- attempts.py: dashboard quiz_stats now queries by attempted quizzes not
created quizzes — regular users now see per-quiz breakdown correctly
- documents.py: moderators/admins can fetch documents by ID (were getting
404 despite seeing them in the list); also restrict section creation and
delete to moderators via require_moderator
- nextcloud.py: sanitise filename in Content-Disposition header (strip
quotes, backslashes, newlines to prevent header injection)
- UploadPage.jsx: importing from Nextcloud no longer switches tab to local,
preserving the selected-file info display
- ResultsPage.jsx: fill-blank correct answers now show correct-bg (green)
instead of always showing wrong-bg (red)
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>