Bookmarks (within book chapter)

Hi!
Yes, I'm unable to continue the development on this one, I wish I could. I'm able to assist in development though as much the free time makes it possible for me. I'm always here for advice as well or for some small improvements and bugfixes. It's not that I'm resigning of it completely, I'll just not code it anymore. All the cards are open for now.
I published the plugin here here because there is nothing similar on Moodle yet and it sounds like an interesting idea. It could help someone for sure or at least open mind.
I've fixed the issues you posted on Github! Thanks for feedback!
Cheers!

Hi Hrvoje. As I understood from the description, you are not able to maintain this plugin in the future so I put the plugin into the 'Seeking new maintainer' set. I tested the functionality of the plugin and it looks like a really good idea. It would be pity to let it die so I hope you will either change your mind and keep maintaining this, or you will be able to find a new maintainer soon.
Thanks for fixing the most crucial issues detected by Dan in his peer-review. Currently, it seems that the code would need a bit more clean-up and polishing to meet Moodle coding guidelines standards. I moved it into the 'Incubating' category so it can get a bit more mature there.

True! Tnx for notifying me.

Hi. Thanks for prompt fixes. Can you please check the "Download versions" link at this page? It seems to me that you hid the more recent version "1.0 (2015021700)" (it appears as Invisible now) instead of the older one. Probably you want to do the opposite - hide the version "0.1 (2015020604)" and show the version 1.0 to make it available.
We will get to re-reviewing your latest version this week and will let you know. Thanks for your patience.

Your feedback have been very valuable to me. I agree with all the comments and have fixed the issues:
1. no more calls to $_POST, only required_param and optional_param calls.
2. define('AJAX_SCRIPT', true); is set but I created another file for non-ajax database access
3. confirm_sesskey() is now used before any database action
4. I agree to your proposal on file name change: modifybookmarks.ajax.php
5. documentation is moved out of github
6. $SESSION is not used anymore at all. Not necessary needed
7. not any user is allowed to delete or update any record from database anymore
Are there any further comments? Should I re-apply?

Thanks Dan for spotting these. I agree this file has security related issues. Additionally, it allows any logged-id user to delete or update any record from that table. Also, $SESSION->chapterid seems to violate the naming convention and I would suggest to ideally not to (ab)use the session for this, or at least make it something like $SESSION->block_bookmarks->chapterid or so.
I am going to mark this plugin as needing more work to get these issues sorted out. Please note, I am having troubles to precheck the plugin code with our tools due to space characters in you directory and file names (Installation instructions). I admit it is a bug in our checking system (as we normally do not allow spaces in filenames), still you may want to move those instructions out of the plugin code to a web site or so.

HI There,
thanks for sharing the plugin. I've just had a quick look and noticed that the file dbaccess.php introduces some security issues and doesn't seem to be complete (you have some TODO comments at the top of the file that suggest you are already aware of this.)
Specifically - you make a call to $_POST which is not allowed - you should be using required_param and optional_param calls.
you should add the following text to the top of the page:
define('AJAX_SCRIPT', true);
You should be passing the sesskey() to the ajax script and checking it before any actions are taken.
https://docs.moodle.org/dev/Security:Cross-site_request_forgery
a better name for that file might be modifybookmarks.ajax.php rather than dbaccess.php