Totara Release Notes

Security releases for Totara 2.9.4, 2.7.12, 2.6.29, 2.5.36, 2.4.39, and 2.2.45 released 22nd February 2016

 
Sam Hemelryk
Security releases for Totara 2.9.4, 2.7.12, 2.6.29, 2.5.36, 2.4.39, and 2.2.45 released 22nd February 2016
di Sam Hemelryk - Sunday, 21 February 2016, 19:08
Gruppo Totara

Hello everyone,

The following versions of Totara have now been released:

  • 2.9.4
  • 2.7.12
  • 2.6.29
  • 2.5.36
  • 2.4.39
  • 2.2.45

These versions do contain security fixes and for this reason we strongly recommend upgrading. Each release also includes bug fixes and improvements. Thanks to the following people for their contributions to this release:

  • Eugene Venter at Catalyst NZ - TL-7542, TL-8276
  • Hamish Dewe at Orion Health - TL-8371
  • Jo from Kineo - TL-8392

Kind regards
Sam Hemelryk

Release 2.9.4 (22nd February 2016):

Security issues:

    TL-8235        Included session key check in Face-to-face when adding and removing attendees
    TL-8392        Fixed handling of non-numeric answers to numeric feedback activity questions

New features:

    TL-8115        Added a new URL custom field type

                   This new custom field type can be used in Courses, Hierarchies, Goals and
                   Face-to-face.


Improvements:

    TL-7542        Added a new report source for language customisations
    TL-7970        Added the program and certification completion editor

                   Enabled with Site administration -> Advanced features -> Enable program
                   completion editor. Only users with the 'totara/program:editcompletion'
                   capability (site admins only, by default) will be able to access the new
                   tab 'Completion' when editing a program or certification. For more
                   information, see the community post:
                   https://totara.community/mod/forum/discuss.php?d=11040.

    TL-8276        Removed unused CFG settings from Totara messaging code

                   The removed settings are "message_contacts_refresh", "message_chat_refresh"
                   and "message_offline_time".

    TL-8290        Increased maximum value of sortorder field in the Feedback360 questions table.   

                   When running MySQL in particular, the number of questions in one Feedback
                   questionnaire would be limited to 128. This was due to the sortorder field
                   in the corresponding table being of the type tinyint. This sortorder field
                   will now use the bigint datatype for all supported databases, which is
                   consistent with similar fields in other tables. 

    TL-8294        Improved layout of the learning plan page at small screen widths
    TL-8365        Added a link to the course completion report from the user profile page
    TL-8371        Changed program course sets to display courses in the order they were added

                   The order of courses in a program or certification course set would vary
                   when returned by a database. They are now ordered by ID of the
                   prog_courseset_course table, making the order more consistent. This means
                   they will be in the same order as what they were when first added to the
                   course set. 


Bug fixes:

    TL-6593        Fixed course completion status not updating when changing completion criteria

                   Users were not being marked "In progress" when the were assessed against
                   the new completion criteria.

    TL-8075        Fixed error in HR Import when setting the CSV delimiter to Tab
    TL-8078        Completion progress details page was reworded to more accurately indicate the status

                   Previously, the course status in the Completion progress details page
                   (accessed by clicking the "Progress" bar in Record of Learning: Courses or
                   "More details" in the Completion status block) would show "Not started"
                   even though the learner had actually viewed and completed a SCORM lesson.
                   Moreover, the SCORM activity status would be "Viewed the scorm, Achieved
                   grade" even though the learner had not achieved the grade to complete the
                   activity. These were fixed in this patch. Course status is now "incomplete"
                   as long as its activities are not complete and the activity status
                   correctly indicates the learner failed to achieve the required grade.

    TL-8226        Fixed an issue with the course completion scheduled task

                   There was a problem in the completion cron when a user had completed an
                   activity but hadn't had the module completion record written into the
                   database. The criteria review would call get_info() which now updates the
                   state, creating the module completion record. However the initial review
                   would then continue and due to a dataobject lacking the now existing record
                   it would try to write the record again, causing a conflict. The dataobject
                   is now created after the get_info() call, avoiding this issue.

