CVS log for loncom/auth/lonacc.pm

Up to [LON-CAPA] / loncom / auth

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- For 2.11.4 (modified)
  Include changes in 1.209, 1.210

- For 2.11.4 (modified)
  Include changes in 1.162

- Use standard LON-CAPA error documents for 406, 403 and 500 errors for
  /daxeopen/.
- Use loncacc.pm as authz handler for /daxeopen/priv/domain/username/
- Use lonacc.pm as authz handler for /daxeopen/, /daxeopen/priv/, and
  /daxeopen/priv/domain/

- Support use of pop-up browser to insert image files into HTML files
  uploaded to Main Content or Supplemental Content areas of a course.

- For 2.11.4 (modified)
  Include changes in 1.166, 1.167, 1.186 (part), 1.208

- Bugs 6754 and 6907
  - Return of grades to launcher CMS supported for resources or folders
    accessed via LTI-mediated deep link.
  - Support option: "Encrypt stored consumer secrets defined in domain"
  - Signing of LTI payloads for roster retrieval, passback of grades,
    and callback to logput launcher CMS session all now occur on
    primary library server for course's domain.

- For 2.11.4 (modified)
  Include changes in 1.207

- Support access to specific LON-CAPA message after login in cases where a
  LON-CAPA loadbalancer node is used as the portal for a domain.

- For 2.11.4 (modified)
  Include changes in rev. 1.206

- Dual SSO and non-SSO login from /adm/login
  - Display of domain configuration for each server split into two tables
    so input textboxes can be longer.
  - "Pop-up if iframe" (Y/N) item added.  If Y, when login page is in an
    iframe, SSO log-in dialog will be displayed in a new window, i.e.,
    not within the iframe, e.g., to satisfy sameorigin requirement in
    x-frame-options in header sent by SSO server.

- For 2.11.4 (modified)
  Include changes in 1.203, 1.204, 1.205

- Bug 6907
  "Exit Tool" button available to logout a session launched via deep link
  and escape iframe and redirect (for LTI-protected link).

- Bug 6907
  For LTI-protected deep links in which username is included in launch payload
  compare username in payload with username for any existing LON-CAPA session
  in current web browser and expire old session, if different user.

- Bug 6907
  For LTI-protected deep links in which username is included in launch payload
  compare username in payload with username for any existing LON-CAPA session
  in current web browser and expire old session, if different user.

- For 2.11.4 (modified)
  Include changes in 1.169, 1.175, 1.178, 1.192, 1.193, 1.194, 1.195,
                     1.197, 1.200 (part).

- For 2.11
  Backport 1.189, 1.190, 1.191, 1.196, 1.199, 1.200 (part) 1.201, 1.202

- Change in rev. 1.154 should also apply to xlsx, docx, pptx, xlsm, docm and
  pptm files uploaded to a user's portfolio. Eliminate extra byte (line feed),
  which would cause Excel to prompt user to "repair" file after download.

- Bug 6955 IP-based blocking. Pass user'sIP address as third arg to
  loncommon::blockcheck() and second to loncommon::blocking_status().

- Bug 6907
  - Use of token to store linkprot or linkkey compatible with use of
    btoken and iptoken (for load balancing and IP change respectively).
  - Launching access from a deeplink, with its own ltoken and/or linkkey,
    for a user session originally launched from a different deeplink will
    update required session information.

- Use token to store role, symb, linkprot, and/or linkkey when dual log-in
  page to support SSO (Shibboleth) and non-SSO is in use, and for "log in
  again" retry link for failed login, instead of using query string directly.
- When digest is used by tmpput handler in lond to generate an id, only use
  id which does not already exist in LON-CAPA's tmp directory.

- Remove trailing white space.

- Fix typos in rev. 1.195

- Eliminate log spew.

- request.linkprot and request.linkkey only in %env for duration of request.

- Bug 6907 Content in a course can be set to be deep-link only.
  - Support lti-based or key-based access control with SSO authentication.

- Missing ; in rev. 1.192

- Bug 6907 Content in a course can be set to be deep-link only.
  If initial access is via a deep-link (/tiny/$domain/$uniqueid), and
  target folder/resource is deep-link only, access to resources, menus,
  and items listed in Course Contents controlled by deeplink parameter value.

- Go to originally requested URL after single sign on with Shibboleth.

- Bug 6914.
  Replace hostname with alias when creating absolute URLs, if alias in use.

