.6.26.1, and 2.5.33.1 contain unnecessary files.

These unnecessary files are extra hidden OSX system files that do not cause any functional problems but should not have been included in the release packages.

We are currently rebuilding and uploading new packages to Fetchapp.

Please note the emergency release numbers will not change but the rebuilt packages will exclude the unnecessary files.

We apologize for the inconvenience.

Regards,

Scott Blair

Permanente link | Ouder tonen

The emergency release packages for 2.9.1.1, 2.7.9.1, 2.6.26.1, and 2.5.33.1 have been rebuilt and uploaded to Fetchapp.

The new packages, which do not contain the unnecessary files, can be accessed and downloaded via the links in the original Fetchapp email.

The following list of files and sha1 sums can be used to confirm you have the latest version.

a3d0d1823b1520548ba0663ddaeddb11a980ba23 totaralms-2.5.33.1.tar.gz
7bf637700bb5589cfd790f586d57063d5b80252e totaralms-2.6.26.1.tar.gz
4bc96b645af4f20fc53300f49ae3f38010f9e3c1 totaralms-2.7.9.1.tar.gz
b8b006d8107fd1b6771b7a8a2aba8cd58ff6e52b totaralms-2.9.1.1.tar.gz

As additional confirmation you should not see any files such as ._admin, ._auth, ._availability, etc. upon visual inspection of the contents of the unzipped packages.

We apologize again for the inconvenience.

Regards,

Scott Blair

Permanente link | Ouder tonen