search

SafeExamBrowser / seb-win-refactoring

Safe Exam Browser for Windows.
https://www.safeexambrowser.org/news_en.html
Mozilla Public License 2.0
166 stars 108 forks source link

request for /theme/boost_ethz/sebuser.php #552

Closed KBorm closed 1 year ago

KBorm commented 1 year ago

We had "some communication problems" between SEB and Moodle that may be caused by our environment (not yet clear). The client always loses the connection to the server.

Examining our communation logs we found the following error messages on SEB client side: 

    "GET /theme/boost_ethz/sebuser.php HTTP/1.1" 404

The SEB client requested a /theme/boost_ethz/sebuser.php page which does not exist on the Moodle server. Not even the theme boost_ethz exists. The theme boost_ethz cannot be found for download anywhere.

In the SEB source code file ResourceHandler.cs there is a line with the hard coded request URL. 

    var message = new HttpRequestMessage(HttpMethod.Get, $"{uri.Scheme}{Uri.SchemeDelimiter}{uri.Host}/theme/boost_ethz/sebuser.php");

This line will always fail as the file does not exist. We do not know if this is actually a problem, but it is confusing.

This bug was already reported as #160.

Steps to Reproduce Steps to reproduce the behavior: ??

Version Information

danschlet commented 1 year ago

This file provides a REST endpoint we use in our custom Moodle theme. This is used as a workaround in the current integration of Moodle with SEB Server to determine the Moodle user name after a user logs in to Moodle. If you're not using our custom Moodle theme, then this will always fail as you said. Actually our implementation seems to query this script every time when a Moodle session cookie is identified, even if not using SEB Server, which doesn't make much sense. We should limit it to SEB Server sessions and possibly have a SEB setting to enable/disable this check. It will anyways get obsolete when we release the final SEB Server integration for Moodle (development currently ongoing).

We will disable these requests in the next SEB updates to prevent any possible side effects. But I'm not sure if this really can cause communication issues with Moodle (looking into logs in browser consoles you often see failed requests to some non-existing files, was my impression in the past).

dbuechel commented 1 year ago

We had "some communication problems" between SEB and Moodle that may be caused by our environment (not yet clear). The client always loses the connection to the server.

This hardly is the reason for these issues, but it indeed would make sense to only perform these requests when necessary (i.e. when the current session is using SEB Server), as @danschlet already mentioned.

dbuechel commented 1 year ago

The change can now be tested in the latest beta build for version 3.5.0: https://sebdev-let.ethz.ch/api/buildjobs/91lrp0snq6av4g1x/artifacts/SEB_3.5.0.530_SetupBundle.exe.