The current CVS code for quizzes now has quiz timers.
You can test it here: http://moodle.org/mod/quiz/view.php?id=2349
Please try to break it and work around it (as students).
Martin, I was able to bypass the timer on Firefox 0.8 by doing the following:
- Load quiz, wait for timer to start.
- Firefox->Preferences, disable Javascript.
- Go to fridge, get a beer, let the dogs out.
- Firefox->Preferences, enable Javascript.
- Answer questions, double-check answers.
- Select submit.
2 minutes, scored 8.3.
I believe step #3 is optional.
I don't believe you'll be able to accomplish this with any sort of timing operation depending on the client. I'm working on this too, and the approach I'm taking is the following:
- Send quiz, along with random quiz key of sufficient length and randomness that a student will in all likelihood not be able to reproduce or guess it.
- Start the timer.js routine, just to give the student an idea of how much time they have.
- At end of time, submit page. Compare the quiz key with the copy stored on the server side. If the key is incorrect, or has been modified, the quiz is invalid. Compare the timestamp of the quiz key when generated with the current timestamp. If the difference is greater than the time allotted plus a margin of error, the quiz is invalid (obviously because the student tried to outwit the timer).
--Brian
Martin, after thinking about this, it seems that all you need to do to "secure" your code is generate a unique pseudorandom number on the server side (something like
md5(uniqid(rand(),true))
), and store that, a creation timestamp, and an expiration timestamp in a DB table. Send the PR number with the questions after the confirmation dialog. Then simply verify the PR number when the quiz is submitted with those in the DB. If you use the right function, the probability of generating two unique PR numbers will be close to nil.
DB storage requirements would be minimal, and since you're storing both the creation and expiration timestamp, it would be trivial to delete the quiz ID records in the DB that have expired, maybe as part of cron.php.
--Brian
md5(uniqid(rand(),true))
), and store that, a creation timestamp, and an expiration timestamp in a DB table. Send the PR number with the questions after the confirmation dialog. Then simply verify the PR number when the quiz is submitted with those in the DB. If you use the right function, the probability of generating two unique PR numbers will be close to nil.
DB storage requirements would be minimal, and since you're storing both the creation and expiration timestamp, it would be trivial to delete the quiz ID records in the DB that have expired, maybe as part of cron.php.
--Brian
Thanks for trying it, Brian.
I hadn't thought of switching off Javascript during the test, however it's not a problem. I already know you've taken 2 minutes (on a 1 minute quiz) and have thus cheated, so I'd mark your attempt with zero grade. I'll make sure the code does this automatically (with an appropriate margin of error to allow for timing differences or computer slowdown).
I don't think your keys etc are relevant here. The time of the start of the attempt is already being recorded, you see.
I hadn't thought of switching off Javascript during the test, however it's not a problem. I already know you've taken 2 minutes (on a 1 minute quiz) and have thus cheated, so I'd mark your attempt with zero grade. I'll make sure the code does this automatically (with an appropriate margin of error to allow for timing differences or computer slowdown).
I don't think your keys etc are relevant here. The time of the start of the attempt is already being recorded, you see.
It wasn't clear to me you were checking times on the server side as well. Pretty slick! I've tried hacking away on the loaded page, and can certainly convince myself it only takes a minute, but what a surprise that will be when a student discovers the error of their ways. When do you plan on making it available?
Great stuff! Thanks, Martin!
Just FYI - on the results page, the time taken showed 1min 1sec although I only let the timer run until it expired (i.e. I did not click on the button on the bottom of the quiz page). This could result in problems with your anti-cheating idea that checks the time taken vs. the limit.
Sascha
Not very sophisticated attempts to break but did the following and it didn't break. 
XP, IE6
Changed PC time
Browser back button
Closed re-opened browesr
Navigated from and to quiz
This is what I did:
When the timer was at 1 second I started hitting the browser's "Stop" button like crazy. This allowed me to prevent the automatic submission of the quiz. The timer started counting negative (started at -1:59:59). I then took a few minutes to answer the quiz and submitted it.
I think the important point is that in both my workaround and Brian's workaround although the student is able to take spend longer than expected in the quiz, but the report still gives the real time (more than 1 minute).
I've got a suggestion: maybe the quiz report page should highlight times which exceed the time allowed (the times could be shown in red, or something similar).
And some doubts: I'm not sure the quiz should be automatically submitted once the time has expired. Maybe just a javascript dialoge saying "The time has expired, please, submit the quiz now." This autosubmission feature will encourage students to search for workarounds, and they will find them (vide Brian's or my workaround). The students are only cheating themselves (because the correct time is recorded, anyway), but this feature I believe creates the wrong type of attitude. Maybe the message that Moodle should pass to the students sould rather be "Hey, this timer is for your information only, the time is in fact recorded on the server, so you can try to hack the timer, but stopping it in fact only works against you". What do you think?
When the timer was at 1 second I started hitting the browser's "Stop" button like crazy. This allowed me to prevent the automatic submission of the quiz. The timer started counting negative (started at -1:59:59). I then took a few minutes to answer the quiz and submitted it.
I think the important point is that in both my workaround and Brian's workaround although the student is able to take spend longer than expected in the quiz, but the report still gives the real time (more than 1 minute).
I've got a suggestion: maybe the quiz report page should highlight times which exceed the time allowed (the times could be shown in red, or something similar).
And some doubts: I'm not sure the quiz should be automatically submitted once the time has expired. Maybe just a javascript dialoge saying "The time has expired, please, submit the quiz now." This autosubmission feature will encourage students to search for workarounds, and they will find them (vide Brian's or my workaround). The students are only cheating themselves (because the correct time is recorded, anyway), but this feature I believe creates the wrong type of attitude. Maybe the message that Moodle should pass to the students sould rather be "Hey, this timer is for your information only, the time is in fact recorded on the server, so you can try to hack the timer, but stopping it in fact only works against you". What do you think?
I agree with you about the attitude, Prem, but basically you can do that already in Moodle without a timer and a nice explanation up the top. 
I believe most people who want a timer will want the auto-submit, if only to minimise excuses from students.
I believe most people who want a timer will want the auto-submit, if only to minimise excuses from students.
I like the "student still has to submit' option when the time is up.
It is in the spirit of "student in control" and "good attitude".
We had a room where the teacher could take over the pc-control and - even as a group of teachers during a meeting - you do not like that when somenone really does that.
(small message on the bottom: "start and endtime for this quizz are registrated on the server, this timer is an indicator for you.")