    TL-8240        Fixed capability checks when assessing a user's access to resources using audience visibility

                   Prior to this fix, in rare situations where the current user was viewing
                   resources available to another user, the access checks were being
                   incorrectly performed for the current user. The checks are now correctly
                   performed for the given user rather than the current user in this
                   situation.

    TL-8253        Fixed a bug which occured in some situations when deleting audiences without members

                   Prior to this fix, if you attempted to delete an audience which had a role
                   assignment associated with it, but not members, you would receive a fatal
                   error. This has now been fixed and the audience is correctly deleted.

    TL-8319        Fixed the display of the "Add audiences" button when setting access rules for dashboards

                   When navigating to the access tab for a dashboard, if the restrict by
                   audience checkbox was already checked then the "Add audience" button would
                   incorrectly be disabled. The button now displays correctly when navigating
                   to the access tab.

    TL-8322        Fixed problem when upgrading to patch T-12199

                   The upgrade step in this patch was changing cohort visibility records for
                   certifications. It tried to change the program-type records to
                   certification-type. Now, if the certification-type record already exists,
                   the program-type record will instead be deleted.

    TL-8361        Fixed incorrect hardcoded max table name length in the XMLDB editor
    TL-8391        Fixed reportbuilder sorting and pagination when Restrict initial display is enabled
    TL-8397        Fixed scheduled task not completing for recurring courses

                   The scheduled task which backs up and restores a recurring course within a
                   program was not successfully completing. This has been fixed. 


Contributions:

    * Eugene Venter at Catalyst NZ - TL-7542, TL-8276
    * Hamish Dewe at Orion Health - TL-8371
    * Jo from Kineo - TL-8392

Release 2.7.12 (22nd February 2016):

Security issues:

    TL-8235        Included session key check in Face-to-face when adding and removing attendees
    TL-8392        Fixed handling of non-numeric answers to numeric feedback activity questions

Improvements:

    TL-7542        Added a new report source for language customisations
    TL-7970        Added the program and certification completion editor

                   Enabled with Site administration -> Advanced features -> Enable program
                   completion editor. Only users with the 'totara/program:editcompletion'
                   capability (site admins only, by default) will be able to access the new
                   tab 'Completion' when editing a program or certification. For more
                   information, see the community post:
                   https://totara.community/mod/forum/discuss.php?d=11040.

    TL-8276        Removed unused CFG settings from Totara messaging code

                   The removed settings are "message_contacts_refresh", "message_chat_refresh"
                   and "message_offline_time".

    TL-8290        Increased maximum value of sortorder field in the Feedback360 questions table.   

                   When running MySQL in particular, the number of questions in one Feedback
                   questionnaire would be limited to 128. This was due to the sortorder field
                   in the corresponding table being of the type tinyint. This sortorder field
                   will now use the bigint datatype for all supported databases, which is
                   consistent with similar fields in other tables. 

    TL-8371        Changed program course sets to display courses in the order they were added

                   The order of courses in a program or certification course set would vary
                   when returned by a database. They are now ordered by ID of the
                   prog_courseset_course table, making the order more consistent. This means
                   they will be in the same order as what they were when first added to the
                   course set. 


Bug fixes:

    TL-6593        Fixed course completion status not updating when changing completion criteria

                   Users were not being marked "In progress" when the were assessed against
                   the new completion criteria.

    TL-8075        Fixed error in HR Import when setting the CSV delimiter to Tab
    TL-8078        Completion progress details page was reworded to more accurately indicate the status

                   Previously, the course status in the Completion progress details page
                   (accessed by clicking the "Progress" bar in Record of Learning: Courses or
                   "More details" in the Completion status block) would show "Not started"
                   even though the learner had actually viewed and completed a SCORM lesson.
                   Moreover, the SCORM activity status would be "Viewed the scorm, Achieved
                   grade" even though the learner had not achieved the grade to complete the
                   activity. These were fixed in this patch. Course status is now "incomplete"
                   as long as its activities are not complete and the activity status
                   correctly indicates the learner failed to achieve the required grade.

