Penfro Posted October 5, 2015 Posted October 5, 2015 Having updated to the latest version of LanSchool (version 7.8.1.39) over the summer I was horrified to see that despite setting channels in the same way as our old version (7.0), it is now possible for a teacher PC to circumvent this by clicking on the Class List icon to view client pc's that are on other channels. This was particularly worrying because we use one channel for Admin PC's - this latest version allows anybody with a Teacher Installation to browse other staff pc's regardless of their channel being set! I cannot quite understand why LanSchool acknowledges the need to set a channel within their Utils folder yet provides an icon that effectively bypasses their own restriction in the GUI!! It's such a shame because apart from that the software is very good and is pitched at a good price-point. Sadly I have had to uninstall the program due to this (what I consider) major flaw in security.
Penfro Posted October 5, 2015 Author Posted October 5, 2015 It's been reported to our vendor who acknowledges the security issue and has been in touch with the developers but that was a month ago and still no patch to fix it.
Penfro Posted October 5, 2015 Author Posted October 5, 2015 I'm at the end of my tether with it. We rolled out the updated client software to over 600 devices in the summer only to find this flaw once the school term started. After a month of waiting, the natives are getting restless because they are missing the other functionality so I'm going to have to start looking at alternatives. Impero looks good but I think the costs for our size of school are too prohibitive.... I saw NetSupport at BETT so might give that a trial first...
FN-GM Posted October 5, 2015 Posted October 5, 2015 We rolled out the updated client software to over 600 devices in the summer only to find this flaw once the school term started. There seems to be a problem with your software testing process. Im surprised this wasn't picked up?
Dos_Box Posted October 5, 2015 Posted October 5, 2015 (edited) It's been reported to our vendor who acknowledges the security issue and has been in touch with the developers but that was a month ago and still no patch to fix it. Have you spoken to LanSchool directly yet? It's probably best you do not go via a third party if you are entitled to support it would be best to get your voice heard rather than rely on someone else to do it for you. Edited October 5, 2015 by Dos_Box
Penfro Posted October 6, 2015 Author Posted October 6, 2015 (edited) There seems to be a problem with your software testing process. Im surprised this wasn't picked up? I asked for an evaluation of the new version before we rolled it out but it would only allow one "DEMO" channel so it was not something that could ever have got flagged. I've spoken to Lanschool direct but they weren't helpful and the Support Rep couldn't understand why I had a problem with it (unbelievable I know!!!) The option to roll back is a good one but although it works for demo's, internet restrictions, etc didn't work - which is why I opted for the upgrade. Thanks for all your suggestions everybody! Edited October 6, 2015 by Penfro
Penfro Posted October 6, 2015 Author Posted October 6, 2015 Would mean buying another product to manage those (130 clients) + privacy issues of normal classroom teachers being able to view (and remote control, etc) activity in other classrooms which wouldn't be acceptable.
dverwolf Posted October 9, 2015 Posted October 9, 2015 ...allows anybody with a Teacher Installation to browse other staff pc's regardless of their channel being set! Penfro, we really appreciate your support and thank you for using LanSchool! I have spoken with our Product Manager about this concern. We've made a change the software that will now give you the ability to restrict a teacher from browsing for students on other channels. To get this new build immediately (rather than wait for the next general release), please reach out to our support team directly at https://helpdesk.stone-ware.com and reference bug #18695. I hope this helps! Thanks again for using LanSchool! 1
dverwolf Posted October 9, 2015 Posted October 9, 2015 (edited) I was able to get a little more information and have another solution that you can apply TODAY that should address your concern. In exisiting builds of LanSchool 7.8, there is already a registry value that can be used to disable the "Browse for Students" button in the Manage Class Lists dialog. Simply add the following registry key to teacher machines to disable this feature. (32bit OS’s) Key: HKEY_LOCAL_MACHINE\Software\LanSchool\ Value: DisableBrowseForStudents = 1 (64bit OS’s) Key: HKEY_LOCAL_MACHINE\Software\Wow6432Node\LanSchool\ Value: DisableBrowseForStudents = 1 Again, I hope this helps address your concern. Please reach out if you have any questions. Thanks again for using LanSchool! Edited October 9, 2015 by dverwolf formatting
Penfro Posted October 13, 2015 Author Posted October 13, 2015 Thank you for your input. Much valued. Sadly this is not an acceptable fix. It only disables two browse buttons but still allows the Manage Class Lists\Import Students button which allows you to very easily circumvent the channels again without needing anything other than basic knowledge of other people on the system.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now