Critical-risk tools in Moodle
24 of the 233 tools in Moodle are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
delete_activityDestructiveDelete an activity from a course, with its participants' data (submissions, attempts, posts, grades). Destructive: confirm with the person first, naming the activity.
-
delete_book_chapterDestructiveDelete a chapter with its files; deleting a chapter (not a subchapter) deletes its subchapters too. Returns the chapters afterwards. Can't be undone: confirm with the person first.
-
delete_database_entryDestructiveDelete a database entry with its values and files. A student deletes their own while Moodle lets them change it; a teacher, anyone's. Can't be undone: confirm with the person fi...
-
delete_database_fieldDestructiveDelete a database field: what every entry has in it goes too, and its tags leave the templates. Returns the fields. Can't be undone: confirm with the person first.
-
delete_eventDestructiveDelete a calendar event the person can manage (a course event, or their own), by its id from list_events or create_event. Activities' dates are changed in the activity instead. ...
-
delete_feedback_itemDestructiveDelete a feedback item; the answers people gave to it go with it. Returns the items left. Can't be undone: confirm with the person first.
-
delete_feedback_templateDestructiveDelete a feedback template (a public one takes a manager's rights). Can't be undone: confirm with the person first.
-
delete_glossary_entryDestructiveDelete a glossary entry with its files. A student deletes their own while the site's editing time lasts; a teacher, anyone's. Can't be undone: confirm with the person first.
-
delete_grade_categoryDestructiveDelete a grade category: Moodle moves what it held into its parent and deletes its total's grades; the course's own category can't be deleted. Can't be undone: confirm with the ...
-
delete_grade_itemDestructiveDelete a manual grade item and every grade in it. An activity's item goes with its activity, so it's refused. Can't be undone: confirm with the person first.
-
delete_groupDestructiveDelete a group; its members stay in the course. Activities set to work by groups lose it. Can't be undone: confirm with the person first.
-
delete_groupingDestructiveDelete a grouping; its groups stay. Can't be undone: confirm with the person first.
-
delete_lesson_pageDestructiveDelete a lesson's page. Answers of other pages that jumped to it are left as Moodle leaves them: check them with get_lesson_pages. Returns the page ids left, in order. Can't be ...
-
delete_postDestructiveDelete a forum post and its replies through Moodle's own confirmation; a discussion's first post takes the whole discussion. Only a moderator deletes someone else's post or one ...
-
delete_question_categoryDestructiveDelete a question bank's category: its subcategories move up to its parent; one with questions needs moveTo, the category its questions go to. Moodle keeps a bank's last top-lev...
-
delete_questionsDestructiveDelete questions from a bank, every version of each, as the bank's delete action does. Moodle doesn't delete a question a quiz uses: it hides it, and hidden lists those. Can't b...
-
delete_sectionDestructiveDelete a section and every activity in it, with their participants' data. Destructive: confirm with the person first, saying which activities go with it.
-
delete_workshop_exampleDestructiveDelete an example submission with its assessments (the reference one and participants' practice ones). Can't be undone: confirm with the person first.
-
override_workshop_gradeDestructiveOverride a grade Moodle calculated in a workshop: a submission's grade, or an assessment's grade for assessing (give one of the two ids, from get_workshop), with feedback for th...
-
remove_quiz_slotDestructiveRemove a slot from a quiz, as the edit page's delete icon does; the question stays in its bank. A quiz with attempts can't change its questions. Returns the quiz's structure. Co...
-
remove_siteDestructiveForget a site added at run time, by name, and delete its browser profile with its session. Not the active site (switch first) nor one from the person's configuration (they remov...
-
remove_workshop_reviewerDestructiveRemove a reviewer's allocation to a submission: Moodle deletes their assessment of it. An assessment already graded is only deleted with evenIfAssessed, and its grade is lost. R...
-
reset_courseDestructiveReset a course as Moodle's reset form does: delete only what's named in delete (submissions, attempts, posts, grades… in every activity that has them), unenrol the people with u...
-
unenrol_userDestructiveUnenrol someone from a course: removes every enrolment of theirs the person may remove, with their roles and group memberships in the course; removed and kept name the enrolment...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.