- Bug 6914
 - Update domain config UI to support settings documented in
   Domain_Configuration_WAF_Proxy.tex
 - Use /adm/migrateuser to handle redirects when user with a LON-CAPA session
   switches between access via VPN and not via VPN (and vice versa).

- For 2.11.3 (modified)
  Include changes in 1.188

- For 2.11
  Backport 1.188

- Fix typo in 1.187

- For 2.11.3 (modified)
  Include changes in 1.187

- For 2.11
  Backport 1.187

- Validate symb included in query string for /adm/navmaps, /adm/wrapper/...
  /adm/coursedocs/showdoc/... URLs.
- Discard invalid symb for /adm/navmaps, but allow access in course context.

- For 2.11.3 (modified)
  Include changes in 1.184

- For 2.11
  Backport 1.184

- For 2.11.3 (modified)
  Include changes in 1.185, 1.186

- For 2.11
  Backport 1.186 (part).

- Bug 6518. Content blocking check for wrapped uploaded files (e.g., PDFs),
  uploaded files with mime types that require /adm/coursedocs/showdoc/, and
  /adm/viewclasslist.

- For 2.11
  Backport 1.185

- Modify changes in rev 1.180. Set of URLs for which symb is checked is not
  completely contained within set of URLs for which access is checked.

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()
- Domain configuration to allow domain's LON-CAPA nodes to operate behind a
  WAF/Reverse Proxy using aliased hostname (CNAME).
- Web requests from other nodes bypass the WAF as their requests are made
  directly to the server hostname (A record); same for internal LON-CAPA
  connections for lonc -> lond.

- For 2.11.3 (modified)
  Include changes in 1.183

- For 2.11
  Backport 1.183

- For non-SSO login on a balancer node, check for balancer cookie in lonauth.pm
  after login credentials validated. (Same as lonacc::sso_login for SSO login).
- Not all calls to check_loadbalancing() require determination of a server
  to which to offload, even when $is_balancer is true.

- For 2.11.3 (modified)
  Include changes in 1.182

- For 2.11
  Backport 1.182

- Bug 6518.
  More comprehensive access to symb for a requested URL to determine when
  access should be blocked and why, if content blocking in use.

- For 2.11.2 (modified)
  Include changes in 1.179, 1.180, 1.181

- For 2.11.3 (modified)
  Include changes in 1.181

- For 2.11
  Backport 1.181

- Bug 6518 Content blocking during quiz/exam.
  - For resources not in a course directly, but instead referenced by resources
    which are, symb to check to determine whether access should be blocked and
    why is symb of resource containing the dependency.
  - No $env{'request.enc'} in effect for dependent files.

- For 2.11.3 (modified)
  Include changes in 1.179, 1.180

- For 2.11
  Backport 1.180

- Modify changes in rev. 1.179. Code to deteect whether requested URL will
  have a symb moved from &needs_symb() routine into main &handler(), and
  called once to set value for $check_symb for later use.

- For 2.11
  Backport 1.179

- Bug 6518.
  More comprehensive access to symb for a requested URL to determine when
  access should be blocked and why, if content blocking in use.

- For 2.11.3 (modified)
  - Include changes in 1.178

- Bug 6400
  Authentication required by user with public session when accessing urls
  for deep-linking, i.e., /tiny/<domain>/uniqid

- For 2.11.3 (modified)
  Include changes in 1.176, 1.177

- For 2.11
  Backport 1.177

- Bug 6215. Download of zip file of submissions no longer restricted to CC.

- For 2.11.2 (modified).
  Use 2.12 feature (LTI) pre-release, in modified 2.11.2. Domain's
  configuration must be set to prohibit hosting of sessions for
  domain's users outside own domain, and modification must be in
  place on all nodes in domain.

- For 2.11
  Backport 1.176

- Don't set "last_known" symb, if current resource is /adm/navmaps (users
  always have access to "Contents" item in inline menu).
- Don't store "last_known" symb for resources in a .page (store the symb
  for the enclosing .page instead).

- For 2.11.3 (modified)
  Include changes in 1.169, 1.172, 1.173

- For 2.11
  Backport 1.171

- For 2.11
  Backport 1.174

- For 2.11 (modified)
  - include changes in 1.169, 1.170, 1.172, 1.173

- Bug 6400
  - Enforce access restrictions for content which is deeplink-only (users
    with "advanced priv for current role are exempt).
  - Support "key" link type in deeplink parameter (requested link must either
    be sent with linkkey as element in POSTed data, or with linkkey in query
    string).  Corresponding value must match key set in deeplink parameter.

