From 65c52e05d109f111f91dacfbe6ed00e8fa4bc234 Mon Sep 17 00:00:00 2001
From: Damyon Wiese <damyon@moodle.com>
Date: Tue, 7 Nov 2017 12:48:21 +0800
Subject: [PATCH] MDL-58699 mod_quiz: Require javascript for popup

If any of the access rules require the attempt to open in a new window, assume we
require javascript to attempt the quiz. This makes it harder to bypass the javascript
pseudo security restrictions.
---
 mod/quiz/renderer.php | 3 +++
 mod/quiz/styles.css   | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/mod/quiz/renderer.php b/mod/quiz/renderer.php
index 007ed6573ee..a2343393746 100644
--- a/mod/quiz/renderer.php
+++ b/mod/quiz/renderer.php
@@ -840,6 +840,9 @@ class mod_quiz_renderer extends plugin_renderer_base {
 
         $button = new single_button($url, $buttontext);
         $button->class .= ' quizstartbuttondiv';
+        if ($popuprequired) {
+            $button->class .= ' quizsecuremoderequired';
+        }
 
         $popupjsoptions = null;
         if ($popuprequired && $popupoptions) {
diff --git a/mod/quiz/styles.css b/mod/quiz/styles.css
index 41b97714bbe..6e85f990e76 100644
--- a/mod/quiz/styles.css
+++ b/mod/quiz/styles.css
@@ -360,11 +360,13 @@ table.quizattemptsummary .noreviewmessage {
     font-size: 0.7em;
 }
 
-.quizstartbuttondiv.quizsecuremoderequired input {
+.quizstartbuttondiv.quizsecuremoderequired input,
+.quizstartbuttondiv.quizsecuremoderequired button {
     display: none;
 }
 
-.jsenabled .quizstartbuttondiv.quizsecuremoderequired input {
+.jsenabled .quizstartbuttondiv.quizsecuremoderequired input,
+.jsenabled .quizstartbuttondiv.quizsecuremoderequired button {
     display: inline;
 }