    TL-8226        Fixed an issue with the course completion scheduled task

                   There was a problem in the completion cron when a user had completed an
                   activity but hadn't had the module completion record written into the
                   database. The criteria review would call get_info() which now updates the
                   state, creating the module completion record. However the initial review
                   would then continue and due to a dataobject lacking the now existing record
                   it would try to write the record again, causing a conflict. The dataobject
                   is now created after the get_info() call, avoiding this issue.

    TL-8240        Fixed capability checks when assessing a user's access to resources using audience visibility

                   Prior to this fix, in rare situations where the current user was viewing
                   resources available to another user, the access checks were being
                   incorrectly performed for the current user. The checks are now correctly
                   performed for the given user rather than the current user in this
                   situation.

    TL-8253        Fixed a bug which occured in some situations when deleting audiences without members

                   Prior to this fix, if you attempted to delete an audience which had a role
                   assignment associated with it, but not members, you would receive a fatal
                   error. This has now been fixed and the audience is correctly deleted.

    TL-8322        Fixed problem when upgrading to patch T-12199

                   The upgrade step in this patch was changing cohort visibility records for
                   certifications. It tried to change the program-type records to
                   certification-type. Now, if the certification-type record already exists,
                   the program-type record will instead be deleted.

    TL-8361        Fixed incorrect hardcoded max table name length in the XMLDB editor
    TL-8391        Fixed reportbuilder sorting and pagination when Restrict initial display is enabled

Contributions:

    * Eugene Venter at Catalyst NZ - TL-7542, TL-8276
    * Hamish Dewe at Orion Health - TL-8371
    * Jo from Kineo - TL-8392

Release 2.6.29 (22nd February 2016):

Security issues:

    TL-8235        Included session key check in Face-to-face when adding and removing attendees
    TL-8392        Fixed handling of non-numeric answers to numeric feedback activity questions

Improvements:

    TL-7970        Added the program and certification completion editor

                   Enabled with Site administration -> Advanced features -> Enable program
                   completion editor. Only users with the 'totara/program:editcompletion'
                   capability (site admins only, by default) will be able to access the new
                   tab 'Completion' when editing a program or certification. For more
                   information, see the community post:
                   https://totara.community/mod/forum/discuss.php?d=11040.


Bug fixes:

    TL-6593        Fixed course completion status not updating when changing completion criteria

                   Users were not being marked "In progress" when the were assessed against
                   the new completion criteria.

    TL-8075        Fixed error in HR Import when setting the CSV delimiter to Tab
    TL-8078        Completion progress details page was reworded to more accurately indicate the status

                   Previously, the course status in the Completion progress details page
                   (accessed by clicking the "Progress" bar in Record of Learning: Courses or
                   "More details" in the Completion status block) would show "Not started"
                   even though the learner had actually viewed and completed a SCORM lesson.
                   Moreover, the SCORM activity status would be "Viewed the scorm, Achieved
                   grade" even though the learner had not achieved the grade to complete the
                   activity. These were fixed in this patch. Course status is now "incomplete"
                   as long as its activities are not complete and the activity status
                   correctly indicates the learner failed to achieve the required grade.

    TL-8226        Fixed an issue with the course completion scheduled task

                   There was a problem in the completion cron when a user had completed an
                   activity but hadn't had the module completion record written into the
                   database. The criteria review would call get_info() which now updates the
                   state, creating the module completion record. However the initial review
                   would then continue and due to a dataobject lacking the now existing record
                   it would try to write the record again, causing a conflict. The dataobject
                   is now created after the get_info() call, avoiding this issue.

    TL-8253        Fixed a bug which occured in some situations when deleting audiences without members

                   Prior to this fix, if you attempted to delete an audience which had a role
                   assignment associated with it, but not members, you would receive a fatal
                   error. This has now been fixed and the audience is correctly deleted.

