Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-69645

Preferences window can be opened on Safe Exam Browser Mac clients during quizzes using manual configuration

    XMLWordPrintable

    Details

      Description

      When a quiz is configured with "Require the use of Safe Exam Browser: YES – Configure manually", on Mac clients, the Safe Exam Browser's Preferences window can be opened during the quiz, without having to enter a Safe Exam Browser (SEB) administrator password. When the Preferences window is open, then SEB temporarily switches off its kiosk (single app) mode. Students then can switch to any app on their Mac, including the Finder and web browsers and communication applications.

      Normally an SEB exam configuration MUST have an administrator password set, because it protects the Preferences menu to be opened on SEB for macOS. It also prevents an SEB configuration to be opened for editing in the SEB Config Tool on Windows. Editing config files isn’t the issue here, as the Config Key request header hash value check prevents students to access a quiz with an edited SEB configuration. Also Moodle generated SEB configuration files are not encrypted, therefore setting an administrator password to prevent editing the file isn't relevant. In this case only opening the Preferences window during a quiz is a problem, this can easily be prevented by including the SEB setting allowPreferencesWindow = false in the configuration generated by Moodle.

      Steps to reproduce:

      • Create a quiz and set "Require the use of Safe Exam Browser: YES – Configure manually"
      • Open the quiz with SEB for macOS (either SEB 2.1.5pre2 or SEB 2.2.1 for macOS)
      • Select "Preferences" from the "SafeExamBrowser" menu in the macOS menu bar or press cmd-, 
      • The Preferences menu is displayed, without having to enter any password. Now you can switch to other running applications using cmd-Tab

      Expected behavior:

      • Preferences window in SEB for macOS cannot be opened during a quiz

      Actual behavior:

      • Preferences window can be opened during the quiz

       

      To test the mitigating setting allowPreferencesWindow = false, you can select the "Config File" tab in the Preferences window and deselect (disable) "Allow to open preferences window on client", then tap "Apply and Restart SEB". Now you cannot open the Preferences menu anymore.

        Attachments

          Activity

            People

            Assignee:
            lucaboesch Luca Bösch
            Reporter:
            danschlet Daniel R. Schneider
            Peer reviewer:
            Tim Hunt
            Integrator:
            Sara Arjona (@sarjona)
            Tester:
            Carlos Escobedo
            Participants:
            Component watchers:
            Tim Hunt, Andrew Nicols, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Fix Release Date:
              14/Sep/20

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 hour, 25 minutes
                1h 25m