Add additional secure browser configurations

[rohansharmasitoula]

User description

Description

• Added additional SB configs for Secure Browser

Github Issue

• Resolves [Local Proview] [Moodle] Implement all configurations for secure browser #101

Checklist before requesting a review

• One line description of the changes is added in the PR
• Issue is linked to the PR via commits (eg: resolves #123)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires only a documentation update

---

PR Type

Enhancement

---

Description

• Introduced new functions redirect_to_wrapper and create_sb_wrapper to handle secure browser configurations, including blacklisted software and screen protection.
• Implemented logic to launch Secure Browser without proctoring, enhancing the flexibility of the system.
• Updated startProview function to handle additional secure browser parameters such as blacklisted software and kiosk mode.
• Updated Sentry DSN for improved error tracking across multiple files.
• Bumped plugin version to 2024110401 to reflect new changes and enhancements.

---

Changes walkthrough 📝

	Relevant files
Enhancement	tracker.php Add secure browser configuration handling in tracker API  classes/local/api/tracker.php Introduced redirect_to_wrapper and create_sb_wrapper functions for secure browser handling. Added logic to handle secure browser configurations like blacklisted software and screen protection. Updated error capturing with new Sentry DSN. +66/-2    injector.php Implement Secure Browser launch logic without proctoring  classes/local/injector.php Added logic to launch Secure Browser without proctoring. Updated Sentry DSN for error handling. +6/-2      datastore.php Populate secure browser settings in datastore                        datastore.php Added secure browser settings to the template. Implemented logic to handle blacklisted software and kiosk mode. +9/-0      frame.php Enhance startProview with secure browser parameters            frame.php Updated startProview function to include secure browser parameters. Modified Sentry DSN for error tracking. +36/-13  tracker.mustache Update tracker template for Secure Browser integration      templates/tracker.mustache Added logic to hide back button when using Secure Browser. Updated session type handling for quiz attempts. +16/-2
Configuration changes	version.php Update plugin version for new release                                        version.php Bumped plugin version to 2024110401. +2/-2

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 101 - Partially compliant Fully compliant requirements: Implement blacklisted apps for Windows and Mac Implement kiosk mode Implement content protection Send all configurations from DB via API when calling the wrapper link for Secure Browser Not compliant requirements: Add all parameters from DB to CDN while loading

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 Security concerns Sensitive information exposure: The startProview function in frame.php receives sensitive information like auth tokens and profile IDs as parameters. This could potentially expose this information to XSS attacks if the values are not properly sanitized or if they are inadvertently logged or displayed. Ensure that all sensitive data is properly protected, sanitized before use, and not exposed in any client-side scripts or logs.

⚡ Recommended focus areas for review Error Handling The create_sb_wrapper function catches all exceptions but only logs them. Consider adding more robust error handling or rethrowing critical errors. Error Handling The catch block in the inject function catches all exceptions, logs them, and then calls die(). This might lead to abrupt termination without proper cleanup or user-friendly error messages. Data Validation The code directly uses values from the database without validation. Ensure all user inputs and database values are properly sanitized and validated before use. Security Concern The startProview function receives sensitive information like auth tokens. Ensure this data is properly protected and not exposed to potential XSS attacks.

[qodo-merge-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Store sensitive configuration data outside of the source code to improve security and maintainability Consider using a configuration file or environment variable to store the Sentry DSN instead of hardcoding it in the source code. classes/local/injector.php [133] -\Sentry\init(['dsn' => 'https://[email protected]/149' ]); +$sentryDsn = get_config('local_proview', 'sentry_dsn'); +\Sentry\init(['dsn' => $sentryDsn]); Apply this suggestion Suggestion importance[1-10]: 9 Why: Storing sensitive data like DSN in configuration files enhances security and makes it easier to manage different environments without changing the code.	9
	Use a more secure method for redirecting to prevent potential security vulnerabilities Consider using a more secure method for redirecting, such as the Moodle redirect() function, instead of using JavaScript to set window.location. classes/local/api/tracker.php [95] -echo "<script> window.location='$wrapper_response->signed_url';</script>"; +redirect($wrapper_response->signed_url); Apply this suggestion Suggestion importance[1-10]: 8 Why: Using JavaScript for redirection can be a security risk. The Moodle redirect() function is a more secure and standard way to handle redirections in Moodle.	8
	Implement Content Security Policy to enhance security by controlling which resources can be loaded Consider using Content Security Policy (CSP) headers to restrict the sources of content that can be loaded, especially for inline scripts and external resources. frame.php [53-57] +<?php +// Add this at the top of your PHP file +header("Content-Security-Policy: script-src 'self' https://browser.sentry-cdn.com 'sha384-4zdOhGLDdcXl+MRlpApt/Nvfe6A3AqGGBil9+lwFSkXNTv0rVx0eCyM1EaJCXS7r'"); +?> <script src="https://browser.sentry-cdn.com/5.18.1/bundle.min.js" integrity="sha384-4zdOhGLDdcXl+MRlpApt/Nvfe6A3AqGGBil9+lwFSkXNTv0rVx0eCyM1EaJCXS7r" crossorigin="anonymous"> </script> Apply this suggestion Suggestion importance[1-10]: 8 Why: Adding a Content Security Policy significantly improves security by restricting the sources of content that can be loaded, reducing the risk of XSS attacks.	8
Best practice	Implement more robust error handling to improve system reliability and debugging capabilities Consider using a more robust error handling mechanism, such as try-catch blocks or custom error handlers, instead of relying solely on Sentry for error capturing. classes/local/api/tracker.php [128-135] try { $curl->setHeader(array('Content-Type: application/json', 'Authorization: Bearer ' . $auth_token)); $response = $curl->post($url, json_encode($data)); $decoded_response = json_decode($response, false); + if ($decoded_response === null && json_last_error() !== JSON_ERROR_NONE) { + throw new \Exception('Failed to decode JSON response'); + } return $decoded_response; } catch (\Throwable $err) { self::capture_error($err); + // Log error or handle it appropriately + return null; } Apply this suggestion Suggestion importance[1-10]: 7 Why: The improved error handling provides better insight into potential issues, especially with JSON decoding, and allows for more graceful error recovery.	7

💡 Need additional feedback ? start a PR chat