CVS log for loncom/auth/publiccheck.pm

Up to [LON-CAPA] / loncom / auth

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- For 2.11.4 (modified)
  Include changes in 1.28, 1.29

- Internal name for conditional portfolio sharing for specific IP addresses
  ranges when set by a user is now userip, to distinguish from those set
  for externalresponse (inrenal name: ip).
- Portfolio shareability setting in domain defaults (by affiliation), with
  possible override for an individual user will apply to portfolio file
  requests to a LON-CAPA node running 2.11, when the file owner's homeserver
  is 2.12 (or later).

- Portfolio shareability setting in domain defaults (by affiliation), with
  possible override for an individual user taken into account.

- For 2.11
  Backport 1.25 (part), 1.26

- For 2.11
  Modified 1.27

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()
- Domain configuration to allow domain's LON-CAPA nodes to operate behind a
  WAF/Reverse Proxy using aliased hostname (CNAME).
- Web requests from other nodes bypass the WAF as their requests are made
  directly to the server hostname (A record); same for internal LON-CAPA
  connections for lonc -> lond.

- For 2.11
  - Backport 1.25 (part)

- Name of cookie for public user set to lonPubID.

- cookie protection

- Bug 6690
  - IP-based access control for portfolio files added to existing "conditional"
    access types used to grant read access to others besides the owner.

- Support Apache 2.4
  - PerlAuthenHandler needs to set $r->user() for requests for <Location>
    directives which include Require valid-user
  - reverse changes in publiccheck.pm rev. 1.20 and 1.21
  - modify changes in lonacc.pm rev. 1.143 and 1.147
  - reverse changes in lonnet.pm rev. 1.1212 and 1.1213, and modify changes
    in rev. 1.1244 (no longer treating 2.4 as a special case).
- Apache access logs will now include username (or username:domain if user's
  domain is not server's default domain) for URLs requiring "valid-user",
- Apache access logs will now include 'public' as requester for image
  files from /res/adm/pages and also domain logos etc.

- remove trailing whitespace.

- Setting of $r->user() not required prior to Apache 2.4.

- Apache 2.4 requires $r->user() to be set, if "Require valid-user" applies to
  the requested page, otherwise there is an error:
  "No authentication done but request not allowed without authentication".

- Reverse publiccheck.pm,v 1.18, loncapa_apache.conf,v 1.189.
  - No need to assign a public user session for coursecatalog just to
    change inline menu (lonmenu.pm v 1.319 provides a general solution).

- Bug 6105
- Added consistent header for publicly accessible pages.
- Added PerlAccessHandler publiccheck to /adm/coursecatalog to get a clean environment when accessing the page.
- removed titletable which was not displayed anymore.

fixed:
- problem occurring when user tries to view own portfolio files while communication block is active
- Public user now receive the correct status information popup when accessing portfolio files while com.block. is active

improved:
- code
- mt-arguments

added:
- german translations
- sub data_table_caption
- code comments

- Skip check for icons etc. in /res/adm/pages

- convert exisiting cookie reads/validations to use
   lonnet::check_for_valid_session

Put reg exp check for domain logo in lonnet  - &is_domainimage()
checkauthen, publiccheck and lonacc all need this to serve images for log-in page if port 8080 is not in use.
Other possibilities - (1) call once in checkauthen and pass along to publiccheck and lonacc in Apache notes, or (2) modify loncapa_apach.conf.
lonhttpd to use a call to the same routine.

- missed use

Add response code of 'B' to lonnet::allowed() to indicate access to a file is currently subject to a block, because the file owner is part of a course with active communications blocking, and file viewer does not have 'evb' privilege in the course to nullify the block.

Used to block access to portfolio files.  Response of 'B' triggers blockedaccess.pm which displays information about blocking conditions.

- swithc to using helper cleaing functions and helper matchi re

- allowing public access to aboutme/portfolio

- lonnet::allowed() can now return a 'A' for 'pass phrase authentication needed'
- lonacc redirects to restricted access if A is returned

- move portfolio access restriction checking code into lonnet.pm
- some changes to take care of public users access passphrase files

- trying to reduce the number of places those re occur

- no longer need to do the err_header mode

Mechanism for user to provide passphrase, and for the server to validate it when user attempts to access a passphrase-protected portfolio file.

- reenabling public access to help documentation

Enable users to set access controls on portfolio files to permit public viewing. Third iteration of data structure in file_permissions.db for storage of access contol records. Now uses key = value for individual access control records and a key = anonymous hash for fast look-ups of all records for a single file.   Use of a temporary lock record to prevent others modifying access control records for a specific portfolio file while the record for the same file is being updated. Additional argument added to call to lonhtmlcommon::datesetter() to optionally suppress display of calendar link.

- moving get_posted_cgi from loncommon to lonacc

- part of the SSO authen support system