- Bug 6806 Use of an External Resource URL which includes an anchor will
  cause page to be load in iframe at anchor position.
- For servers using Apache/SSL where External Resource points at http:// URL
  query string for links contains usehttp=1, unless Strict-Transport-Security
  set for Apache with max-age > 0.

- Call Apache::lonnet::hostname($lonhost) before accessing
  $Apache::lonnet::protocol{$lonhost) so %Apache::lonnet::protocol is populated.

- Bug 6400
  Tiny url available to switchserver.pm when load-balancer offloads
  SSO-authenticated user.

- Domain config for load balancer to use cookie to record offload target.
  Subsequent requests by same user/browser will send requests to same target
  if remote session still active, and remote node not overloaded.

- For 2.11
  Backport 1.168, 1.170

- Remove unused line. (Changes in rev. 1.111 eliminated the need).

- For 2.11.2 (modified)
  - include changes in rev. 1.168

- Bug 6400 Tiny URL for deep-linking.
  Requires Short::URL and String::CRC32 modules from CPAN. Dependency on
  perl-Short-URL needs to be added to LONCAPA-prerequisites.

- Remove final line feed for xlsm, docm and pptm files so uploaded
  file contains same number of bytes as original file. Microsoft Office
  applications should no longer prompt user to "repair" file after download.

- For 2.11.2 (modified).
  Use 2.12 feature (LTI) pre-release, in modified 2.11.2. Domain's
  configuration must be set to prohibit hosting of sessions for
  domain's users outside own domain, and modification must be in
  place on all nodes in domain.

- Bug 6754. Make LON-CAPA an LTI Tool Consumer (LTI 1.1).
  - Name as ext.tool (instead of exttool), so that parameters can be specified
    in packages.tab, based on extension.

- Facilitate retrieval of the symb for an external tool.

- For 2.11
  - Backport 1.165

- Domain Configuration for dedicated load balancer includes option to
  permit "Hosting on balancer itself".
- If balancer has lowest load, it will host the user session for a user
  logging in.

- For 2.11
  - Backport 1.164

- Support Apache 2.4 using $r->get_remote_host() from Apache2::compat().

- For 2.11
  - Backport 1.160

- For 2.11
  - Backport 1.163

- Eliminate jsMath.
  Use MathJax instead in cases where jsMath use is indicated in a resource,
  ina user's preferences, or in course preferences.

integrated Daxe, opening in a separate window for now

- For 2.11
  Backport 1.161

- Use $LONCAPA::match_username regexp for extraction of username for SSO
  user from $r->user().

- Bug 6690
  - IP-based access control for portfolio files added to existing "conditional"
    access types used to grant read access to others besides the owner.

- Eliminate "Cookie not valid" log spew in web server error logs for
  unauthenticated access of public content.

Bug 6675
- Changed client IP address when load balancing:
  Support option to host on Load Balancer itself, after re-authentication.

- On Apache/SSL servers syllabus should always be served by http:// to avoid
  "mixed content" issue when syllabus is an external resource on http:// server).
  - Set $env{'request.use_absolute'} and pass in args to start page so postdata
    is preserved. (bug 6662).
  - Code used for same purpose in rat/lonwrapper.pm rev. 1.44 for external
    resources moved to lonacc.pm to facilitate re-use.
- Detect if syllabus template replaced with uploaded PDF or link to external
  PDF file, and send as arg in call to lonwrapper.pm, to circumvent lack of
  scrolling for multi-page PDFs in iframes on iOS.

- For public user (e.g., unauthenticated user viewing syllabus etc.)
  set $r->user() to public:public, just in case there a username of
  "public" is a real institutional username (and SSO is in use).
- Prevent public user being identified as SSO-authenticated user without
  LON-CAPA username.

- SSO authenticated user without existing LON-CAPA account:
  Handle as SSO user if either lonSSOUserUnknownRedirect is defined or
  domain configuration permits self-creation of LC account by sso user.

- Change to address bug 6587 in lonacc.pm (rev. 1.139) was causing uploaded
  xlsx files to include an extra byte (line feed), which would cause
  Excel to prompt user to "repair" file after download.
  - Re-enable removal of final line feed for xlsx, docx and pptx files so
    uploaded file contains same number of bytes as original file.

