11.5 (stable)

Important Changes

Known Issues

Changed Behaviour

Security Fixes

The following security issues have been fixed. For more information about these vulnerabilities, see our 11.5 security blog post.

#47077: [File] File Services: Prohibited file suffixes bypassable (Martin-Luther-Universität Halle-Wittenberg)
#48028: [Test & Assessment] Authenticated RCE via Test import (André Schweigert (FAU|ILIAS))
#48072: [xAPI] Authenticated RCE via CmiXapi (André Schweigert ( FAU | ILIAS ))
#48213: [News] Stored XSS in the news (André Schweigert (FAU|ILIAS))
#48292: [Test & Assessment] Unauthenticated test-question rendering (André Schweigert (FAU|ILIAS))
#48298: [Forum] Fix forum attachment download processes ignored forum binding
#48313: [Calendar] Unauthenticated user and role enumeration via calendar (André Schweigert (FAU|ILIAS))
#48359: [Test & Assessment] Close RCE in ImageMap Question by Removing Unnecessary Code (André Schweigert (SchweigertIT))
#48362: [Staff] Broken access control in MyStaff (Peter Reichartz)
#48365: [Test & Assessment] Fix file deletion through uncaught file traversal opportunity in SingleChoice, MultipleChoice, KPrim, Matching, and Ordering Questions (André Schweigert (SchweigertIT))
#48366: [Learning Module SCORM 2004] Stored XSS in SCORM tracking reports (André Schweigert (SchweigertIT))
#48373: [Test & Assessment] Protect Additional Function Commands By Write (André Schweigert (FAU|ILIAS))
#48374: [Test & Assessment] Add Access Checks and Filtering to Result-Functions for Administrators (André Schweigert (FAU|ILIAS))
#48402: [Test & Assessment] Prevent Accessing Anonymous Test Run by Providing Active Id Only
#48413: [Test & Assessment] RCE via questionpool import (André Schweigert (SchweigertIT))
#48414: [Test & Assessment] RCE in ImageMapQuestion (André Schweigert (SchweigertIT))
#48418: [Mail] Stored XSS in mail (Christof Buch)
#48447: [Survey] Anonymous user enumeration via Survey (André Schweigert (FAU|ILIAS))
#48453: [File] File: Anonymous users could download file objects without permission when the public area was enabled. (Isira Adithya (@isira_adithya, https://github.com/isira-adithya))

Fixed Issues

The following issues reported in Mantis have been resolved:

#45381: [Accessibility / WCAG Issues] Navigation elements without a function-describing label (akill)
#44883: [Background Tasks] Bulk Download von Objekten für Anonymous funktioniert nicht (tjoussen)
#48100: [Blog] Language variable ID showing instead of entries. But entries exist in the various language files. (akill)
#48185: [Booking Pool] Use of array_any() in BookingManager not compatible with PHP 8.3 (tjoussen)
#42379: [Category and Repository] Limit Objects per Block: No Show More Button (akill)
#45434: [Category and Repository] Actions not working with multiple object-blocks (akill)
#47272: [Category and Repository] Repository/Component/RBAC: Deactivated plugin type cannot be deinstalled (misleading error message) (akill)
#47803: [Category and Repository] ILIAS\HTTP\Response\Sender\ResponseSendingException thrown with message "Response was already sent." (PR) (akill)
#48104: [Category and Repository] Embeded link: «This is the root node of the system!!!» (akill)
#48233: [Category and Repository] Permission Denied in Category->Settings->Multilingualism (akill)
#48416: [Certificate] In certain cases, the text in the certificate can no longer be centred (mjansen)
#42263: [Course Management] global and/or lokal style is not imported, although included in export file (akill)
#43358: [Course Management] Failed test: Kurs exportieren (akill)
#44942: [Course Management] Failed test: Sichtbarkeit einer Portfolio-Freigabe überprüfen (akill)
#46977: [Course Management] Learning Progress stays "In progress" (yellow) for Tutor/Administrator users after completing Learning Module (akill)
#48299: [Course Management] Aufruf "Lernfortschritt" im Kurs und über Hauptmenü führt zu Fehler -> SEIT UPDATE auf Ilias 10.11 (smeyer)
#48287: [Cron Service] Anzeige Tabs in Cron (mjansen)
#47040: [Dashboard (f.k.a. Personal Desktop)] Manual Sorting is unusable if its the only option (lscharmer)
#48332: [Dashboard (f.k.a. Personal Desktop)] Missing button to save manual sorting (lscharmer)
#39303: [Exercise] Übung: Abgabebenachrichtigungen an frühere Kurstutoren (akill)
#46390: [Exercise] Übungseinheit mit zufälliger Auswahl einreichen > alle Übungseinheiten im Kalender einsehbar und aufrufbar (akill)
#47668: [Exercise] Infoline for upload limit not correct for team uploads (akill)
#48019: [Exercise] Silent Failure: Failed file upload creates 0-byte file without user notification (akill)
#48346: [Exercise] TypeError thrown with message "substr(): Argument #3 ($length) must be of type ?int, false given" (akill)
#48425: [Exercise] Peer feedbacks got lost during migration (akill)
#48454: [Exercise] Uploading additional peer feedback files leaves junk data in IRSS (akill)
#48223: [Export] XML export file of a certain course fails with "This file could not be imported. ..." (smeyer)
#47828: [File] permission "Bypass Negative List" for administrators does not work at import of learning module SCORM (fschmid)
#48371: [Forum] Error thrown with message "Typed property ForumDto::$top_pk must not be accessed before initialization" (mjansen)
#48422: [Forum] Navigation through forum fails (mjansen)
#30866: [ILIAS Page Editor] Media objects - size confusion or wrong expactation? (akill)
#40079: [ILIAS Page Editor] Einfügen eines Inhaltes über die Maus wird in der Tabellespalte nicht gespeichert (akill)
#40645: [ILIAS Page Editor] Dropdown Absatzformate für Akkordeons wird nicht im Slate angezeigt (akill)
#41043: [ILIAS Page Editor] External links with pipes look strange (akill)
#42247: [ILIAS Page Editor] Block: Permission object is not adapted to the copy of the object after copying (akill)
#42606: [ILIAS Page Editor] Absatzformate lassen sich nicht gesammelt bearbeiten (akill)
#44269: [ILIAS Page Editor] Failed test: Löschung des Overlay-Bildes (akill)
#44274: [ILIAS Page Editor] Drag-and-drop an element (akill)
#44513: [ILIAS Page Editor] Order of style sections is ignored. (akill)
#44649: [ILIAS Page Editor] Section: External link target allows only up to 200 characters (akill)
#45461: [ILIAS Page Editor] internal link is not adapted when copying container object (akill)
