--- loncom/Attic/lchtmldir	2004/10/20 09:30:57	1.11
+++ loncom/Attic/lchtmldir	2010/10/12 09:53:45	1.22
@@ -2,6 +2,8 @@
 
 # The Learning Online Network with CAPA
 #
+# $Id: lchtmldir,v 1.22 2010/10/12 09:53:45 foxr Exp $
+#
 # Copyright Michigan State University Board of Trustees
 #
 # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
@@ -41,7 +43,7 @@
 #    NSCL
 #    Michigan State University8
 #    East Lansing, MI 48824-1321
-
+#
 #   General flow of control:
 #   1. Validate process state (must be run as www).
 #   2. Validate parameters:  Need two parameters:
@@ -61,7 +63,7 @@
 #       - internal - www:www/2775
 #       - local    - www:www/2775
 #
-
+#
 #
 #   Take a few precautions to be sure that we're not vulnerable to trojan
 #   horses and other fine issues:
@@ -69,7 +71,9 @@
 use strict; 
 use Fcntl qw(:mode);
 use DirHandle;
-
+use POSIX;
+use lib '/home/httpd/lib/perl/';
+use LONCAPA qw(:match);
 
 $ENV{'PATH'} = '/bin:/usr/bin:/usr/local/sbin:/home/httpd/perl';
 delete @ENV{qw{IFS CDPATH ENV BASH_ENV}};
@@ -84,8 +88,8 @@ if ($DEBUG) {
     print("Checking uid...\n");
 }
 my $wwwid = getpwnam('www');
-&DisableRoot;
-if($wwwid != $>) {
+
+if($wwwid != $<) {
     if ($DEBUG) {
 	print("User ID incorrect.  This program must be run as user 'www'\n");
     }
@@ -125,14 +129,14 @@ if( $authentication ne "unix:"     &&
     $authentication ne "localauth:") {
     if($DEBUG) {
 	print("Invalid authentication parameter: ".$authentication."\n");
-	print("Should be one of: unix, internal, krb4, localauth\n");
+	print("Should be one of-- unix: internal: krb4: krb5: localauth:\n");
     }
     exit 3;
 }
 
 # Untaint the username.
 
-my $match = $username =~ /^(\w+)$/;
+my $match = $username =~ /^($match_username)$/;
 my $patt  = $1;
  
 if($DEBUG) {
@@ -144,7 +148,7 @@ my $safeuser = $patt;
 if($DEBUG) {
     print("Save username = $safeuser \n");
 }
-if(($username ne $safeuser) or ($safeuser!~/^[A-za-z]/)) {
+if($username ne $safeuser) {
     if($DEBUG) {
 	print("User name $username had illegal characters\n");
     }
@@ -154,39 +158,57 @@ if(($username ne $safeuser) or ($safeuse
 #untaint the base directory require that the dir contain only 
 # alphas, / numbers or underscores, and end in /$safeuser
 
-$dir =~ /(^([\w\/]+))/;
 
-my $dirtry1 = $1;
 
-$dir =~ /$\/$safeuser/;
-my $dirtry2 = $1;
+my ($allowed_dir) = ($dir =~ m{(^([/]|$match_username)+)});
+
+my $has_correct_end = ($dir =~ m{/\Q$safeuser\E$});
 
-if(($dirtry1 ne $dir) or ($dirtry2 ne $dir)) {
+if(($allowed_dir ne $dir) or (!$has_correct_end)) {
     if ($DEBUG) {
 	print("Directory $dir is not a valid home for $safeuser\n");
     }
     exit 5;
 }
 
-
 # As root, create the directory.
 
-my $homedir = $dirtry1;
+my $homedir = $allowed_dir;
 my $fulldir = $homedir."/public_html";
 
 if($DEBUG) {
     print("Full directory path is: $fulldir \n");
 }
-if(!( -e $dirtry1)) {
+if(!( -e $homedir)) {
     if($DEBUG) {
-	print("User's home directory $dirtry1 does not exist\n");
+	print("User's home directory $homedir does not exist\n");
     }
     if ($authentication eq "unix:") {
         exit 6;
     }
 }
+if ($authentication eq "unix:") {
+    # check whether group $safeuser exists.
+    my $usergroups = `id -nG $safeuser`;
+    if (! grep /^$safeuser$/, split(/\s+/,$usergroups)) { 
+        if($DEBUG) {
+            print("Group \"$safeuser\" does not exist or $safeuser is not a member of that group.\n");
+        }
+        exit 7;
+    }
+}
+
+
+
 &EnableRoot;
 
+#  If authentication is internal and the top level directory exists
+#  give it the right permissions (in case this is a modification.
+
+if ($authentication eq "internal:") {
+    chmod(0711, $homedir);	# so www can enter ~/public_html.
+}
+
 &System("/bin/mkdir -p $fulldir")   unless (-e $fulldir);
     unless(-e $fulldir."/index.html") {
 	open OUT,">".$fulldir."/index.html";
@@ -214,14 +236,15 @@ END
     close OUT;
     }
 
-&System("/bin/chmod  02775  $fulldir");
-&System("/bin/chmod  0775  $fulldir"."/index.html");
+&System("/bin/chmod  02770  $fulldir");
+&System("/bin/chmod  0770  $fulldir"."/index.html");
 
 
 # Based on the authentiation mode, set the ownership of the directory.
 
 if($authentication eq "unix:") {	# Unix mode authentication...
-    &System("/bin/chown -R   $safeuser".":".$safeuser." ".$fulldir);
+    print "Unix auth\n";
+    &System("/bin/chown -R   $safeuser:$safeuser"." ".$fulldir);
     &JoinGroup($safeuser);
 } else {
     # Internal, Kerberos, and Local authentication are for users
@@ -237,11 +260,28 @@ if($authentication eq "unix:") {	# Unix
 	#  user's home directory that can reset ownerships and permissions
 	#  back the way the used to be.
 
-	&write_restore_script($homedir);
-
-	&System("/bin/chown -R root:root ".$homedir);
+	# This can take long enough for lond to time out, so we'll do it
+	# in a separate process that we'll not wait for.
+	#
+	my $fpid = fork;
+	if($fpid) {
+	    &DisableRoot;
+	    exit 0;
+	} else {
+	    print "Forked\n";
+	    POSIX::setsid();	# Disassociate from parent.
+	    print "Separate session\n";
+	    &write_restore_script($homedir);
+	    print "Restore script written\n";
+	    &System("/bin/chown -R root:root ".$homedir);
+	    &System("/bin/chown -R www:www  ".$fulldir);
+	    print "Exiting\n";
+	    exit 0;
+	}
+    } else {
+	&System("/bin/chown -R www:www  ".$fulldir);
     }
-    &System("/bin/chown -R www:www  ".$fulldir);
+
 }
 &DisableRoot;
 
@@ -283,7 +323,10 @@ sub DisableRoot {
 	print("Disable root: id = ".$>."\n");
     }
 }
-
+#
+#  Join the www user to the user's group.
+#  we must be running with euid as root at this time.
+#
 sub JoinGroup {
     my $usergroup = shift;
 
@@ -302,7 +345,16 @@ sub JoinGroup {
 	}
 	exit 6;
     }
-    
+    if (-e '/var/run/httpd.pid') {
+	open(PID,'/var/run/httpd.pid');
+	my $pid=<PID>;
+	close(PID);
+	my ($safepid) = $pid=~ /(\d+)/;
+	$pid = $safepid;
+	if ($pid) {
+	    my $status = system("kill -USR1 $safepid");
+	}
+    }
 }