- Support access to Shibboleth environment variables defined in
  attribute-map.xml via %ENV, when user without a LON-CAPA account
  authenticates via Shibboleth SSO.

- Don't set $env{'form.origurl'} to the requested uri, to avoid
  unwanted redirects from the roles page for newly authenticated users.

- SSO authentication in cases where server is not also a load balancer.
  - If authenticated, display the URL which triggered the original
    authentication, unless, a symb was supplied in the query string, in
    which case use that.

- Call to &sso_login() not needed when lonacc::handler() is called in the
  context of an internal redirect to /adm/switchserver.
- Avoid ISE on loadbalancer server following change in checkauthen.pm rev
  1.14

- Support Apache 2.4
  - PerlAuthenHandler needs to set $r->user() for requests for <Location>
    directives which include Require valid-user
  - reverse changes in publiccheck.pm rev. 1.20 and 1.21
  - modify changes in lonacc.pm rev. 1.143 and 1.147
  - reverse changes in lonnet.pm rev. 1.1212 and 1.1213, and modify changes
    in rev. 1.1244 (no longer treating 2.4 as a special case).
- Apache access logs will now include username (or username:domain if user's
  domain is not server's default domain) for URLs requiring "valid-user",
- Apache access logs will now include 'public' as requester for image
  files from /res/adm/pages and also domain logos etc.

- remove trailing whitespace.

- Support Apache 2.4 (Fedora 18, 19, 20; SuSE 13.1)
  - $r->user needs to be set in lonnet::check_for_valid_session()
    if the session is valid, but lonacc:sso_login() also needs to be able
    to identify an SSO case.

- Modify POD to eliminate errors seen with pod2man in perl 5.18

- Bug 6675
- Case where $env{'REMOTE_ADDR'} as reported to server selected to host
  user session, is different from $env{'REMOTE_ADDR'} as reported to
  server which handled original authentication request.
  - Domain configuration for a load balancing server can be set to one of
    the following, if an IP mismatch is detected by /adm/migrateuser
    during credentials checking after redirect via /adm/switchserver
    (i) Session will be hosted on Load Balancer
    (ii) Session will be hosted on offload server
    for each of (a) SSO users from load balancer's domain, (b) non-SSO users
  - Setting to host on load balancer will be ignored if switch server was called
    by an author or co-author switching to server housing the authoring space.

- Bug 5962.
  Additional syllabus option - minimal template (provides a "blank" HTML
  file (portfolio/syllabus/loncapa.html) which can be edited using the
  WYSIWYG editor.
- Edit button for uploaded syllabus file (html) and minimal template
  provides direct access to WYSIWYG editing screen.

- Apache 2.4 requires $r->user() to be set, if "Require valid-user" applies to
  the requested page, otherwise there is an error:
  "No authentication done but request not allowed without authentication".

- Eliminate unwanted log message on lonbalancer server when /adm/switchserver
  was called via internal_redirect, immediately following authentication.

- Supplemental Content area can contain Syllabus and/or Personal Information pages.
- Do not append symb (if either item is also used in Main content area), if
  accessed via Supplemental Content.

- HTML files uploaded to course's Supplemental content area can be edited,
  and any dependencies can be replaced (or uploaded, if missing).

- Bug 6587.
  Only check for "empty" file for file upload to portfolio.

- Dedicated loadbalancer.
  - If a session for a specific user is being hosted on a loadbalancer server
    call to lonnet::check_loadbalancing() only made for an authenticated
    user, once 10 minutes have elapsed since last call.
    (user.loadbalexempt and user.loadbalcheck.time stored in %env).

- Customization for GCI_3
  - No change to last activity timestamp when DC is using adhoc CC role
    in a GCI Testing center course owned by someone else.

- Bug 6371.
  - Use of lonBalancer in Apache config file superceded by setting
    loadbalancing in domain configuration.
  - More granularity available in load balancing:
     - Rules can be defined for users in domain, based on institutional
       affiliation (e.g., Faculty, Staff, Student etc.).
     - Rules for advanced user or author trump rules based on affiliation
     - Rules can also be set for users from other domain hosted by
       institution (i.e., multi-domain server set-ups)
     - Rules can also be set for users from other institutions.

