fix/sb without proctoring

[devang1281]

User description

• Update Sentry DSN to self Hosted Servers
• Fix Proctoring not working and Hiding Back button on quiz page for sb exams

---

PR Type

Bug fix, Enhancement

---

Description

• Updated the Sentry DSN across multiple files to point to a new self-hosted server.
• Changed the redirection method in tracker.php from a PHP redirect to a JavaScript-based approach.
• Added logic to handle Secure Browser sessions without proctoring in injector.php.
• Updated plugin version and release information in version.php.
• Enhanced the quiz interface to hide the back button when launched in Secure Browser in tracker.mustache.

---

Changes walkthrough 📝

	Relevant files
Enhancement	tracker.php Update redirection method and Sentry DSN                                  classes/local/api/tracker.php Changed redirection method from PHP redirect to JavaScript window location. Commented out a debug statement. Updated Sentry DSN to a new server. +4/-3      injector.php Add Secure Browser logic and update Sentry DSN                      classes/local/injector.php Added logic for launching Secure Browser without Proctoring. Updated Sentry DSN to a new server. +3/-1      frame.php Update Sentry DSN in HTML frame                                                    frame.php Updated Sentry DSN to a new server. +1/-1      tracker.mustache Enhance quiz interface for Secure Browser                                templates/tracker.mustache Added condition to hide back button in Secure Browser. Modified logic for session type handling. +16/-2
Configuration changes	version.php Update plugin version and release                                                version.php Updated plugin version and release information. +2/-2

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 Security concerns Sensitive information exposure: The PR includes changes to Sentry DSN (Data Source Name) across multiple files. While updating to a self-hosted server can improve security, exposing the DSN in client-side code (as seen in frame.php) could potentially allow unauthorized access to error logs. It's crucial to ensure that the new Sentry configuration doesn't inadvertently expose sensitive information or debugging details to end-users.

⚡ Recommended focus areas for review Potential Security Risk The change from PHP redirect to JavaScript-based redirect might introduce security vulnerabilities if not properly implemented. This should be carefully reviewed to ensure it doesn't allow for potential XSS attacks. Logic Complexity The added logic for launching Secure Browser without Proctoring increases the complexity of the code. This should be reviewed to ensure it doesn't introduce any unintended side effects or edge cases. Browser Compatibility The new code to hide the back button relies on string matching in English. This approach might not work for non-English interfaces and could potentially break functionality in certain browsers or configurations.

[qodo-merge-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Use server-side redirection instead of client-side JavaScript for improved security and reliability Instead of using JavaScript to redirect, consider using PHP's header() function for a more secure and reliable redirection method. This avoids potential issues with JavaScript being disabled or manipulated client-side. classes/local/api/tracker.php [95] -echo "<script> window.location='$wrapper_response->signed_url';</script>"; +header("Location: $wrapper_response->signed_url"); +exit(); Apply this suggestion Suggestion importance[1-10]: 8 Why: The suggestion to use PHP's header() function for redirection instead of JavaScript improves security and reliability by preventing client-side manipulation and ensuring redirection even if JavaScript is disabled.	8
Maintainability	Extract complex conditional logic into a separate method for better code organization The condition for launching Secure Browser without Proctoring is complex and nested. Consider extracting this logic into a separate method for improved readability and maintainability. classes/local/injector.php [81-84] -if ((!$quizaccess_proctor_setting) || - ($quizaccess_proctor_setting && $quizaccess_proctor_setting->proctortype == 'noproctor')) { - if (($quizaccess_proctor_setting->tsbenabled && strpos($_SERVER ['HTTP_USER_AGENT'], "Proview-SB") === FALSE)) { - $t = new api\tracker(); +if (self::should_launch_secure_browser_without_proctoring($quizaccess_proctor_setting)) { + $t = new api\tracker(); Apply this suggestion Suggestion importance[1-10]: 7 Why: Extracting the complex conditional logic into a separate method enhances code readability and maintainability by reducing nesting and improving organization.	7
Best practice	Extract repeated user agent check into a reusable function to reduce code duplication The user agent check for Proview-SB is repeated in multiple places. Consider extracting this check into a reusable function to avoid duplication and improve maintainability. templates/tracker.mustache [102-104] -if (window.navigator.userAgent.match(/Proview-SB/)) { +function isProviewSB() { + return window.navigator.userAgent.match(/Proview-SB/); +} + +if (isProviewSB()) { console.log("User Agent: ", window.navigator.userAgent); document.querySelectorAll('a').forEach(link => { Apply this suggestion Suggestion importance[1-10]: 7 Why: Extracting the repeated user agent check into a reusable function reduces code duplication and enhances maintainability by centralizing the logic in one place.	7
Enhancement	Simplify the code for hiding the back button to improve efficiency and readability The code for hiding the back button is repetitive and could be simplified. Consider using a more efficient selector and a single condition check to improve performance and readability. templates/tracker.mustache [104-111] -document.querySelectorAll('a').forEach(link => { - const urlContainsIndex = link.href.includes('moodle/mod/quiz/view.php'); - const textContainsBack = link.textContent.trim().toLowerCase().includes('back'); - if (urlContainsIndex && textContainsBack) { - // Hide the element by setting its display style to none +document.querySelectorAll('a[href*="moodle/mod/quiz/view.php"]').forEach(link => { + if (link.textContent.trim().toLowerCase().includes('back')) { link.style.display = 'none'; } }); Apply this suggestion Suggestion importance[1-10]: 6 Why: The suggestion simplifies the code for hiding the back button, improving efficiency and readability by using a more efficient selector and reducing redundancy.	6

💡 Need additional feedback ? start a PR chat