Moodle question bank advisory

CLAMP has become aware of a significant bug involving the Moodle question bank. This bug affects Moodle platforms on versions 4.3.8, 4.4.4, or 4.5.0 (and higher). CLAMP recommends that schools do not upgrade to those versions until this bug has been fixed. Please continue reading for a full explanation.

Background

It’s a long-standing issue within Moodle that backing up and restoring a course with a quiz can bring numerous questions forward even when those questions are not actually used in the course (see MDL-41924 for discussion). Compounding this issue is the fact that usage statistics are unreliable because a random question may pull any question from a given category.

Moodle 4.0 introduced the concept of question versions to the question bank (MDL-71696). CLAMP reviewed this change at the Summer 2022 Hack/Doc Fest at Carleton College. This was a significant change and introduced a number of bugs. One of the more significant is MDL-77625: when importing a quiz into a course multiple times, the imported quiz could reference questions in the original course, and not the imported course. This bug was fixed, but the fix introduced a far more serious bug: MDL-83541.

Within the Moodle question bank, the “stamp” is meant to serve as a globally unique identifier. There have been various reports over the years that stamps are in fact not unique, but this didn’t cause a serious problem until now. If multiple questions have the same stamp, and you’re importing a quiz with a question that references that stamp, the question is ambiguous. This can lead to a failed import because Moodle cannot find the answers to the question, because it’s referencing the wrong question. This manifests in an error, produced below, beginning “Failed to find an answer matching…”

Recommendations

Moodle HQ is working on a fix and we will update this post when that fix is released. As of writing on February 11, 2025, it is not fixed. The recent stable releases (4.3.10 and 4.4.6) are not fixed. In lieu of a code fix, it’s possible to manually remediate a faulty question bank. First, you’ll need to identify problematic “duplicate” questions. Michael Gerszewski wrote a SQL query to identify these questions, given a course ID. CLAMP has published a version of that query suitable for Tim Hunt’s ad-hoc database queries report. In working with this report, we discovered a situation where a course had been imported several times (e.g. from 2018 to 2019 to 2020), and the duplicate questions were spread out among all three courses. Furthermore, we found situations where (as seen in MDL-77625), a quiz from one course referenced a question in a different course.

Deleting the unused, duplicate questions should make it possible to cleanly import a course with quizzes and questions to a new course. That said, cleaning up a question bank with hundreds of duplicate questions, spread across multiple courses, doesn’t scale well. Another possibility is to create a fresh question bank with new questions. This is also a labor-intensive process. CLAMP does not recommend any automated remediations. You should also bear in mind that if a quiz in a course used random questions, the usage report may be unreliable.