#45958: [ILIAS Page Editor] Removed language still visible in multilingual page editing (akill)
#47022: [ILIAS Page Editor] Preview for style classes not working in sections and table cell menus (akill)
#47657: [ILIAS Page Editor] Entries in page_history not purged when object is deleted (akill)
#47754: [ILIAS Page Editor] Map content elements in COPage can overflow their parent container on narrow viewports (PR) (akill)
#47804: [ILIAS Page Editor] Soft Line Break (akill)
#48141: [ILIAS Page Editor] Reordering page elements using drag-and-drop does not work in all browsers (akill)
#48281: [ILIAS Page Editor] Editing paragraph with outdated characteristic fails (JS TypeError, infinite loading) (akill)
#48323: [ILIAS Page Editor] Advanced List: wrong item style after adding a new list (akill)
#48331: [ILIAS Page Editor] test11: ilPageObjectGUI::getNotesHTML(): Implicitly marking parameter $a_callback as nullable is deprecated (akill)
#48449: [ILIAS Page Editor] Block: "Ziel-Objekt wählen" für interne Links reagiert nicht (akill)
#48043: [Item Groups] Objekteblöcke offen und mit Titel (tjoussen)
#48101: [Item Groups] ILIAS\ItemGroup\Setup\Agent.ilItemGroupDisplayMigration does not stay [done] (tjoussen)
#42405: [Language Handling] Use sess#:#sess_members_gallery# (smeyer)
#48113: [Learning Module HTML] "Edit content" leads to wrong HTML Learning Module (maxbecker)
#31765: [Learning Module ILIAS : Assessment Questions] Feedbacks in Questions of Learning Module: Closed Accordion Panels won't open when clicking on them (akill)
#37322: [Learning Module ILIAS : Editor] ILIAS Learning Module Editor - Learning Progress - Links to Chapters (akill)
#38718: [Learning Module ILIAS : Editor] Learning Module -> Adopt Content (akill)
#48251: [Learning Module ILIAS : Editor] FAQ Tool: Falsche Seite bei Verlinkung auf Seite aus anderem ILIAS-Lernmodul (akill)
#27940: [Learning Module ILIAS : Presentation] Fehlende Sprachvariablen bei Verlinkungen in Medienobjekten auf Plugins (Interactive Video, Mobile Quiz, etc) (akill)
#40637: [Learning Module ILIAS : Presentation] Deleted glossary can still be used in the learning module (akill)
#43359: [Learning Module ILIAS : Presentation] No fullscreen for image if the page contains a question with IPE for feedback (akill)
#43562: [Learning Module ILIAS : Presentation] Failed test: ILIAS Lernmodul kopieren (akill)
#45316: [Learning Module ILIAS : Presentation] Description of Learning Modul is not displayed in Presentation View (akill)
#45923: [Learning Module ILIAS : Presentation] Missing Chapter Name in Breadcrumb When Opening Learning Module (akill)
#46968: [Learning Module ILIAS : Presentation] Learning Progress does not mark pages containing questions as completed when the copied module has multilingualism enabled (akill)
#47796: [Learning Module ILIAS : Presentation] HTML-Download noch unterstützt? (akill)
#47839: [Learning Module ILIAS : Presentation] Presentation mode -> Click on Learning Progress button -> ILIAS jumps to the first page (akill)
#48337: [Learning Module ILIAS : Presentation] TypeError when an internal link has a non-numeric target id (akill)
#45815: [Learning Module SCORM 1.2] All SCOs lost on Import when Importing a zip file that was exported from ILIAS (both 1.2 and 2004) (qualitus.hartwig)
#48459: [Learning Module SCORM 1.2] SCORM 1.2: Call to undefined method ilSCORMPresentationGUI::logWarning() (qualitus.hartwig)
#48294: [Learning Sequence] Personal Learning Progress cannot be opened after update to ILIAS 9.23 (smeyer)
#48326: [Mail] Scheduled mails sent repeatedly every night (mjansen)
#48334: [Mail] Setting "Max. attachment size" not respected (mjansen)
#47459: [Main Menu] Main Menu sub-items can't be activated (fschmid)
#46877: [Media Pools and Media Objects] Allowed filetypes diverge on create and update (akill)
#47603: [Media Pools and Media Objects] Default Properties: setting "Text Representation" (alt-Attribute) resets image size to fixed 0x0 (akill)
#47838: [Media Pools and Media Objects] The title “Thumbnail” doesn't have enough space (akill)
#48084: [News] Entfernung des inkorrekten Kennwertes für eine Anzahl im News-Filter "Kontext". (tjoussen)
