Whenever quizmaker makes a quiz, it stores it on the server. It does this by asking the user to enter in the name of the path and file and then puting the two together to determine where to store the file. This has the potential of opening holes which hackers can burrow through and inexperienced users can slip through without realizing it. Likewise it will not accept any filename that starts with a period. Before writing any files, QuizMaker checks to see if the path has its permissions set correctly and if the filenames exist.
Permissions are important.
This is where the major hazard comes in. This provides greater flexiblity because it allows individual users to store the file in specific directories, yet it opens a security hole because it could give a user the ability to access an unauthorized directory. This is why precautions have to be taken. For one thing, treat the path information as confidential information which should only be put into the hands of trusted individuals. Emphasize to teachers that it has to be entered exactly as it is written.