    TL-8391        Fixed reportbuilder sorting and pagination when Restrict initial display is enabled

Contributions:

    * Jo from Kineo - TL-8392

Release 2.5.36 (22nd February 2016):

Important:

    TL-8347        Fixed dynamic audience rules that reference an organisation menu type custom field

                   This patch is a backport of TL-7896, which was recently included in Totara
                   2.6 and above.
                   
                   Dynamic audience rules for Organisation menu custom fields can have one of
                   two operators, "Equal to" and "Not equal to".
                   Prior to this fix these operators functioned in reverse. "Equal to" would
                   lead to users within an organisation for which the custom field did NOT
                   include the selected options.
                   Likewise if "Not equal to" was used users within organisations for which
                   the selected value was used would be included as audience members.
                   After this fix the operators are applied correctly.
                   
                   If you have dynamic audiences with rules based upon organisation menu
                   custom fields then we strongly recommend you review these dynamic audience
                   rules and the associated audience memberships.
                   During upgrade these rules will be corrected and audience memberships may
                   change.
                   If you have affected audiences, you can fix them without incurring
                   membership changes by following these steps:
                   
                   1. Disable cron prior to your upgrade.
                   2. Upgrade your site.
                   3. Review the dynamic audiences that are affected. If you need memberships
                   to stay exactly the same then changing the condition on the rule from
                   "Equals to" to "Not equals to" (or vice-versa) will ensure that audience
                   memberships stay as they were prior to this version.
                   4. Approve your changes and review the audience memberships.
                   5. Re-enable and run the cron.


Security issues:

    TL-8392        Fixed handling of non-numeric answers to numeric feedback activity questions

Improvements:

    TL-7970        Added the program and certification completion editor

                   Enabled with Site administration -> Advanced features -> Enable program
                   completion editor. Only users with the 'totara/program:editcompletion'
                   capability (site admins only, by default) will be able to access the new
                   tab 'Completion' when editing a program or certification. For more
                   information, see the community post:
                   https://totara.community/mod/forum/discuss.php?d=11040.


Bug fixes:

    TL-6593        Fixed course completion status not updating when changing completion criteria

                   Users were not being marked "In progress" when the were assessed against
                   the new completion criteria.

    TL-8078        Completion progress details page was reworded to more accurately indicate the status

                   Previously, the course status in the Completion progress details page
                   (accessed by clicking the "Progress" bar in Record of Learning: Courses or
                   "More details" in the Completion status block) would show "Not started"
                   even though the learner had actually viewed and completed a SCORM lesson.
                   Moreover, the SCORM activity status would be "Viewed the scorm, Achieved
                   grade" even though the learner had not achieved the grade to complete the
                   activity. These were fixed in this patch. Course status is now "incomplete"
                   as long as its activities are not complete and the activity status
                   correctly indicates the learner failed to achieve the required grade.

    TL-8226        Fixed an issue with the course completion scheduled task

                   There was a problem in the completion cron when a user had completed an
                   activity but hadn't had the module completion record written into the
                   database. The criteria review would call get_info() which now updates the
                   state, creating the module completion record. However the initial review
                   would then continue and due to a dataobject lacking the now existing record
                   it would try to write the record again, causing a conflict. The dataobject
                   is now created after the get_info() call, avoiding this issue.

    TL-8253        Fixed a bug which occured in some situations when deleting audiences without members

                   Prior to this fix, if you attempted to delete an audience which had a role
                   assignment associated with it, but not members, you would receive a fatal
                   error. This has now been fixed and the audience is correctly deleted.

    TL-8391        Fixed reportbuilder sorting and pagination when Restrict initial display is enabled

Contributions:

    * Jo from Kineo - TL-8392

Release 2.4.39 (22nd February 2016):

Security issues:

    TL-8392        Fixed handling of non-numeric answers to numeric feedback activity questions

Contributions:

    * Jo from Kineo - TL-8392

Release 2.2.45 (22nd February 2016):

Security issues:

    TL-8392        Fixed handling of non-numeric answers to numeric feedback activity questions

Contributions:

    * Jo from Kineo - TL-8392