Hello, this is my first post ever on Drupal.org, but I respect open source a lot. Hence I'm trying to be as helpful as I can i.e. not being a leech. With that out of the way...

If a tech savvy user reveals to see the code they can easily figure out the answers to all matching questions.
Take a look at the following sample image.
Quiz Matching Issue Sample

Under the HTML for the drop down (the box section with the arrow to be precise) you get something like this (for the sample in the image above):

<select id="edit-tries-5" name="tries[5]" class="form-select">

<option value="def"></option>
<option value="2">OPTION A</option>
<option value="3">OPTION B</option>
<option value="1">OPTION C</option>
<option value="5">OPTION D</option>
<option value="4">OPTION E</option>

</select>

The user can then see that OPTION D, is tagged with the same value as the as the drop down's name and id.

In the theming file of matching (mathching.theme.inc) I found the following at line 34:

/**
 * Theme the answering form
 */
function theme_matching_subquestion_form($variables) {
  $form = $variables['form'];
  $out = '<table class = "matching-tbl">';
  foreach ($form as $key => $value) {
    if (is_int($key)) {
      $out .= '<tr><td class = "matching-question">' . $value['#question'];
      $out .= '</td><td class = "matching-select">' . drupal_render_children($value) . '</td></tr>';
    }
  }
  $out .= '</table>';
  return $out;
}

The HTML code from before is rendered under drupal_render_children($value). I'm having trouble further figuring out where this $value is coming from and what it's doing. I've worked on it for about an hour. I will post updates to this thread. If someone that is more PHP/Drupal savvy wants to help, you are welcome to.

P.S. I tagged the bug as major because users who depend on this module can easily have their tests cheated on with one whistleblower. Feel free to change the priority if you feel I did wrong.

CommentFileSizeAuthor
quiz.png8.75 KBAnonymous (not verified)
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Anonymous’s picture

Issue summary: View changes
Anonymous’s picture

Still couldn't figure out a way to patch this. Any help much appreciated.

Anonymous’s picture

Component: Code - matching » Code - Quiz core
Assigned: Unassigned »

I have to check if this is still the case in the new version.