Notes About Security

Built-in protections

  • The Public Area and the Administration Area of TCExam are physically separated on the filesystem. This allows to add further access restrictions based on the filesystem and the web server, and the application ships .htaccess access controls.
  • To access the various TCExam resources you need a valid account (user/password) and a level equal to or greater than the requested resource level. The level of test takers and Public areas is 1 by default. TCExam also supports RADIUS, LDAP and CAS authentication, as well as custom authentication methods.
  • Passwords are stored using a modern password hashing algorithm.
  • Test takers may access a particular test only if they belong to a group enabled for that test.
  • Test takers may access a particular test only if their IP address is enabled for that test.
  • Test takers may execute a particular test only one time (unless authorized by an administrator, or the test is explicitly marked as repeatable).
  • TCExam may generate a unique test for each user by randomly selecting and ordering questions and alternative answers. This drastically reduces or eliminates the risk of copying between test takers.
  • The test time is kept by the server. At the end of the available time the test is automatically closed.
  • The full activity of the test taker is logged on the server, including statistical data (e.g. reaction time) and security data (e.g. IP address).
  • Another security benefit comes from TCExam being Open Source Software, because it is widely known that security by obscurity is not a secure practice in the long run.
  • If you use TCExam in a controlled environment (e.g. a computer room) you can also add all the traditional security measures such as keyloggers, video cameras and so on.

Security hardening in version 17

Version 17 includes a dedicated security-hardening pass:

  • Per-installation random secret. The shipped K_RANDOM_SECURITY value is now a placeholder; the installer generates a unique random secret for every install. The PDF result-access token (the ?email= link) fails closed while the secret is left at the placeholder or the old hardcoded default, so result PDFs cannot be retrieved with a guessable token.
  • CSPRNG-based codes. Verification codes and one-time values are generated with a cryptographically secure pseudo-random number generator.
  • Safe file/URL access. File and URL access is restricted through configurable path/host allow-lists (K_FILE_ALLOWED_PATHS / K_FILE_ALLOWED_HOSTS, and the K_PDF_ALLOWED_* options for the PDF engine).
  • Restricted registration groups. Self-registration can be limited to specific groups with K_USRREG_ALLOWED_GROUPS.

Recommended hardening checklist

  • After installation, delete the install/ directory and set restrictive file permissions (see the Installation page).
  • Log in with the default admin / 1234 account, create a new level-10 administrator with a strong password and remove the default admin user immediately.
  • Serve TCExam over HTTPS and protect the whole admin/ folder with web-server authentication.
  • Keep the admin/backup/ folder unreachable from the web (or move it elsewhere and set K_PATH_BACKUP in shared/config/tce_paths.php).
  • Keep PHP, the database and the Composer dependencies up to date.

For the full security policy and how to report a vulnerability, see SECURITY.md. Please report security issues privately instead of opening a public issue.