WPLMS MyCred Hook issue

[italymadeeasy]

Hi there, I just realised that the MyCred Hook for WPLMS (that allows us to assign MyCred points for stuff that happens on WPLMS) is open to a big exploit loophole. We set MyCred points to be awared at Course Completion. That works just fine but... When combined with another WPLMS Setting, Course Retake, it allows users to cheat, since they can complete a course, then click on the Retake Course button and earn the same MyCred points all over again, for both starting and completing a course... as many times as they have patience for! Do you have a quick script we could add to the Customizer to prevent this behaviour? Thanks, much appreciated

[MrVibe]

This is an interesting point. I have to check if Retakes is an action in MyCred addon or not. ( Assuming it is ) However, you can create another point awarding criteria where you can reduce the points of the user who is re-taking the course. If you add points in negative like : -150 with a negative sign then you can award -150 points t user on Course retakes.

[italymadeeasy]

That is an interesting suggestion! I didn't know there was a hook for re-taking a course! I will check, thanks

[italymadeeasy]

these are all the options I found https://d.pr/i/68Li09 Also, we award points for finishing a course too! And if someone wants to cheat, they will get points for both starting and finishing a course, a million times. Right?

[Anshuman Sahu]

Yes this is a loophole adding to issue log : https://trello.com/c/D00bagCv

[italymadeeasy]

Awesome, thanks Careful though, your card talks about Quiz Retakes only and "subtracting points". I think the problem is that points should only be GIVEN the first time a quiz is taken or a course (the problem I reported) is started and ended. I know you will fix this in the next update, but I wonder if you could share a code snippet to fix it asap, to avoid users cheating the system. For now I guess we could remove the option to "retake" courses, but I am not sure if enrolled students would still be able to access a course they have "finished". I mean, if a course does not have Retakes available, is the FINISHED COURSE button still clickable for the user to browse through the lessons of the course? In other words, the only difference the "Retake" option does is that all stats for the course are reset, all grades and all course progress. Other than that, a student is always able to enter a course they own. Correct? Thanks

[Anshuman Sahu]

If that is the case then you can set a user maximum number of times value in the mycred point awarding criteria settings : https://prnt.sc/1q57r3h

[italymadeeasy]

I see. I never considered that option because I assumed it meant that a single user can only be awarded the points specified in a WPLMS Hook rule ONCE, in their lifetime, which would not make sense, considering we offer multiple courses, and therefore wish to reward customers for every course they purchase, not just the first one. Am I wrong to assume that that's how the "user maximum = 1" works? Also, the other question I had in my previous post: if we remove the option for courses to be RETAKEN, will students still be allowed to enter their courses and use them as normal? Thanks

[Anshuman Sahu]

Yes you are right this setting will run for 1 user for any course . In that case you should create a new point criteria for each course and fill module id with course id as well in order to allot the points for 1 time per user per course .

[italymadeeasy]

True! That's an awesome suggestion! Will do that! Thanks!

[Author]

Posts