--- doc/loncapafiles/webserver.piml	2019/07/02 19:40:13	1.47
+++ doc/loncapafiles/webserver.piml	2024/08/05 15:45:16	1.62
@@ -2,7 +2,7 @@
 	"http://lpml.sourceforge.net/DTD/piml.dtd">
 <!-- webserver.piml -->
 
-<!-- $Id: webserver.piml,v 1.47 2019/07/02 19:40:13 raeburn Exp $ -->
+<!-- $Id: webserver.piml,v 1.62 2024/08/05 15:45:16 raeburn Exp $ -->
 
 <!--
 
@@ -48,7 +48,7 @@ http://www.lon-capa.org/
 <target dist='suse9.2 suse9.3 sles9'>/etc/httpd/httpd.conf</target>
 <target dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2'>/etc/apache2/default-server.conf</target>
 <target dist='debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12'>/etc/apache2/sites-available/loncapa</target>
-<target dist='ubuntu14 ubuntu16 ubuntu18'>/etc/apache2/conf-available/loncapa</target>
+<target dist='debian10 debian11 debian12 ubuntu14 ubuntu16 ubuntu18 ubuntu20 ubuntu22 ubuntu24'>/etc/apache2/conf-available/loncapa.conf</target>
 <note>This is for Apache 1.X for Red Hat 4ES, Fedora 2, 3 and 4, SusSE 9.2 and 9.3, and SLES 9 distributions. This is for Apache 2.X for Fedora 5, Red Hat 5, CentOS 5, Scientific Linux 5, Oracle Linux 5, SuSE 10.1, SLES 10, Debian 5, Ubuntu LTS 8 and later distributions</note>
 <dependencies dist='default'>
 /etc/httpd/conf/httpd.conf
@@ -59,8 +59,8 @@ http://www.lon-capa.org/
 <dependencies dist='debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12'>
 /etc/apache2/sites-available/loncapa
 </dependencies>
-<dependencies dist='ubuntu14 ubuntu16 ubuntu18'>
-/etc/apache2/conf-available/loncapa
+<dependencies dist='debian10 debian11 debian12 ubuntu14 ubuntu16 ubuntu18 ubuntu20 ubuntu22 ubuntu24'>
+/etc/apache2/conf-available/loncapa.conf
 </dependencies>
 <dependencies dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2'>
 /etc/apache2/default-server.conf
@@ -69,6 +69,71 @@ http://www.lon-capa.org/
 # Generated from doc/loncapafiles/webserver.piml
 use Socket;
 use Sys::Hostname::FQDN();
+use File::Spec;
+use Cwd();
+
+# For ubuntu 14 and later check for loncapa.conf in sites-available,
+# and conf-available, and for symlinks in sites-enabled, and conf-enabled
+if ('<DIST />' =~ /^ubuntu(\d+)$/) {
+    my $version = $1;
+    if ($version &gt; 12) {
+        if (-l '/etc/apache2/conf-enabled/loncapa.conf') {
+            my $linkfname = readlink('/etc/apache2/conf-enabled/loncapa.conf');
+            if ($linkfname ne '') {
+                $linkfname = Cwd::abs_path(File::Spec->rel2abs($linkfname,'/etc/apache2/conf-enabled'));
+            }
+            unless ($linkfname eq '/etc/apache2/conf-available/loncapa.conf') {
+                unlink('/etc/apache2/conf-enabled/loncapa.conf');
+            }
+        }
+        if (-e '/etc/apache2/conf-available/loncapa') {
+            system('mv /etc/apache2/conf-available/loncapa /etc/apache2/conf-available/loncapa.conf');
+        }
+        unless (-l '/etc/apache2/conf-enabled/loncapa.conf') {
+            if (-e '/etc/apache2/conf-available/loncapa.conf') {
+                my $currdir = Cwd::getcwd();
+                if ($currdir ne '') {
+                    chdir('/etc/apache2/conf-enabled');
+                    symlink('../conf-available/loncapa.conf','loncapa.conf');
+                    chdir($currdir);
+                }
+            }
+        }
+        if (-l '/etc/apache2/sites-enabled/000-default.conf') {
+            my $linkfname = readlink('/etc/apache2/sites-enabled/000-default.conf');
+            if ($linkfname ne '') {
+                $linkfname = Cwd::abs_path(File::Spec->rel2abs($linkfname,'/etc/apache2/sites-enabled'));
+            }
+            if (($linkfname eq '/etc/apache2/sites-available/loncapa') ||
+                ($linkfname eq '/etc/apache2/sites-available/000-default.conf')) {
+                unlink('/etc/apache2/sites-enabled/000-default.conf');
+            }
+        }
+        if (-e '/etc/apache2/sites-available/loncapa') {
+            system('mv /etc/apache2/sites-available/loncapa /etc/apache2/sites-available/loncapa.conf');
+        }
+        if (-l '/etc/apache2/sites-enabled/loncapa.conf') {
+            my $linkfname = readlink('/etc/apache2/sites-enabled/loncapa.conf');
+            if ($linkfname ne '') {
+                $linkfname = Cwd::abs_path(File::Spec->rel2abs($linkfname,'/etc/apache2/sites-enabled'));
+            }
+            unless ($linkfname eq '/etc/apache2/sites-available/loncapa.conf') {
+                unlink('/etc/apache2/sites-enabled/loncapa.conf');
+            }
+        }
+        unless (-l '/etc/apache2/sites-enabled/loncapa.conf') {
+            if (-e '/etc/apache2/sites-available/loncapa.conf') {
+                my $currdir = Cwd::getcwd();
+                if ($currdir ne '') {
+                    chdir('/etc/apache2/sites-enabled');
+                    symlink('../sites-available/loncapa.conf','loncapa.conf');
+                    chdir($currdir);
+                }
+            }
+        }
+    }
+}
+
 unless (-e "<TARGET />") {
   print '**** ERROR! <TARGET /> should exist! Are you missing the Apache '.
