--- loncom/auth/lonacc.pm 2013/01/30 16:23:47 1.142 +++ loncom/auth/lonacc.pm 2014/03/10 02:07:01 1.154 @@ -1,7 +1,7 @@ # The LearningOnline Network # Cookie Based Access Handler # -# $Id: lonacc.pm,v 1.142 2013/01/30 16:23:47 raeburn Exp $ +# $Id: lonacc.pm,v 1.154 2014/03/10 02:07:01 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -89,8 +89,6 @@ store attempted access =head1 NOTABLE SUBROUTINES -=over - =cut @@ -103,7 +101,7 @@ use Apache::lonnet; use Apache::loncommon(); use Apache::lonlocal; use Apache::restrictedaccess(); -use Apache::blockedaccess(); +use Apache::blockedaccess(); use Fcntl qw(:flock); use LONCAPA qw(:DEFAULT :match); @@ -162,6 +160,8 @@ sub get_posted_cgi { if (length($value) == 1) { $value=~s/[\r\n]$//; } + } elsif ($fname =~ /\.(xls|doc|ppt)x$/i) { + $value=~s/[\r\n]$//; } if (ref($fields) eq 'ARRAY') { next if (!grep(/^\Q$name\E$/,@{$fields})); @@ -230,6 +230,8 @@ sub get_posted_cgi { =pod +=over + =item upload_size_allowed() Perform size checks for file uploads to essayresponse items in course context. @@ -264,20 +266,26 @@ sub upload_size_allowed { =item sso_login() handle the case of the single sign on user, at this point $r->user - will be set and valid now need to find the loncapa user info and possibly - balance them - returns OK if it was a SSO and user was handled - undef if not SSO or no means to hanle the user + will be set and valid; now need to find the loncapa user info, and possibly + balance them. If $r->user() is set this means either it was either set by + SSO or by checkauthen.pm, if a valid cookie was found. The latter case can + be identified by the third arg ($usename), except when lonacc is called in + an internal redirect to /adm/switchserver (e.g., load-balancing following + successful authentication) -- no cookie set yet. For that particular case + simply skip the call to sso_login(). + + returns OK if it was SSO and user was handled. + returns undef if not SSO or no means to handle the user. =cut sub sso_login { - my ($r,$handle) = @_; + my ($r,$handle,$username) = @_; my $lonidsdir=$r->dir_config('lonIDsDir'); - if (!($r->user - && (!defined($env{'user.name'}) && !defined($env{'user.domain'})) - && ($handle eq ''))) { + if (($r->user eq '') || ($username ne '') || + (defined($env{'user.name'}) && (defined($env{'user.domain'})) + && ($handle ne ''))) { # not an SSO case or already logged in return undef; } @@ -287,7 +295,7 @@ sub sso_login { my $query = $r->args; my %form; if ($query) { - my @items = ('role','symb'); + my @items = ('role','symb','iptoken'); &Apache::loncommon::get_unprocessed_cgi($query,\@items); foreach my $item (@items) { if (defined($env{'form.'.$item})) { @@ -296,6 +304,12 @@ sub sso_login { } } + my %sessiondata; + if ($form{'iptoken'}) { + %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'}); + my $delete = &Apache::lonnet::tmpdel($form{'token'}); + } + my $domain = $r->dir_config('lonSSOUserDomain'); if ($domain eq '') { $domain = $r->dir_config('lonDefDomain'); @@ -303,8 +317,18 @@ sub sso_login { my $home=&Apache::lonnet::homeserver($user,$domain); if ($home !