Release notes for Safe Exam Browser version 3.7.1 for macOS:
SEB 3.7.1 adds the option to require specific SEB client versions in a configuration, allows fetching server certificates by URL in settings, and contains a security fix for certificate validation as well as several permission-handling and stability fixes.
New in SEB 3.7.1b2 (Build 15999)
-
Detecting apps with Accessibility permissions (setting detectAccessibilityApps) requires Full Disk Access to read the system permission (TCC) database. On macOS 11 the system does not grant apps read access to this database even when Full Disk Access is enabled, so this detection is now only performed on macOS 12 and newer. On macOS 11 SEB no longer shows a Full Disk Access prompt that could never be satisfied and starts normally (the accessibility app detection is simply unavailable there). Accordingly, the default minimum required macOS version has been raised to macOS 12.
-
Fixed Full Disk Access detection so SEB reliably recognizes when Full Disk Access has been granted (on macOS 12 and newer).
-
Fixed several permission and information dialogs (Full Disk Access, Location Services and the "minimum macOS version required" alert) not being displayed — or SEB freezing or continuing without waiting for the user — when running under the AAC Assessment Mode on macOS 11. These alerts are now shown reliably and correctly block the session start.
-
Fixed the Location Services permission dialog not closing automatically on macOS 11 once access is granted in System Settings.
-
Fixed an unnecessary Location Services permission dialog briefly appearing on macOS 11 even when access was already granted.
New in SEB 3.7.1b1 (Build 1598E)
-
Added "Allowed SEB Versions": exam administrators can now require that a configuration may only be used (and an exam only attempted) with one or more specific SEB client version(s). If the SEB version running on the device doesn't match the requirement, SEB displays an alert stating which version(s) are required and offers to open the SEB download page ("Download SEB") or to quit; in both cases SEB is quit, so it can't be used for the exam with a disallowed version. The requirements are configured in Settings / Security (see the new setting sebAllowedVersions below).
As this feature will only make sense when there will only be SEB macOS clients circulating which support the version check and because that is more secure, you should preferably use server-side SEB client version restrictions. -
Added fetching server certificates by URL in Settings / Network / Certificates: certificates to embed can now be retrieved directly from a URL.
-
Fixed improper certificate validation (CWE-295): removed the "authorized hosts" substring fallback in the server-trust evaluation, which could accept a certificate for a host whose name merely contained an authorized host name as a substring. Server trust is now matched correctly.
-
Fixed a crash when opening the Advanced Certificates sheet in Settings / Network / Certificates.
-
Fixed Full Disk Access permission detection on macOS 12 and 11. System permission prompts are now requested while the AAC Assessment Mode is off, and Full Disk Access is checked before requesting download/log folder access, so the prompts are shown reliably and aren't hidden behind the locked-down UI. Also the authorization dialog is no longer displayed when starting SEB with pressed option key (which displays Settings instead of starting a session).
-
Location Services access is now only requested when actually needed (to display Wi-Fi network names), when displaying the Wi-Fi control isn’t disabled and while SEB isn't locked down, so users aren't prompted unnecessarily.
-
Replaced the preset permitted process for the Cisco Secure Client with AnyConnect, which works when it is connected before starting SEB.
New Settings
sebAllowedVersions — Array of strings, default empty (no restriction)
Settings window: Security → "Allowed SEB Versions"
Specifies one or more SEB client versions required in order to use a configuration. Enter one restriction per row. Each restriction has the format OS.Major.Minor.[Patch].[Build].[AE].[min], where the parts in square brackets are optional:
OS— the operating system:Win,MacoriOS.Major,Minor— the major and minor version (required).[Patch],[Build]— optionally the patch and build version.[AE]— optionally indicates the Alliance Edition.[min]— optionally marks the value as the minimum required version (this version or any newer one); without it, the restriction is an exact match on the components you specified.
Examples: Win.3.9.min allows all SEB for Windows versions from 3.9 upwards; Mac.3.7.1 requires exactly SEB for macOS 3.7.1.
Only restrictions for the platform SEB is running on can allow the current build; a non-empty list that contains no satisfiable restriction for the running platform blocks it. When the running version isn't allowed, SEB shows an error message describing the requirement — phrased as a minimum ("… or higher") or as one or more specific versions, as configured — with a link to the SEB download page.