- Additional perlVar for sso_login.
  lonSSOUserDomain - LON-CAPA domain for users logging in via SSO
                     (could be different to default domain of server).

- No upload to portfolio if uploaded file was zero bytes.

- Display course breadcrumb trail and icons for course or user when
  aboutme included in a course, when displaying list of available
  group or user portfolio files (aboutme/portfolio).

- Bug 6239. Register "Course roster" (/adm/viewclasslist) if added to
  a course via Course Editor.

- Backport 1.132.

- Bug 6236.
  Authorization (AuthzHandler) for a Community when editing a simple problem:
  /res/lib/templates/simpleproblem.problem/smpedit
  (mdc priv in lonsimpleproblemedit::handler() laer checks editing rights).

- replaced frameset by iframe in lonwrapper
    ! IE 7 doesn't scale iframe to 100% height, IE 6 and 8 do
    ! scrolling in Mobile Safari is limited
- added styles for iframe to loncommon
- replaced menubuttons call in lonwrapper by start_page call to make full use of the new header
- removed remote control specific code (RC will be removed shortly)
- replaced code in lonsyllabus with a call to new wrapper routine
- removed subs initlittle and menubutton from lonmenu since they aren't needed anymore

- Browsing of /res space by Community Coordinators - 'bro' priv.
- For URLs of items in /res - test if allowed with 'bro' priv, if not allowed for 'bre' priv.

- Bug 6101.
 - external resource URLs can include a query string.

fixed:
- problem occurring when user tries to view own portfolio files while communication block is active
- Public user now receive the correct status information popup when accessing portfolio files while com.block. is active

improved:
- code
- mt-arguments

added:
- german translations
- sub data_table_caption
- code comments

- loncommon::get_unprocessed_cgi() retrieve roles and symb from query string.
  - Now passed along in %env to support case where lonBalancer is "yes" and
    switchserver offloads session.

- Bug 3987. Deep-linking.
- Preserve role and symb from query string in call to SSO authenticator.
  - Propagate to migrateuser when starting session.

- HTML documents uploaded directly to a course can be edited by a Course Coordinator (mdc priv).
- "Edit this resource" link displayed in inline menu.
- Link will switch server to course's home server if session is currently hoosted elsewehere (unless a lock is in place).

- Deep linking:
  - origurl and symb args can be included in query string for switchserver call, so switched session will go to the same resource on the new server.

Work in progress.
Logging needed: changes, and by whom.

- Backport 1.124.

- Skip cookie check for icons etc. in /res/adm/pages

- Backport 1.118, 1.122

- Default maximum file size set to 10 MB for files uploaded to essayresponse items.

Bugs 5719 and 5820.
- Do not add contents of files uploaded to essayresponse items in course activity log.
- Round file size (in Mb) to 6 decimal places when setting HWFILESIZE form element.
- HWFILESIZE and HWFILETOOBIG (if set) will be stored in course activity log.

POD documentation changes

Reformatted POD, moved to bottom of file

Added/updated/converted POD. Many files had their POD redone to new standards.

Bug 5719 Size limits for File Upload in Essay response.
 - Max. cumulative size for submitted files applies to total for all files submitted to a particular essayresponse item. Default is 100 MB.
 - In course context, &lonacc:get_posted_cgi() will now no longer add file contents to %env if size exceeds max. for item.
 - Additional checks in essayresponse::file_submission() will assign award as "EXCESS_FILESIZE" if total of all files being submitted for sinle essayresponse item exceed max set via
PARM.
 - Modification to $Apache::lonhomework::results{"resource.$part.$id.$which"} to now include a comma separated list of only those submitted files which passed both the filetype and size tests.

POD documentation changes

- Incoming users authenticated by SSO may not always need to go to the roles screen.
- Add the following to a <Location $url> directive in loncapa_apache_conf:
PerlSetVar      ssodirecturl 1
for authenticated SSO users to go to $url after session initialization.

- If a user successfully authenticates via SSO, but a LON-CAPA account is lacking for the username used to authenticate, offer the possibility of creating an account, if selfcreation is allowed for the 'sso' auth type.
- selfcreation auth types are now stored as an array, instead of a single-valued scalar.

- &get_posted_cgi() can take second (optional) argument - a reference to an array of the names of form elements which may be retrieved from a submitted form (method was "post").

