--- loncom/auth/lonacc.pm	2014/05/05 23:17:12	1.155
+++ loncom/auth/lonacc.pm	2015/03/11 17:27:15	1.159.2.1
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Cookie Based Access Handler
 #
-# $Id: lonacc.pm,v 1.155 2014/05/05 23:17:12 raeburn Exp $
+# $Id: lonacc.pm,v 1.159.2.1 2015/03/11 17:27:15 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -283,14 +283,17 @@ sub sso_login {
     my ($r,$handle,$username) = @_;
 
     my $lonidsdir=$r->dir_config('lonIDsDir');
-    if (($r->user eq '') || ($username ne '') ||
+    if (($r->user eq '') || ($username ne '') || ($r->user eq 'public:public') ||
         (defined($env{'user.name'}) && (defined($env{'user.domain'}))
 	  && ($handle ne ''))) {
 	# not an SSO case or already logged in
 	return undef;
     }
 
-    my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/);
+    my ($user) = ($r->user =~ m/^($match_username)$/);
+    if ($user eq '') {
+        return undef;
+    }
 
     my $query = $r->args;
     my %form;
@@ -307,7 +310,10 @@ sub sso_login {
     my %sessiondata;
     if ($form{'iptoken'}) {
         %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'});
-        my $delete = &Apache::lonnet::tmpdel($form{'token'});
+        my $delete = &Apache::lonnet::tmpdel($form{'iptoken'});
+        unless ($sessiondata{'sessionserver'}) {
+            delete($form{'iptoken'});
+        }
     }
 
     my $domain = $r->dir_config('lonSSOUserDomain');
@@ -319,8 +325,8 @@ sub sso_login {
 	&Apache::lonnet::logthis(" SSO authorized user $user ");
         my ($is_balancer,$otherserver,$hosthere);
         if ($form{'iptoken'}) {
-            if (($sessiondata{'domain'} eq $form{'udom'}) &&
-                ($sessiondata{'username'} eq $form{'uname'})) {
+            if (($sessiondata{'domain'} eq $domain) &&
+                ($sessiondata{'username'} eq $user)) {
                 $hosthere = 1;
             }
         }
@@ -361,7 +367,7 @@ sub sso_login {
 		      'server'    => $r->dir_config('lonHostID'),
 		      'sso.login' => 1
 		      );
-            foreach my $item ('role','symb') {
+            foreach my $item ('role','symb','iptoken') {
                 if (exists($form{$item})) {
                     $info{$item} = $form{$item};
                 }
@@ -442,7 +448,10 @@ sub handler {
     my ($is_balancer,$otherserver);
 
     if ($handle eq '') {
-        unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) {
+        unless ((($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) ||
+                ($requrl =~ m{^/public/$match_domain/$match_courseid/syllabus}) ||
+                ($requrl =~ m{^/adm/help/}) ||
+                ($requrl =~ m{^/res/$match_domain/$match_username/})) {
 	    $r->log_reason("Cookie not valid", $r->filename);
         }
     } elsif ($handle ne '') {
@@ -473,7 +482,7 @@ sub handler {
 	}
 	$env{'request.filename'} = $r->filename;
 	$env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
-        my $suppext;
+        my ($suppext,$checkabsolute);
         if ($requrl =~ m{^/adm/wrapper/ext/}) {
             my $query = $r->args;
             if ($query) {
@@ -494,6 +503,9 @@ sub handler {
                     $env{'request.external.querystring'} = $preserved;
                 }
             }
+            if ($env{'request.course.id'}) {
+                $checkabsolute = 1;
+            }
         } elsif ($env{'request.course.id'} &&
                  (($requrl =~ m{^/adm/$match_domain/$match_username/aboutme$}) ||
                   ($requrl =~ m{^/public/$cdom/$cnum/syllabus$}))) {
@@ -508,6 +520,20 @@ sub handler {
                     }
                 }
             }
+            if ($requrl =~ m{^/public/$cdom/$cnum/syllabus$}) {
+                $checkabsolute = 1;
+            }
+        }
+        if ($checkabsolute) {
+            my $hostname = $r->hostname();
+            my $lonhost = &Apache::lonnet::host_from_dns($hostname);
+            if ($lonhost) {
+                my $actual = &Apache::lonnet::absolute_url($hostname);
+                my $expected = $Apache::lonnet::protocol{$lonhost}.'://'.$hostname;
+                unless ($actual eq $expected) {
+                    $env{'request.use_absolute'} = $expected;
+                }
+            }
         }
 # -------------------------------------------------------- Load POST parameters
 
@@ -546,6 +572,13 @@ sub handler {
 	if ($requrl !~ m{^/(?:adm|public|prtspool)/}
 	    || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
 	    my $access=&Apache::lonnet::allowed('bre',$requrl);
+            if ($handle eq '') {
+                unless ($access eq 'F') {
+                    if ($requrl =~ m{^/res/$match_domain/$match_username/}) {
+                        $r->log_reason("Cookie not valid", $r->filename);
+                    }
+                }
+            }
 	    if ($access eq '1') {
 		$env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
 		return HTTP_NOT_ACCEPTABLE;