Page Comparison

...

Lessons management of HTML pages

By default, Lessons uses Content Security Policy headers to restrict what an HTML page can do, when the page is loaded from Sakai.

This is a security tradeoff. There are security risks from opening a web page written by someone else. That page can contain Javascript, which will execute with your own permissions. For this reason, by default Sakai will not open web pages in Resources. If you click on an HTML file there, it will download. We considered this inaccessible for Lessons, since the whole point of Lessons is to present content online. But we still had to deal with the security problem. So the page is served with an HTTP header that causes browsers to open the page in a “sandbox.” This restricts what the page can do.

This is new in 11. In Sakai 10, Lessons would simply open any HTML page specified.

You can restore the Sakai 10 behavior by adding the following to sakai.properties:

lessonbuilder.use-csp-headers=false

The recommended approach for dealing with this security risk is to use Sakai’s content domain support. This causes HTML pages stored in resources to be served from a different hostname than the main Sakai hostname. E.g. if your institution uses sakai.univ.edu, you might use content.sakai.univ.edu for content, resulting in URL such as https://content.sakai.univ.edu/access/content/group ….  Using a separate domain prevents web pages from executing with your Sakai privileges. Thus if you are using a separate content domain, Lessons does not add the Content Security Policy headers.

Note that it is up to the browser to enforce Content Security Policy. Safari, Chrome, and Edge do. Firefox does not. Thus Firefox users are still at risk when opening HTML pages in Lessons. I believe IE 10 and 11 also support it.

Dashboard not included

The Dashboard tool, new for Sakai 11, has not been included in the 11.0 release because too many technical issues existed and not enough person-power to address them in time for the release.

...

STEP (Samigo Test and Quizzes Enhancement Project) feature to allow different delivery settings for specific sections, groups, and individuals , did not make it into Sakai 11.0 due to issues with the Auto Submit feature and data storage and retrieval issues. We are hoping to have this go into a later 11.x maintenance release. 

A number of other features were delivered as a result of STEP for 11.0 including:

Features on by default in Sakai 10, turned off by default in Sakai 11

...

Highly recommended settings to override default values

# ######################################
# SAK-29271 Feedback Tool Properties
# ######################################
# Recipient address that will receive the contact emails
# feedback.technicalAddress = someaddress@institution.org

# Enable/Disable the content panel
# DEFAULT: true
# feedback.show.content.panel = false

# Enable/Disable the help panel
# DEFAULT: true
# feedback.show.help.panel = false

# Enable/Disable the technical panel
# DEFAULT: true
# feedback.show.technical.panel = false

# Enable/Disable the suggestions panel
# DEFAULT: true
# feedback.show.suggestions.panel = false

# Configure the help link destination (Sakai help by default)
# feedback.helpPagesUrl = /portal/help/main

# Configure the help link target
# feedback.helpPagesTarget = _blank

# Configure the helpdesk destination
# feedback.helpdeskUrl = https://helpdesk.institution.org

# Configure the suggestion link destination
# feedback.featureSuggestionUrl = https://suggestions.institution.org

# Add supplementary information at the right side of the tool
# feedback.supplementaryInfo = Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum

# Maximum size for the feedback attachments. This value should be lower than content.upload.max value, if it's higher the tool will use content.upload.max value
# feedback.attach.max = 10

...

Sakai 11 skins using Morpheus

...