Change Log

All notable changes to this project will be documented in this file.

[3.0.1] 2026-07-22

Updated

• Fix #369: {coursename} can now be wrapped in other tags.


• Fix #365, #366, #367: Resolve issue with nested {if...} tags.


• Fix stylelint errors for @property and aspect-ratio.


• Fixed PostgreSQL version moodle-ci testing issues.

[3.0.0] 2026-05-11

Added

• 267 phpUnit tests and 469 assertions in 15 categories.


• Security: Fixed SSRF/LFI in {scrape} tag (Issue #361).


• Added support for nested {ifprofile} tags.

Updated

• Removed internal str_contains polyfill (no longer needed on PHP 7.3+).


• Fix-346: {ifactivitycompleted} now exclude COMPLETION_COMPLETE_FAIL (failed graded activities no longer count as completed).


• Fix-356: {ifnotcustomrole} tag fixed (was broken since v2.7.0).


• Added maximum width for {coursecontacts} tag. Now also inline.


• Multiple bug and compatibility fixes.


• Updated copyright notice for 2026.


• Compatible with Moodle 3.11 to 5.2 (not Moodle 2.7 to 3.10)


• Compatible with PHP 7.3 to 8.4 (not PHP 5.4 to 7.2)


• Hardened the {scrape} tag against SSRF/LFI by allowing only HTTP(S) URLs, resolving root-relative URLs against $CFG->wwwroot, using Moodle's cURL security helper, rejecting non-HTML responses, limiting response size, and sanitizing scraped HTML before display.


• Added {scrape} settings for allowed hosts, maximum response size, cache TTL, and whether missing scrape content should display a message or fail silently.


• Improved {scrape} performance with configurable MUC caching, conservative request timeouts, redirect limits, and mid-download response size enforcement.


• Changed missing {scrape} matches to return the configured fail output instead of falling back to the full remote page.


• Added PHPUnit coverage for {scrape} URL handling, blocked schemes, host allowlists, response limits, output cleaning, XPath escaping, caching, content-type checks, and silent-failure mode.


• Note: PHP 8.4 + Moodle 5.2 CI lane pending upstream moodle-plugin-ci fix; plugin tested manually on this combo.

Important

Notice: This release drops support for Moodle 2.7 through 3.10 and PHP 5.4 through 7.2. The minimum supported versions are now Moodle 3.11 and PHP 7.3.

A separate legacy version of FilterCodes is available on the MOODLE_311_LEGACY branch for sites running Moodle 2.7 through 3.11. This is the final release for those legacy versions of Moodle and will not receive further updates. All non-legacy-specific improvements in the legacy version are also included in this 3.0.0 release. Sites already on Moodle 3.11 can install 3.0.0 directly without first upgrading Moodle — the overlap is intentional to make the transition smoother.

Security - {scrape} tag: This release contains an important security fix for the {scrape} tag (SSRF/LFI protection - Issue #361). Sites that use the {scrape} tag are strongly encouraged to upgrade. The fix tightens what the {scrape} tag is allowed to fetch and how it is processed; see the Fixes/updates section for details. The {scrape} tag remains enabled on sites where it was already enabled - no re-configuration is required, but administrators may wish to review the new settings (described below) to tune size limits, caching, and allowed hosts to suit their site. If your site currently scrapes pages larger than 1 MB, or scrapes non-HTML content (such as plain text or JSON), those scrapes will stop working after the upgrade - review the new {scrape} settings and adjust the maximum response size if needed, or note that non-HTML responses are no longer supported.

New features

• 
  

  Added a comprehensive PHPUnit test suite - 267 tests with 469 assertions across 15 categories - to improve long-term quality and stability.

  
  


• 
  

  Added new settings for the {scrape} tag:

  
  
  
  
  • Allowed hosts - optional list of permitted hostnames. Default: empty (all public HTTP(S) hosts allowed, subject to Moodle's cURL security settings).
  
  
  • Maximum response size - caps how much content can be downloaded per scrape. Default: 1 MB.
  
  
  • Cache lifetime - how long successful scrape results are cached. Default: 30 seconds.
  
  
  • Show missing-content message - choose between displaying a "content missing" message or failing silently when scraped content is unavailable. Default: silent.
  
  
  
  


• 
  

  Added support for nested {ifprofile} tags.

  
  


• 
  

  Added a maximum width option for the {coursecontacts} tag, which can now also be displayed inline.

  
  

Fixes and updates

• Security: Hardened the {scrape} tag against SSRF/LFI attacks by allowing only HTTP(S) URLs, resolving root-relative URLs against the site URL, using Moodle's built-in cURL security helper, rejecting non-HTML responses, limiting response size, and sanitizing scraped content before display (Issue #361).


• Improved {scrape} performance with configurable caching, conservative request timeouts, redirect limits, and mid-download size enforcement.


