Add Safe Browser enhancements and quiz security features by SayaliGangurde48 · Pull Request #877 · FOSSEE/online_test

SayaliGangurde48 · 2026-07-13T17:26:34Z

Summary

This PR adds Safe Browser functionality for Yaksh quizzes to provide a more secure online examination environment.

Changes Made

Added Safe Browser mode configuration for quizzes.
Added Safe Browser settings form.
Added fullscreen enforcement.
Added camera and microphone permission support.
Added tab switching detection.
Added fullscreen exit detection.
Added browser shortcut restrictions for exam mode.
Updated quiz creation and editing flow.
Added required database migrations.

prathamesh920

Please resolve the comments.

Also,
A. Keep multiple questions in the quiz and do testing.
And with multiple attempts to students

B. Please check!

Selecting full-screen mode exits automatically whenever the user moves to the next question.
(So user has to every time click Enter full screen mode)
Check if audio or camera permission is not given by the user,
then it should not allow student to start the exam!
On some violations it shows Time up and quits the quiz.
Also, after the violations it shows the page quit exam Yes or No.
If No is clicked then it starts the exam again with a new attempt.
This should not be allowed from here.

C. Check the flow for Quiz taken by the moderator as a Student or Teacher,
from the moderator's add quiz interface, then safe browser mode is not activated.

D. Camera and audio output is available where?
Means as a teacher how can he/she see?

E. Try to break the system in all the possible way.
JS is acting like a shield here, and the backend django is serving as per the behavior submitted by JS. If user tricks JS, then the backend will not be aware. So, some mechanism,
were there is a dedicated communication between the JS and the backend. And a state should be maintained.
Also, we need to sure if in between the user attempts to violate or stop the camera or audio, it should be tracked.

F. We need to ensure that unit/integration tests are added.

prathamesh920 · 2026-07-26T22:19:43Z

    <div class="card-body">
+
      {% if questionpaper.quiz.is_expired %}
-          <div class="alert alert-error">


So, these are formatting changes, and no code changes here or addition of code. There are various places this has happened so it makes the PR a bit heavy. I request to remove the formatting changes from this PR, there can be a separate PR for this later.
Wherever i can locate i will comment "formatting changes", can be undone.

prathamesh920 · 2026-07-26T22:20:02Z

 <div class="container">
  <div class="card">
    <div class="card-header">
-      {{questionpaper.quiz.description}}


formatting changes

prathamesh920 · 2026-07-26T22:20:16Z

+
      {% if questionpaper.quiz.is_expired %}
-          <div class="alert alert-error">
-              This Quiz has expired. You can no longer attempt this Quiz.


formatting changes
Below as well can be seen, kindly undo.

prathamesh920 · 2026-07-26T22:22:22Z

+
+          <strong>
+            This is your Attempt {{ attempt_num }}
+            of {{ questionpaper.quiz.attempts_allowed }}.


If infinite attempts allowed then it will display "-1"
In this case it should show "infinite"

prathamesh920 · 2026-07-26T22:23:31Z


 </script>
+
+<script>


Please make a separate JS file for this and include only when safe exam is selected.

prathamesh920 · 2026-07-26T22:35:07Z

-                    for tc_id in order
-                    ]
-        except TestCaseOrder.DoesNotExist:
+            testcase_order = TestCaseOrder.objects.get(


Why this change? It does the same thing.

prathamesh920 · 2026-07-26T22:36:03Z

        for f in files:
            zip_file.writestr(
-                os.path.join("additional_files", os.path.basename(f.file.name)),
+                os.path.join(


Below "formatting changes"

prathamesh920 · 2026-07-26T22:36:50Z

 from stats.models import TrackLesson
 from yaksh.forms import (
-    UserRegisterForm, UserLoginForm, QuizForm, QuestionForm,
+    UserRegisterForm, UserLoginForm, QuizForm,SafeBrowserForm,QuestionForm,


Put space after comma

prathamesh920 · 2026-07-26T22:40:50Z


    return my_render_to_response(request, 'yaksh/course_detail.html', context)