     'software package?';
@@ -76,22 +141,64 @@ unless (-e "<TARGET />") {
 }
 else {
   # Append loncapa_apache.conf inclusion to httpd.conf 
-  # (or sites-available/loncapa or conf-available/loncapa) if not present.
-  $flag=0;
-  open(IN,'&lt;<TARGET />');
-  while (&lt;IN&gt;) { 
-    if (/^\s*Include\s+conf\/loncapa_apache.conf/) {
-      $flag=1; 
+  # (or sites-available/loncapa or conf-available/loncapa.conf) if not present.
+  my $absolute_link;
+  if ('<DIST />' =~ /^sles(\d+)$/) {
+    my $version = $1;
+    if ($version &gt; 11) {
+      $absolute_link = 1;
     }
   }
-  close(IN);
-  unless ($flag==1) {
-    open(OUT,'&gt;&gt;<TARGET />');
-    print(OUT 'Include conf/loncapa_apache.conf'."\n");
-    close(OUT);
+  if ($absolute_link) {
+    # For SuSE and SLES /etc/apache2/default-server.conf needs to include:
+    # Include /etc/apache2/loncapa_apache.conf
+    # instead of:
+    # Include conf/loncapa_apache.conf
+    my $delflag=0;
+    my $addflag=1;
+    open(IN,'&lt;<TARGET />');
+    while (&lt;IN&gt;) {
+      if (/^\s*Include\s+conf\/loncapa_apache.conf/) {
+        $delflag=1;
+      }
+      if (/^\s*Include\s+\/etc\/apache2\/loncapa_apache.conf/) {
+        $addflag = 0;
+      }
+    }
+    close(IN);
+    if ($addflag) {
+      open(OUT,'&gt;&gt;<TARGET />');
+      print(OUT 'Include /etc/apache2/loncapa_apache.conf'."\n");
+      close(OUT);
+    }
+    if ($delflag==1) {
+      my $in='';
+      open(IN,'&lt;<TARGET />');
+      while(&lt;IN&gt;) {
+        $in.=$_ unless /^\s*Include\s+conf\/loncapa_apache.conf/;
+      }
+      close(IN);
+      open(OUT,'&gt;<TARGET />');
+      print(OUT $in);
+      close(OUT);
+    }
+  } else {
+    $flag=0;
+    open(IN,'&lt;<TARGET />');
+    while (&lt;IN&gt;) { 
+      if (/^\s*Include\s+conf\/loncapa_apache.conf/) {
+        $flag=1; 
+      }
+    }
+    close(IN);
+    unless ($flag==1) {
+      open(OUT,'&gt;&gt;<TARGET />');
+      print(OUT 'Include conf/loncapa_apache.conf'."\n");
+      close(OUT);
+    }
   }
   # Remove loncapa.conf inclusion from httpd.conf 
-  # (or sites-available/loncapa or conf-available/loncapa) if present.
+  # (or sites-available/loncapa or conf-available/loncapa.conf) if present.
   $flag=0;
   open(IN,'&lt;<TARGET />');
   while (&lt;IN&gt;) {
@@ -142,6 +249,12 @@ else {
           $conffile = '/etc/apache2/default-server.conf';
       } elsif ('<DIST />' =~ /^(debian|ubuntu)/) {
           $conffile = '/etc/apache2/sites-available/loncapa';
+          if ('<DIST />' =~ /^ubuntu(\d+)$/) {
+              my $version = $1;
+              if ($version &gt; 12) {
+                  $conffile = '/etc/apache2/conf-available/loncapa.conf';
+              }
+          }
       }
       print('**** ERROR **** '.$conffile.' has an overlapping definition of '.
             'ScriptAlias (it is incorrectly set to '.$scriptalias.').'."\n".
@@ -197,7 +310,7 @@ else {
             'of requests for http:// to https:// '."\n".'or:'."\n".$rewrite_off.
             ' - the file used to disable such rewriting'."\n\n".
             'This may be because '. $curr_rewrite.' has been '. 
-            'previously customized,'."\n".' or it may be because of a change '.  