- backport 1.112, 1.113

- boundary value is announced in the content-type so use it there rather
  than trying to self discover it

- safari 3 uses + in the content separator lines

- convert exisiting cookie reads/validations to use
   lonnet::check_for_valid_session

	Put separator between $uname and $udom

	Add access info for multidownload of student submissions.

Put reg exp check for domain logo in lonnet  - &is_domainimage()
checkauthen, publiccheck and lonacc all need this to serve images for log-in page if port 8080 is not in use.
Other possibilities - (1) call once in checkauthen and pass along to publiccheck and lonacc in Apache notes, or (2) modify loncapa_apach.conf.
lonhttpd to use a call to the same routine.

- log sso authorizations users

Look for lonSSOReloginServer set in an apache conf file (e.g., sentinel.conf at MSU), so the "login again" link displayed on logout points to a SSO-enabled server if the user's login was originally SSO-authenticated.

If SSO auth, need to set $env{'request.sso.login'} = 1 before internal_redirect to switchserver.

If SSO user is authenticated but has no LON-CAPA account provide information, including results of query of RO's LONCAPA_ClassList table for the user.

Some routines in coursecatalog modified to support use by sentinelonly.pm

Add response code of 'B' to lonnet::allowed() to indicate access to a file is currently subject to a block, because the file owner is part of a course with active communications blocking, and file viewer does not have 'evb' privilege in the course to nullify the block.

Used to block access to portfolio files.  Response of 'B' triggers blockedaccess.pm which displays information about blocking conditions.

- swithc to using helper cleaing functions and helper matchi re

- need to undef the The Response phase handler since we have already taken care of the needed output

- sigh

- check for definiton

- mispelling

- clean $r->user just in case

- BUG#5005, need to shift to maintianing the jsmath processing status to a stack since we can create subpages when creating the main page thus need to track the need for each sub page independently

- BUG#4986, smppg weren't listing to conditions

- optimizing the login for users (fewer redirects occur) also if the user
  is going to be load balanced don't fire the remote up on the initial
  server

- SSO in works with remote contrl now
- enable a way to optionally configure a page to direct users to
  if they SSO in and lon-capa doesn't know them

- fix issues with public access
   - publiccheck takes care of issuing all public cookies
     (thus no longer getting two ids consumed)
   - pucliccheck will initlaize the env of a puclic user so
     lonacc can use the existance of user.name and user.domain being
     set as a valid check of a being a valid user (as opposed to the
     cookie being set to a valid file)

- allowing public access to aboutme/portfolio

- lonnet::allowed() can now return a 'A' for 'pass phrase authentication needed'
- lonacc redirects to restricted access if A is returned

- move portfolio access restriction checking code into lonnet.pm
- some changes to take care of public users access passphrase files

- reenabling acccess to portfiles when grading

- trying to reduce the number of places those re occur

- switching from using a FORBIDDEN pass to just making the restricted
   access screen the response phase

Mechanism for user to provide passphrase, and for the server to validate it when user attempts to access a passphrase-protected portfolio file.

grppg replaces with smppg for group homepages.  Context determined from course domain and course number in URL.

Fixes so more menu buttons are provided when group page is accessed via Navigation controls (i.e., as a registered resource).  Other changes so grppg behaves like smppg.

- upload group file publixc access wasn't working BUG#4881

Portfolio file access control now allows for domain-based, user-based, and course/group-based controls.  Passphrase-protected access (without login) yet to be enabled.

- elimintaing novel use of #

Enable users to set access controls on portfolio files to permit public viewing. Third iteration of data structure in file_permissions.db for storage of access contol records. Now uses key = value for individual access control records and a key = anonymous hash for fast look-ups of all records for a single file.   Use of a temporary lock record to prevent others modifying access control records for a specific portfolio file while the record for the same file is being updated. Additional argument added to call to lonhtmlcommon::datesetter() to optionally suppress display of calendar link.

- preserve the fact that we ssoed in

- touchups from the loncommon move

- moving get_posted_cgi from loncommon to lonacc

- moving hadnler routines out of lonnet into lonacc

- start_page

correct syntax.

- /adm/coursedocs/showdoc/ resources have fully valid sy,mbs now

Let browser determine what language to use in public access, rather than
whatever language was last used in a specific child process.

- changes needed to support making loacc a authz handler
- add ability 'lonBalancer' to force all sesions to be offloaded

Remove "already logged in" and "no active roles" weirdness after looking
at /public-resources.