+import json


Already imported in the file on the top.

prathamesh920 · 2026-07-26T22:41:50Z

    return my_render_to_response(request, 'yaksh/course_detail.html', context)

+import json
+from django.views.decorators.http import require_POST


Please put this import at the top along with other django.views.decorators imports

prathamesh920 · 2026-07-26T23:55:50Z

+            ids = [
+                int(x)
+                for x in testcase_order.order.split(",")
+                if x.strip()


if tc_id.strip() can be added to the existing code

prathamesh920 · 2026-08-04T00:45:25Z

+    "use strict";
+
+    var violationCount = 0;
+    var MAX_VIOLATIONS = 3;


This shouldn't be a constant.

prathamesh920 · 2026-08-04T00:45:59Z

+            {% endif %}.
+          </strong>
+
+          {% if is_retry %}


is_retry = attempt_number > 1
So the message below will be displayed for normal attempts as well! (one without safe exam mode)

prathamesh920 · 2026-08-04T00:46:23Z

+
+            ids = [
+                int(tc_id)
+                for tc_id in testcase_order.order.split(",")


testcase_order not defined!
I suggest remove this fix as it is fixed in a different PR with tests

prathamesh920 · 2026-08-04T00:46:52Z

+                else:
+                    order = module.get_unit_order("quiz", quiz)
+
+            added_quiz = form.save(commit=False)


This will try to save invalid form as well!

prathamesh920 · 2026-08-04T00:47:03Z

+@require_POST
+@login_required
+def report_violation(request):
+    data = json.loads(request.body)


What if no answer paper or missing fields in JSON.
Error handling needed.
Also below, AnswerPaper not found should be caught

prathamesh920 · 2026-08-04T00:47:07Z

+        paper.status = "completed"
+        paper.end_time = timezone.now()
+
+        print("SAFE BROWSER TERMINATED =", paper.terminated_by_safe_browser)


Remove print()

prathamesh920 · 2026-08-04T00:47:10Z

+
+    paper.save()
+
+    print(


Remove print()

prathamesh920 · 2026-08-04T00:51:04Z

+
+
+@require_POST
+@login_required


Add @email_verified

prathamesh920 · 2026-08-04T00:51:55Z

+
+
+@require_POST
+@login_required


Add @email_verified

prathamesh920 · 2026-08-04T01:06:26Z

Please test Camera permission denied then what happens.

I suggest you add tests for:

Creating/editing a quiz with safe-browser mode.
Invalid QuizForm and Invalid SafeBrowserForm does not save.
report_violation increments count/terminates at max_violations.
report_violation rejects non-safe-browser quizzes.
Safe-browser terminated attempt does not resume.
Normal in-progress attempt still resumes.

Then make the changes to your code.

Then do manual testing as well.

Add Safe Browser enhancements and quiz security features

47d075d

prathamesh920 requested changes Jul 26, 2026

View reviewed changes

prathamesh920 reviewed Jul 26, 2026

View reviewed changes

Address PR review comments

0c4bd39

prathamesh920 reviewed Aug 4, 2026

View reviewed changes

Comment thread yaksh/views.py Outdated

paper.save()

print(

prathamesh920 Aug 4, 2026

Copy link
Copy Markdown

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove print()

prathamesh920 reviewed Aug 4, 2026

View reviewed changes

Comment thread yaksh/views.py

@require_POST

@login_required

prathamesh920 Aug 4, 2026

Copy link
Copy Markdown

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add @email_verified

prathamesh920 reviewed Aug 4, 2026

View reviewed changes

Comment thread yaksh/views.py

@require_POST

@login_required

prathamesh920 Aug 4, 2026

Copy link
Copy Markdown

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add @email_verified

Address review comments for Safe Browser integration

f4c645c


		return my_render_to_response(request, 'yaksh/course_detail.html', context)

		import json


		</script>

		<script>

Uh oh!

Conversation

SayaliGangurde48 commented Jul 13, 2026

Summary

Changes Made

Uh oh!

prathamesh920 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

prathamesh920 commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

prathamesh920 left a comment •

edited

Loading