+            'previously customized,'."\n".'or it may be because of a change '.  
             'to the files in '.$rewrite_dir."\n");
             if (open(my $fh,'&lt;',$curr_rewrite)) {
                 while(&lt;$fh&gt;) {
@@ -219,7 +332,7 @@ else {
                 || '<DIST />' eq 'sles9') {
                 $ssldir = '/etc/apache/vhosts.d';
             } elsif ('<DIST />' =~ /^(suse|sles)/) {
-                $ssldir = '/etc/apache2/vhosts.d';                  
+                $ssldir = '/etc/apache2/vhosts.d';
             } elsif ('<DIST />' =~ /^(debian|ubuntu)/) {
                 $ssldir = '/etc/apache2/sites-available';
             } else {
@@ -227,9 +340,11 @@ else {
             }
             my $hostname = Sys::Hostname::FQDN::fqdn();
             my $hostip = Socket::inet_ntoa(scalar(gethostbyname($hostname)) || 'localhost');
-            my @expected = ('RewriteCond %{REQUEST_URI} ^/adm/wrapper/ext/(?!https:\/\/)',
+            my @expected = ('RewriteEngine on',
+                            'RewriteCond %{HTTPS} =on',
+                            'RewriteCond %{REQUEST_URI} ^/adm/wrapper/ext/(?!https:)',
                             'RewriteCond %{QUERY_STRING} (^|&(|amp;))usehttp=1($|&)',
-                            'RewriteRule ^/adm/wrapper/ext/(?!https:\/\/) http://%{HTTP_HOST}%{REQUEST_URI} [R,L,NE]',
+                            'RewriteRule ^/adm/wrapper/ext/(?!https:) http://%{HTTP_HOST}%{REQUEST_URI} [R,L,NE]',
                             'RewriteCond %{REMOTE_ADDR} 127.0.0.1',
                             'RewriteRule (.*) - [L]');
             if (($hostip ne '') && ($hostip ne '127.0.0.1')) {
@@ -243,7 +358,8 @@ else {
                 my @rewrites;
                 if (opendir(my $dir,$ssldir)) {
                     my @sslconf_files;
-                    foreach my $file (!grep(/^\.$/,readdir($dir))) {
+                    foreach my $file (grep(!/^\./,readdir($dir))) {
+                        next if ($file =~ /\.rpmnew$/);
                         if (open(my $fh,'&lt;',"$ssldir/$file")) {
                             while (&lt;$fh&gt;) {
                                 if (/^\s*&lt;VirtualHost\s+[^:]*\:443&gt;\s*$/) {
@@ -255,19 +371,18 @@ else {
                         }
                     }
                     if (@sslconf_files) {
-                        my @rewrites;
                         foreach my $file (@sslconf_files) {
                             if (open(my $fh,'&lt;',"$ssldir/$file")) {
                                 my ($rewrite,$num) = (0,0);
                                 while (&lt;$fh&gt;) {
                                     if ($rewrite) {
-                                        if (/\s*&lt;\/IfModule&gt;/) {
+                                        if (/^\s*&lt;\/IfModule&gt;/) {
                                             $rewrite = 0;
                                             $num ++;
                                         } else {
                                             chomp();
-                                            s/^(\s+|\s+)$//g;
-                                            push(@{$rewrites[$num]},$_);                              
+                                            s/^\s+|\s+$//g;
+                                            push(@{$rewrites[$num]},$_);
                                         }
                                     } elsif (/^\s*&lt;IfModule\s+mod_rewrite.c&gt;/) {
                                         $rewrite = 1;
@@ -283,26 +398,28 @@ else {
                     foreach my $item (@rewrites) {
                         if (ref($item) eq 'ARRAY') {
                             my $found = 0;
-                            foreach my $item (@rewrites) {
+                            foreach my $line (@{$item}) {
                                 foreach my $match (@expected) {
-                                    if ($match eq $item) {
+                                    if ($match eq $line) {
                                         $found ++;
                                         last;
                                     }
                                 }
                             }
-                            if ($found &gt;= @expected) {
-                                $gotrules = 1;                                
+                            if ($found &gt;= scalar(@expected)) {
+                                $gotrules = 1;
+                                last;
                             }
                         }
                     }
                 }
             }
             unless ($gotrules) {
-                print('**** WARNING **** '.$curr_rewrite.' is currently set so rewrites '.
+                print('**** WARNING **** '."\n".$curr_rewrite.' is currently set so rewrites '.
                       'of http to https are enabled for most URLs.'."\n".
-                      'It is recommended to also set rewrites from https to http '.
-                      'in a file in '.$ssldir.' by including the following:'."\n".
+                      'Unless your Apache configuration includes Strict-Transport-Security '.
+                      '(with max-age > 0), it is recommended to also set rewrites from https to http '.
+                      'for specific URLs in a file in '.$ssldir.' by including the following:'."\n".
                       "&lt;IfModule mod_rewrite.c&gt;\n".'  '.
                       join("\n  ",@expected)."\n".
                       "&lt;/IfModule&gt;\n");