diff --git a/src/main/java/org/olat/course/assessment/manager/AssessmentModeManagerImpl.java b/src/main/java/org/olat/course/assessment/manager/AssessmentModeManagerImpl.java index e4c6a426712f18039217a72579ae6c2093f75ad4..9238dccef0f115c21600769ceda0a2568f8f574d 100644 --- a/src/main/java/org/olat/course/assessment/manager/AssessmentModeManagerImpl.java +++ b/src/main/java/org/olat/course/assessment/manager/AssessmentModeManagerImpl.java @@ -319,6 +319,15 @@ public class AssessmentModeManagerImpl implements AssessmentModeManager { if(safeExamHash != null && safeExamHash.equals(hash)) { safe = true; } + + if(!safe && url.endsWith("/")) { + String strippedUrl = url.substring(0, url.length() - 1); + String strippedHash = Encoder.sha256Exam(strippedUrl + safeExamBrowserKey); + if(safeExamHash != null && safeExamHash.equals(strippedHash)) { + safe = true; + } + } + if(debug) { if(safeExamHash == null) { log.debug("Failed safeexambrowser request hash is null for URL: " + url + " and key: " + safeExamBrowserKey); diff --git a/src/test/java/org/olat/course/assessment/manager/AssessmentModeManagerTest.java b/src/test/java/org/olat/course/assessment/manager/AssessmentModeManagerTest.java index d70807ef439e187cff163eb38d9e1c1763890ef7..d8ae37030a9ce0f6c460972a4ac574fd7a458f1f 100644 --- a/src/test/java/org/olat/course/assessment/manager/AssessmentModeManagerTest.java +++ b/src/test/java/org/olat/course/assessment/manager/AssessmentModeManagerTest.java @@ -1036,6 +1036,27 @@ public class AssessmentModeManagerTest extends OlatTestCase { Assert.assertTrue(allowed); } + /** + * SEB 2.1 and SEB 2.2 use slightly different URLs to calculate + * the hash. The first use the raw URL, the second remove the + * trailing /. + */ + @Test + public void isSafelyAllowed_seb22() { + String safeExamBrowserKey = "a3fa755508fa1ed69de26840012fb397bb0a527b55ca35f299fa89cb4da232c6"; + String url = "http://kivik.frentix.com"; + String hash = Encoder.sha256Exam(url + safeExamBrowserKey); + + MockHttpServletRequest request = new MockHttpServletRequest(); + request.setServerName("kivik.frentix.com"); + request.setScheme("http"); + request.addHeader("x-safeexambrowser-requesthash", hash); + request.setRequestURI("/"); + + boolean allowed = assessmentModeMgr.isSafelyAllowed(request, safeExamBrowserKey); + Assert.assertTrue(allowed); + } + @Test public void isSafelyAllowed_fail() { String safeExamBrowserKey = "gdfkhjsduzezrutuzsf";