• Changed missing {scrape} matches to return the configured fallback output instead of the full remote page.


• Fixed {ifactivitycompleted} so that failed graded activities no longer count as completed (Fix-346).


• Fixed the {ifnotcustomrole} tag, which had been broken since version 2.7.0 (Fix-356).


• Now compatible with Moodle LMS 3.11 LTS through 5.2.


• Now compatible with PHP 7.3 through 8.4.


• Bumped the minimum supported Moodle LMS version to 3.11 and the minimum PHP version to 7.3.


• Removed the internal str_contains polyfill (no longer needed on supported PHP versions).


• Updated to comply with current Moodle coding standards.


• Updated copyright notice for 2026.


• Note: The automated CI lane for PHP 8.4 + Moodle 5.2 is pending an upstream moodle-plugin-ci fix; this combination has been manually tested.

Important

Notice: This is the final legacy release of FilterCodes for Moodle 2.7 to 3.11. This branch is no longer actively supported and is not expected to receive further updates. For additional feature updates, bug fixes, and security fixes, please upgrade to a supported release of Moodle LMS.

New features

• Explicit Moodle support metadata for Moodle 2.7 to 3.11.


• Explicit incompatibility metadata for Moodle 4.0 and later.


• New option to link {coursecontacts} and {teamcards} to a user's mobile phone.

Fixes/updates

• Final legacy release for Moodle 2.7 to 3.11.


• Included several backwards compatibility fixes for older Moodle and PHP versions.


• Fixed PHP 5.4 compatibility issues including return types, class name references, null coalescing, array_column(), and empty() expressions.


• Fixed compatibility guards and fallbacks for Moodle APIs that vary between Moodle 2.7 and 3.11.


• Fixed detection of encoded course tags such as %7Bcoursecontextid%7D.


• Improved {scrape} tag fetching by using Moodle's download_file_content() helper for better legacy Moodle compatibility.


• Updated README compatibility information for this legacy branch.


• Fixed {coursecontacts} phone links and icon handling.


• Fixed {ifcourserequests} logic.


• Fixed {ifactivitycompleted} and {ifnotactivitycompleted} handling of failed completion states.


• Added an active enrolment fallback for {coursecount students:active}.


• Improved {coursecontacts} display width.


• Updated copyright notice for 2026.

Change Log

[2.7.2] 2025-10-27

Added

• Now detects encoded course tags (e.g. %7Bcoursecontextid%7D)


• Added option to link to Mobile Phone in {coursecontact} tag.


• Added support for nested {if...} tags.


• {coursecount students:active} Added active enrolments fallback if no role_assignments present.

Updated

• Fix 342: {coursecontact} Phone link will now be displayed when configured in the settings.


• Fixed logic of {ifcourserequest} tags.


• Fix a Moodle coding guidelines compliance issue.


• Improved 3rd party plugin detection for {menudev} tag.


• Fixed PHP issue with blank {firstnamephonetic}, {lastnamephonetic}, {middlename} tags.


• Fixed URL to Moodle reports.


• Compatible with Moodle 2.7 to 5.1


• Compatible with PHP 5.4 to 8.4

What's New

[2.7.0] 2025-05-05

Added

• New {ifnotingroup} tag (without parameters).


• Primary/Custom menu text, such as course or category names, can now contain a pipe (|) character.


• New {firstnamephonetic} tag.


• New {lastnamephonetic} tag.


• New {middlename} tag.


• New 'Add New User' and 'Upload Users' to {menuadmin} tag.

Updated

• Fix-323: Escape arguments used to construct a link from button code.


• Fix-210: {ifrolename} tags now work correctly.


• Fix-319: Moodle 4.5 and 5.0 Plugin CI runs.


• Fix-318: Language tags now work inside {global_...} tags.


• Performance optimization: Now caches login state.


• Issue #329: Increase maximum globaltagcount to 100.


• Issue #335: Refactor text_filter to construct archetypes only once.


• Fixed several issues relating to Multi-language text.

[2.6.3] 2025-04-27

Updated

• Fixed warning if the {ifprofile_field_shortname} field does not exist.


• The {sitesummary} tag now displays the site summary instead of the site full name.


• Managers can no longer access the Themes menu.


• Refactored {menuwishlist}. No functional change.


• Fixed coding style guidelines compliance issue.


• Only Site Administrators can now access User: Profile Fields in the Admin menu.


• Fix-312: {ifactivitycompleted} and {ifnotactivitycompleted} now work correctly with graded activities.


• Fix-311: {global_...} tags can now include numbers in their name.


• Fix-322: Made path to settings PHP files more specific.


• Fixed ALT text for {userpictureimg} tag.


• Fixed compatibility issues with Moodle LMS 5.0.


• Fixed issue with profile image if size was not specified.


• Now prevents recursive calls.


• Copyright notice to include 2025.