--- loncom/auth/lonauth.pm 2020/05/02 15:29:40 1.121.2.19 +++ loncom/auth/lonauth.pm 2021/12/12 01:48:40 1.121.2.22 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.121.2.19 2020/05/02 15:29:40 raeburn Exp $ +# $Id: lonauth.pm,v 1.121.2.22 2021/12/12 01:48:40 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -45,7 +45,7 @@ use Digest::MD5; # ------------------------------------------------------------ Successful login sub success { my ($r, $username, $domain, $authhost, $lowerurl, $extra_env, - $form,$cid) = @_; + $form,$cid,$expirepub) = @_; # ------------------------------------------------------------ Get cookie ready my $cookie = @@ -59,8 +59,9 @@ sub success { # -------------------------------------------------------------------- Log this + my $ip = &Apache::lonnet::get_requestor_ip(); &Apache::lonnet::log($domain,$username,$authhost, - "Login $ENV{'REMOTE_ADDR'}"); + "Login $ip"); # ------------------------------------------------- Check for critical messages @@ -172,6 +173,12 @@ sub success { if ($defaultcookie) { $r->headers_out->add('Set-cookie' => $defaultcookie); } + if ($expirepub) { + my $c = new CGI::Cookie(-name => 'lonPubID', + -value => '', + -expires => '-10y',); + $r->headers_out->add('Set-cookie' => $c); + } $r->send_http_header; my %lt=&Apache::lonlocal::texthash( @@ -202,7 +209,7 @@ ENDSUCCESS # --------------------------------------------------------------- Failed login! sub failed { - my ($r,$message,$form) = @_; + my ($r,$message,$form,$authhost) = @_; (undef,undef,undef,my $clientmathml,my $clientunicode) = &Apache::loncommon::decode_user_agent(); my $args = {}; @@ -223,17 +230,37 @@ sub failed { if ($udom) { $retry .= (($retry=~/\?/)?'&':'?').'domain='.$udom; } - if (exists($form->{role})) { - my $role = &Apache::loncommon::cleanup_html($form->{role}); - if ($role ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'role='.$role; - } - } - if (exists($form->{symb})) { - my $symb = &Apache::loncommon::cleanup_html($form->{symb}); - if ($symb ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb; + my $lonhost = $r->dir_config('lonHostID'); + my $querystr; + my $result = &set_retry_token($form,$lonhost,\$querystr); + if ($result eq 'fail') { + if (exists($form->{role})) { + my $role = &Apache::loncommon::cleanup_html($form->{role}); + if ($role ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'role='.$role; + } + } + if (exists($form->{symb})) { + my $symb = &Apache::loncommon::cleanup_html($form->{symb}); + if ($symb ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb; + } + } + if (exists($form->{firsturl})) { + my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); + if ($firsturl ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; + if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { + unless (exists($form->{linkprot})) { + if (exists($form->{linkkey})) { + $retry .= 'linkkey='.$form->{linkkey}; + } + } + } + } } + } elsif ($querystr ne '') { + $retry .= (($retry=~/\?/)?'&':'?').$querystr; } my $end_page = &Apache::loncommon::end_page(); &Apache::loncommon::content_type($r,'text/html'); @@ -296,8 +323,24 @@ sub handler { my $end_page = &Apache::loncommon::end_page(); my $dest = '/adm/roles'; - if ($env{'form.firsturl'} ne '') { - $dest = $env{'form.firsturl'}; + my %form = &get_form_items($r); + if ($form{'logtoken'}) { + my $tmpinfo = &Apache::lonnet::reply('tmpget:'.$form{'logtoken'}, + $form{'serverid'}); + unless (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost') || + ($tmpinfo eq 'no_such_host')) { + my ($des_key,$firsturl,@rest)=split(/&/,$tmpinfo)l + $firsturl = &unescape($firsturl); + my %info; + foreach my $item (@rest) { + my ($key,$value) = split(/=/,$item); + $info{$key} = &unescape($value); + } + if ($firsturl ne '') { + $info{'firsturl'} = $firsturl; + $dest = $firsturl; + } + } } $r->print( $start_page @@ -313,19 +356,7 @@ sub handler { # ---------------------------------------------------- No valid token, continue - - my $buffer; - if ($r->header_in('Content-length') > 0) { - $r->read($buffer,$r->header_in('Content-length'),0); - } - my %form; - foreach my $pair (split(/&/,$buffer)) { - my ($name,$value) = split(/=/,$pair); - $value =~ tr/+/ /; - $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; - $form{$name}=$value; - } - + my %form = &get_form_items($r); if ((!$form{'uname'}) || (!$form{'upass0'}) || (!