- need to use lonacc when accessing .hlp files to get session env, but need to also allow public access to help files

- restrict public users to /res/* and /adm/roles, /adm/logout, and /adm/randomlabel.png

- BUG#2573 can't do randomlabel/imageresponse/reactionresponse/organicresponse etc as 'public' resources,
   - public users on first access get a Cookie and a skeleton of a session environment now

- should use decode_symb instead

- ENV -> env

- the _symb.db now actually does store symbs
- I am pretty sure the symbread changes are correct, but I still need to double check them

- nsdl branch needs and fixes

- a BAD_REQUEST resposne is not very helpful, why not just throw up the login page.

- part of BUG#3904, remote navigating a resource not in the course doesn't gie you a return location link

- public homework access was broken because we switched homework forms to 'multipart/form-data' but public acces wasn't using the get_posted_cgi to parse the form data

- setup the browser.* attributes for public users

- one more thing, if they didn't give a symb, and we don't have a symb, we can't verify it at this stage, this can happen we things are ambiguous, so pass them by for now and we'll disambiguiate later

- only things on a mpa shoul dhave a symb check done BUG#3766

- /res/adm things don't have symbs

- more of BUG#3714

- remove log spew

- allow smpedit to take a symb arg

DC can select a CC role in his/her domain, and receive CC privileges on the fly.  Work in progress. Access is not quite set right for pages.

- Somewhat amazed at how easy this was should with these changes
   - uploaded .html/.page (all ssi type docs) now
       - get parsed
       - can be printed
       - get default parameters
       - are no longer wrapper ed

- .problems are still somewhat issue oriented though (need real metadata support for uploaded)

- decode_symb()

Do not explicitly request most recent versions of files.

Two subroutines will need caching:

* lonnet::fixversion
& lonnet::getversion

Setting content language in headers.

Initialize language handle

Consolidate functions from access control handlers in order to eventually
add them also to lonuploadedacc.pm - preparation for running uploaded
problems.

- Perl 5.80 + mod_perl 2.0 + APache 2.0  really want the 0 in there

For the reload button on the inline remote to work, "last_known" in symblist
must be set correctly.

Install new managekeys handler, make new permission "mky" to invoke it

- public users can now submit answers to problems that are published public
- lonxml includes line numbers when complaing about missing tags

Handle login without Remote.

Direct notification email directly to login screen.

Still working on running syllabus, etc, without /adm/wrapper.

best wishes to all.

- fixes BUG#300
- now log all print accesses
- now force restrictions on acces to files in prtspool

Bug #773

Recognizes "/public" as "public"

Bug 573.
Only calls login screen for resources with embstyle ssi, or /adm/roles,
or /adm/logout

Bug 488
Undo version 1.32 of lonacc to avoid unneccessary calls to metadata.
Postpone to lonnet::allowed call.
Deal with 'priv' while we are at it.

Add copyright to request environment (toward bug 488)

This is incorporating the &symbverify call for user-supplied symbs.
Towards bug 279. Should bring up roles error when wrong.

Should register symb correctly when directly jumping to GET provided symb

Accepts symb now

- use the new add_to_env command in loncommon, this way <select multiple> will work

Hopefully (POST only) accepts <select multiple>

Store request method

adding in POD documentation; using loncommon::fileembstyle instead of
lonnet -Scott Harrison

Counts accesses to resources

Logging of accesses and caching of symb

GPL

Public Access

<allow> more powerful, has wildcards - needs TESTING!!!

Wildcards in httprefs

Bugfix

Request State more Informative

Applied shared flocks on the environment

Remove newlines at the end of non-file form fields

Now take "multipart/form-data" forms for file upload

No "wild guesses" based on directory, use <allow> tag instead

Tries to figure out referer a little harder to work with subrequests from
Java applets

Info for lonnet::allowed added early into the request cycle

Now also unescape form element name

Direct writing to environment

Flush content length after reading POST parms

Access control course level

Updates. Implement roles control on browsing and menu.

Roles have starting and end time
Bug fixes after replication shift
New login screen
Authenticator routes to roles screen
Form variables are transfered to environment (not tested)

removed "profile."
added request.filename to enviroment

Limit length of $middlename to 16 characters for critical message buffer
Add appenv to lonnet (not tested yet)

Putting environment variables into session profile
Reading environment variables from session profile
Not tested yet

LON-CAPA Communication Module

Initial revision