--- loncom/auth/lonacc.pm	2020/10/06 19:36:07	1.159.2.8.2.6
+++ loncom/auth/lonacc.pm	2020/10/01 10:42:56	1.159.2.13
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Cookie Based Access Handler
 #
-# $Id: lonacc.pm,v 1.159.2.8.2.6 2020/10/06 19:36:07 raeburn Exp $
+# $Id: lonacc.pm,v 1.159.2.13 2020/10/01 10:42:56 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -355,14 +355,6 @@ sub sso_login {
 	    # login but immediately go to switch server to find us a new 
 	    # machine
 	    &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
-            foreach my $item (keys(%form)) {
-                $env{'form.'.$item} = $form{$item};
-            }
-            unless ($form{'symb'}) {
-                unless (($r->uri eq '/adm/roles') || ($r->uri eq '/adm/sso')) {
-                    $env{'form.origurl'} = $r->uri;
-                }
-            }
             $env{'request.sso.login'} = 1;
             if (defined($r->dir_config("lonSSOReloginServer"))) {
                 $env{'request.sso.reloginserver'} =
@@ -550,7 +542,6 @@ sub handler {
             my $lonhost = &Apache::lonnet::host_from_dns($hostname);
             if ($lonhost) {
                 my $actual = &Apache::lonnet::absolute_url($hostname);
-                my $exphostname = &Apache::lonnet::hostname($lonhost);
                 my $expected = $Apache::lonnet::protocol{$lonhost}.'://'.$hostname;
                 unless ($actual eq $expected) {
                     $env{'request.use_absolute'} = $expected;
@@ -599,15 +590,6 @@ sub handler {
                 $env{'form.origurl'} = $r->uri;
             }
         }
-        if ($requrl=~m{^/+tiny/+$match_domain/+\w+$}) {
-            if ($env{'user.name'} eq 'public' &&
-                $env{'user.domain'} eq 'public') {
-                $env{'request.firsturl'}=$requrl;
-                return FORBIDDEN;
-            } else {
-                return OK;
-            }
-        }
 
 # ---------------------------------------------------------------- Check access
 	my $now = time;
@@ -624,8 +606,7 @@ sub handler {
                     ($requrl=~m|\.problem/smpedit$|) ||
                     ($requrl=~/^\/public\/.*\/syllabus$/) ||
                     ($requrl=~/^\/adm\/(viewclasslist|navmaps)$/) ||
-                    ($requrl=~/^\/adm\/.*\/aboutme\/portfolio(\?|$)/) ||
-                    ($requrl=~m{^/adm/$cdom/$cnum/\d+/ext\.tool$})) {
+                    ($requrl=~/^\/adm\/.*\/aboutme\/portfolio(\?|$)/)) {
                     $check_symb = 1;
                 }
             }
@@ -799,29 +780,19 @@ sub handler {
                         unless (&Apache::lonnet::symbverify($symb,$requrl,\$encstate)) {
                             $invalidsymb = 1;
                             #
-                            # If $env{'request.enc'} inconsistent with encryption expected for $symb
-                            # retrieved by lonnet::symbread(), call again to check for an instance of
-                            # $requrl in the course for which expected encryption matches request.enc.
-                            # If symb for different instance passes lonnet::symbverify(), use that as
-                            # the symb for $requrl and call &Apache::lonnet::allowed() for that symb.
-                            # Report invalid symb if there is no other symb. Redirect to /adm/ambiguous
-                            # if multiple possible symbs consistent with request.enc available for $requrl.
+                            # If $env{'request.enc'} is true, but no encryption for $symb retrieved
+                            # by original lonnet::symbread() call, call again to check for an instance
+                            # of $requrl in the course which has encryption, and set that as the symb.
+                            # If there is no such symb, or symbverify() fails for the new symb proceed
+                            # to report invalid symb.
                             #
-                            if (($env{'request.enc'} && !$encstate) || (!$env{'request.enc'} && $encstate)) {
+                            if ($env{'request.enc'} && !$encstate) {
                                 my %possibles;
                                 my $nocache = 1;
-                                my $oldsymb = $symb;
                                 $symb = &Apache::lonnet::symbread($requrl,'','','',\%possibles,$nocache);
-                                if (($symb) && ($symb ne $oldsymb)) {
+                                if ($symb) {
                                     if (&Apache::lonnet::symbverify($symb,$requrl)) {
-                                        my $access=&Apache::lonnet::allowed('bre',$requrl,$symb);
-                                        if ($access eq 'B') {
-                                            $env{'request.symb'} = $symb;
-                                            &Apache::blockedaccess::setup_handler($r);
-                                            return OK;
-                                        } elsif (($access eq '2') || ($access eq 'F')) {
-                                            $invalidsymb = '';
-                                        }
+                                        $invalidsymb = '';
                                     }
                                 } elsif (keys(%possibles) > 1) {
                                     $r->internal_redirect('/adm/ambiguous');