$form{'udom'})) { &failed($r,'Username, password and domain need to be specified.', \%form); @@ -369,26 +400,12 @@ sub handler { return OK; } - my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr)=split(/&/,$tmpinfo); - if ($rolestr) { - $rolestr = &unescape($rolestr); - } - if ($symbstr) { - $symbstr= &unescape($symbstr); - } - if ($iptokenstr) { - $iptokenstr = &unescape($iptokenstr); - } - if ($rolestr =~ /^role=/) { - (undef,$form{'role'}) = split('=',$rolestr); + my ($des_key,$firsturl,@rest)=split(/&/,$tmpinfo); + $firsturl = &unescape($firsturl); + foreach my $item (@rest) { + my ($key,$value) = split(/=/,$item); + $form{$key} = &unescape($value); } - if ($symbstr =~ /^symb=/) { - (undef,$form{'symb'}) = split('=',$symbstr); - } - if ($iptokenstr =~ /^iptoken=/) { - (undef,$form{'iptoken'}) = split('=',$iptokenstr); - } - my $upass = &Apache::loncommon::des_decrypt($key,$form{'upass0'}); # ---------------------------------------------------------------- Authenticate @@ -538,11 +555,16 @@ sub handler { ($is_balancer,$otherserver) = &Apache::lonnet::check_loadbalancing($form{'uname'},$form{'udom'},'login'); if ($is_balancer) { + # Check if browser sent a LON-CAPA load balancer cookie (and this is a balancer) + my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r); + if (($found_server) && ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) { + $otherserver = $found_server; + } if ($otherserver eq '') { my $lowest_load; ($otherserver,undef,undef,undef,$lowest_load) = &Apache::lonnet::choose_server($form{'udom'}); if ($lowest_load > 100) { - $otherserver = &Apache::lonnet::spareserver($lowest_load,$lowest_load,1,$form{'udom'}); + $otherserver = &Apache::lonnet::spareserver($r,$lowest_load,$lowest_load,1,$form{'udom'}); } } if ($otherserver ne '') { @@ -570,6 +592,8 @@ sub handler { } $r->internal_redirect($switchto); } else { + &Apache::loncommon::content_type($r,'text/html'); + $r->send_http_header; $r->print(&noswitch()); } return OK; @@ -591,6 +615,8 @@ sub handler { } $r->internal_redirect($switchto); } else { + &Apache::loncommon::content_type($r,'text/html'); + $r->send_http_header; $r->print(&noswitch()); } return OK; @@ -611,7 +637,7 @@ sub handler { # ---------------------------------------------------------- Are we overloaded? if ((($userloadpercent>100.0)||($loadpercent>100.0))) { - my $unloaded=Apache::lonnet::spareserver($loadpercent,$userloadpercent,1,$form{'udom'}); + my $unloaded=Apache::lonnet::spareserver($r,$loadpercent,$userloadpercent,1,$form{'udom'}); if (!$unloaded) { ($unloaded) = &Apache::lonnet::choose_server($form{'udom'}); } @@ -625,12 +651,70 @@ sub handler { if (($is_balancer) && ($hosthere)) { $form{'noloadbalance'} = $hosthere; } + my $extra_env; + if (($hosthere) && ($sessiondata{'sessionserver'} ne '')) { + if ($sessiondata{'origurl'} ne '') { + $firsturl = $sessiondata{'origurl'}; + $form{'firsturl'} = $sessiondata{'origurl'}; + my @names = ('role','symb','linkprot','linkkey'); + foreach my $item (@names) { + if ($sessiondata{$item} ne '') { + $form{$item} = $sessiondata{$item}; + } + } + } + } &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef, \%form); return OK; } } +sub get_form_items { + my ($r) = @_; + my $buffer; + if ($r->header_in('Content-length') > 0) { + $r->read($buffer,$r->header_in('Content-length'),0); + } + my %form; + foreach my $pair (split(/&/,$buffer)) { + my ($name,$value) = split(/=/,$pair); + $value =~ tr/+/ /; + $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; + $form{$name}=$value; + } + return %form; +} + +sub set_retry_token { + my ($form,$lonhost,$querystr) = @_; + if (ref($form) eq 'HASH') { + my ($firsturl,$token,$extras,@names); + @names = ('role','symb','iptoken'); + foreach my $name (@names) { + if ($form->{$name} ne '') { + $extras .= '&'.$name.'='.&escape($form->{$name}); + last if ($name eq 'linkprot'); + } + } + my $firsturl = $form->{'firsturl'}; + if (($firsturl ne '') || ($extras ne '')) { + $extras .= ':retry'; + $token = &Apache::lonnet::reply('tmpput:'.&escape($firsturl). + $extras,$lonhost); + if (($token eq 'con_lost') || ($token eq 'no_such_host')) { + return 'fail'; + } else { + if (ref($querystr)) { + $$querystr = 'retry='.$token; + } + return 'ok'; + } + } + } + return; +} + sub check_can_host { my ($r,$form,$authhost,$domdesc) = @_; return unless (ref($form) eq 'HASH'); @@ -671,6 +755,8 @@ sub check_can_host { if ($login_host ne '') { my $protocol = $Apache::lonnet::protocol{$login_host}; $protocol = 'http' if ($protocol ne 'https'); + my $alias = &Apache::lonnet::use_proxy_alias($r,$login_host); + $hostname = $alias if ($alias ne ''); my $newurl = $protocol.'://'.$hostname.'/adm/createaccount'; $r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA'). '