Affected version: Gibbon v30.0.01
Module: Timetable Admin → Manage Courses & Classes
Severity: Medium — blocks course rollover workflow between school years
Description
Clicking “Copy All To Next Year” in Timetable Admin > Manage Courses & Classes produces a “File not found” error instead of copying courses to the next school year.
Steps to Reproduce
- Log in as admin
- Navigate to Timetable Admin > Manage Courses & Classes
- Select a past school year using the year navigator
- Click Copy All To Next Year
- Confirm the prompt
Expected: Courses and classes are copied to the next school year with a success banner.
Actual: “File not found” error page is displayed. No courses are copied.
Root Cause
Two bugs in the same flow:
- course_manage.php:97 — ->directLink() bypasses Gibbon’s router
The action button generates a direct URL to course_manage_copyProcess.php instead of routing through index.php?q=… On PHP-FPM server configurations, direct file access
does not reliably provide the globals ($guid, $connection2) that isActionAccessible() depends on. The function returns false, triggering a redirect to a malformed URL that
renders as “File not found”.
- course_manage_copyProcess.php:42,52 — missing exit after error header() calls
Two early-return error paths call header(“Location: …”) without a subsequent exit. PHP continues executing into the success path, appending &return=success0 to a URL that
already contains &return=error1 or &return=error2, corrupting the final redirect.
Affected Files
- modules/Timetable Admin/course_manage.php — line 97
- modules/Timetable Admin/course_manage_copyProcess.php — lines 42, 52
Fix
course_manage.php:97 — remove ->directLink() so the action routes through index.php?q=… like all other Gibbon module actions.
course_manage_copyProcess.php — add exit; after each error header() call on lines 42 and 52.
Environment
- Server: Apache 2.4.52 + PHP-FPM
- PHP: 8.x
- OS: Ubuntu (AWS LightSail)
- Bug is present in stock v30.0.01 install