#48342: [News] news_block_news_for_context - in code but never triggered (tjoussen)
#46540: [Online Help] Guided Tour: Input for Element ID needs byline (akill)
#46541: [Online Help] Missing Element IDs (akill)
#46759: [Online Help] Interaktive Touren: Sprachliche Anpassung in der Tabelle "Schritte" (akill)
#48375: [Organisational Units] SOAP method importOrgUnitsSimpleXML fails with HTTP 500 because ilOrgUnitImporter::$stats is never initialized (fschmid)
#47686: [Portfolio] Links within portfolios always redirect to the first page instead of the specific target page (akill)
#46604: [Precondition Handling] Missing Information on Learning Progress (skergomard)
#48176: [Search] Lucene indexing not working for plugins (smeyer)
#48207: [SOAP & Webservices] SOAP importUsers incorrectly denies user creation for a global administrator (ahmed)
#47411: [Study Programme] Failed test: Beschreibung eines SP kann nicht aktualisiert werden (fkruse)
#43687: [Style – Content Style] No way back while pasting a style class (akill)
#43905: [Style – Content Style] Fehlende Auswahl von Accordeon-Elementen (akill)
#48282: [Style – Content Style] accordion in accordion with different styles isn't working correctly (akill)
#16121: [Tagging] tags with backslash ("\") don't work with desktop-tag-block (akill)
#46462: [Taxonomies] Sortierung funktioniert nicht (akill)
#45093: [Test & Assessment] Missing summary of the points in the column title in question pools and tests(!) (skergomard)
#46184: [Test & Assessment] Default Content Style in Test doesn't show manual style classes (skergomard)
#46663: [Test & Assessment] Fragen löschen: Versuchen, Aktion ohne Auswahl durchzuführen (tjoussen)
#47888: [Test & Assessment] Trying to score formula question sometimes leads to an exception (tjoussen)
#48209: [Test & Assessment] Participants tab of a test no longer shows the number of participants (skergomard)
#48274: [Test & Assessment] LaTeX not working in 'Best solution' feedback - delimiters showing instead (skergomard)
#48348: [Test & Assessment] Participants table is sorted by last name, but shows full name as <first name> <last name>, making it hard to use (skergomard)
#48353: [Test & Assessment] Need thousands of questions at the tip of your fingers? Just copy the question table and then reload the page a few times! (skergomard)
#48367: [Test & Assessment] File Upload Question: Action "Download All Files" leads to 404 Not Found (fschmid)
#48368: [Test & Assessment] Seitengestaltung in Test: Vollbild lässt sich nicht über das "x" schließen (skergomard)
#48293: [User Service] User update and deletion fatal when usr_profile_data.value is NULL (skergomard)
#48426: [User Tracking] Inhaltsseite: Statusänderung "Selbsteinschätzung für gesamtes Objekt" nicht an beschriebener Stelle zu finden (smeyer)
#42969: [Wiki] Wiki > Settings > LTI Releases: Wrong tab/subtab display (akill)
#43530: [Wiki] Internal links don't support multilingual wiki pages (akill)
#44078: [Wiki] German pages are listed as orphaned when using multi language (akill)
#47674: [Wiki] The wiki print function does only print the master language (akill)
#47905: [Wiki] Search in a wiki -> Whoops (tschmitz)
#48441: [Wiki] Page list is using the wrong CSS class (akill)
#48452: [Wiki] Wiki Creation Fails (akill)
#48423: [¥ Component] CLI setup update re-activates plugins that were deactivated by the administrator (tfuhrer)
#47315: [¥ File System] Preview Images of gifs look broken (fschmid)
#48276: [¥ IRSS – ILIAS Resource Storage Service] Tab "File" in Advanced Settings of image in Wiki throws error (fschmid)
#48382: [¥ IRSS – ILIAS Resource Storage Service] Some PHP-Warnings during mediaobject.ilMobMigration (fschmid)
#48198: [¥ Password] Very limited list of allowed (special) characters for user password (mjansen)
#48391: [¥ Tiny MCE] Underlined and strikethrough text in manual scoring not working (formatting removed after saving) (shepherd)
#48099: [¥ UI Components / KS] Data table “Select all/Unselect all” action only affects the first row and throws a JavaScript exception in the browser console (tfuhrer)
#48296: [¥ UI Components / KS] Table actions trigger (tfuhrer)