~ /(con_lost|no_host|no_such_host)/) { &Apache::lonnet::logthis(" SSO authorized user $user "); - my ($is_balancer,$otherserver) = - &Apache::lonnet::check_loadbalancing($user,$domain); + my ($is_balancer,$otherserver,$hosthere); + if ($form{'iptoken'}) { + if (($sessiondata{'domain'} eq $form{'udom'}) && + ($sessiondata{'username'} eq $form{'uname'})) { + $hosthere = 1; + } + } + unless ($hosthere) { + ($is_balancer,$otherserver) = + &Apache::lonnet::check_loadbalancing($user,$domain); + } + if ($is_balancer) { # login but immediately go to switch server to find us a new # machine @@ -323,7 +347,15 @@ sub sso_login { } else { # need to login them in, so generate the need data that # migrate expects to do login - my %info=('ip' => $r->connection->remote_ip(), + my $ip; + my $c = $r->connection; + eval { + $ip = $c->remote_ip(); + }; + if ($@) { + $ip = $c->client_ip(); + } + my %info=('ip' => $ip, 'domain' => $domain, 'username' => $user, 'server' => $r->dir_config('lonHostID'), @@ -334,6 +366,11 @@ sub sso_login { $info{$item} = $form{$item}; } } + unless ($info{'symb'}) { + unless (($r->uri eq '/adm/roles') || ($r->uri eq '/adm/sso')) { + $info{'origurl'} = $r->uri; + } + } if ($r->dir_config("ssodirecturl") == 1) { $info{'origurl'} = $r->uri; } @@ -367,11 +404,13 @@ sub sso_login { } } if (grep(/^sso$/,@cancreate)) { - $r->internal_redirect('/adm/createaccount'); + $r->set_handlers('PerlHandler'=> + [\&Apache::createaccount::handler]); + $r->handler('perl-script'); } else { $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect')); + $r->set_handlers('PerlHandler'=> undef); } - $r->set_handlers('PerlHandler'=> undef); return OK; } return undef; @@ -380,26 +419,30 @@ sub sso_login { sub handler { my $r = shift; my $requrl=$r->uri; - if (&Apache::lonnet::is_domainimage($requrl)) { + + if ($requrl =~ m{^/res/adm/pages/[^/]+\.(gif|png)$}) { return OK; } - if ($requrl =~ m{^/res/adm/pages/[^/]+\.(gif|png)$}) { + if (&Apache::lonnet::is_domainimage($requrl)) { return OK; } - my $handle = &Apache::lonnet::check_for_valid_session($r); + my %user; + my $handle = &Apache::lonnet::check_for_valid_session($r,undef,\%user); - my $result = &sso_login($r,$handle); - if (defined($result)) { - return $result; + unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) { + my $result = &sso_login($r,$handle,$user{'name'}); + if (defined($result)) { + return $result; + } } my ($is_balancer,$otherserver); if ($handle eq '') { unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) { - $r->log_reason("Cookie $handle not valid", $r->filename); + $r->log_reason("Cookie not valid", $r->filename); } } elsif ($handle ne '') { @@ -477,6 +520,9 @@ sub handler { $checkexempt = 1; } } + if ($env{'user.noloadbalance'} eq $r->dir_config('lonHostID')) { + $checkexempt = 1; + } unless ($checkexempt) { ($is_balancer,$otherserver) = &Apache::lonnet::check_loadbalancing($env{'user.name'}, @@ -488,6 +534,10 @@ sub handler { if ($otherserver ne '') { $env{'form.otherserver'} = $otherserver; } + unless (($env{'form.origurl'}) || ($r->uri eq '/adm/roles') || + ($r->uri eq '/adm/switchserver') || ($r->uri eq '/adm/sso')) { + $env{'form.origurl'} = $r->uri; + } } # ---------------------------------------------------------------- Check access @@ -629,6 +679,15 @@ sub handler { $env{'request.state'} = 'edit'; } } + } + } elsif ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/portfolio/syllabus/.+\.html?$}) { + if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) { + if ($query) { + &Apache::loncommon::get_unprocessed_cgi($query,['forceedit','editmode']); + if (($env{'form.forceedit'}) || ($env{'form.editmode'})) { + $env{'request.state'} = 'edit'; + } + } } } }