--- loncom/interface/domainprefs.pm	2017/01/30 19:18:33	1.160.6.79
+++ loncom/interface/domainprefs.pm	2017/10/17 14:07:23	1.160.6.86
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.160.6.79 2017/01/30 19:18:33 raeburn Exp $
+# $Id: domainprefs.pm,v 1.160.6.86 2017/10/17 14:07:23 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -262,6 +262,8 @@ sub handler {
                       help => 'Domain_Configuration_LangTZAuth',
                       header => [{col1 => 'Setting',
                                   col2 => 'Value'},
+                                 {col1 => 'Internal Authentication',
+                                  col2 => 'Value'},
                                  {col1 => 'Institutional user types',
                                   col2 => 'Assignable to e-mail usernames'}],
                       print => \&print_defaults,
@@ -618,7 +620,7 @@ sub process_changes {
     } elsif ($action eq 'autocreate') {
         $output = &modify_autocreate($dom,%domconfig);
     } elsif ($action eq 'directorysrch') {
-        $output = &modify_directorysrch($dom,%domconfig);
+        $output = &modify_directorysrch($dom,$lastactref,%domconfig);
     } elsif ($action eq 'usercreation') {
         $output = &modify_usercreation($dom,%domconfig);
     } elsif ($action eq 'selfcreation') {
@@ -744,7 +746,7 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') ||
-            ($action eq 'contacts')) {
+            ($action eq 'contacts') || ($action eq 'defaults')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -3060,8 +3062,10 @@ sub print_helpsettings {
         my $css_class;
         my %existing=&Apache::lonnet::dump('roles',$dom,$confname,'rolesdef_');
         my (%customroles,%ordered,%current);
-        if (ref($settings->{'adhoc'}) eq 'HASH') {
-            %current = %{$settings->{'adhoc'}};
+        if (ref($settings) eq 'HASH') {
+            if (ref($settings->{'adhoc'}) eq 'HASH') {
+                %current = %{$settings->{'adhoc'}};
+            }
         }
         my $count = 0;
         foreach my $key (sort(keys(%existing))) {
@@ -3097,7 +3101,7 @@ sub print_helpsettings {
                 @jsarray = ('bystatus');
             }
         }
-        my %domhelpdesk = &Apache::lonnet::get_active_domroles($dom,['dh'.'da']);
+        my %domhelpdesk = &Apache::lonnet::get_active_domroles($dom,['dh','da']);
         if (keys(%domhelpdesk)) {
             push(@accesstypes,('inc','exc'));
             push(@jsarray,('notinc','notexc'));
@@ -3725,7 +3729,7 @@ sub print_coursedefaults {
         foreach my $type (@types) {
             $datatable .= '<td align="center">'.&mt($type).'<br />'.
                            '<input type="text" name="mysqltables_'.$type.'"'.
-                           ' value="'.$currmysql{$type}.'" size="5" /></td>';
+                           ' value="'.$currmysql{$type}.'" size="8" /></td>';
         }
         $datatable .= '</tr></table></td></tr>'."\n";
         $itemcount ++;
@@ -5402,7 +5406,10 @@ sub print_usermodification {
 sub print_defaults {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my $rownum = 0;
-    my ($datatable,$css_class);
+    my ($datatable,$css_class,$titles);
+    unless ($position eq 'bottom') {
+        $titles = &defaults_titles($dom);
+    }
     if ($position eq 'top') {
         my @items = ('auth_def','auth_arg_def','lang_def','timezone_def',
                      'datelocale_def','portal_def');
@@ -5415,7 +5422,6 @@ sub print_defaults {
                 $defaults{$item} = $domdefaults{$item};
             }
         }
-        my $titles = &defaults_titles($dom);
         foreach my $item (@items) {
             if ($rownum%2) {
                 $css_class = '';
@@ -5463,8 +5469,87 @@ sub print_defaults {
             $datatable .= '</td></tr>';
             $rownum ++;
         }
+    } elsif ($position eq 'middle') {
+        my @items = ('intauth_cost','intauth_check','intauth_switch');
+        my %defaults;
+        if (ref($settings) eq 'HASH') {
+            %defaults = %{$settings};
+            if ($defaults{'intauth_cost'} !~ /^\d+$/) {
+                $defaults{'intauth_cost'} = 10;
+            }
+            if ($defaults{'intauth_check'} !~ /^(0|1|2)$/) {
+                $defaults{'intauth_check'} = 0;
+            }
+            if ($defaults{'intauth_switch'} !~ /^(0|1|2)$/) {
+                $defaults{'intauth_switch'} = 0;
+            }
+        } else {
+            %defaults = (
+                          'intauth_cost'   => 10,
+                          'intauth_check'  => 0,
+                          'intauth_switch' => 0,
+                        );
+        }
+        foreach my $item (@items) {
+            if ($rownum%2) {
+                $css_class = '';
+            } else {
+                $css_class = ' class="LC_odd_row" ';
+            }
+            $datatable .= '<tr'.$css_class.'>'.
+                          '<td><span class="LC_nobreak">'.$titles->{$item}.
+                          '</span></td><td class="LC_left_item" colspan="3">';
+            if ($item eq 'intauth_switch') {
+                my @options = (0,1,2);
+                my %optiondesc = &Apache::lonlocal::texthash (
+                                   0 => 'No',
+                                   1 => 'Yes',
+                                   2 => 'Yes, and copy existing passwd file to passwd.bak file',
+                                 );
+                $datatable .= '<table width="100%">';
+                foreach my $option (@options) {
+                    my $checked = ' ';
+                    if ($defaults{$item} eq $option) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
+                                  '<label><input type="radio" name="'.$item.
+                                  '" value="'.$option.'"'.$checked.' />'.
+                                  $optiondesc{$option}.'</label></span></td></tr>';
+                }
+                $datatable .= '</table>';
+            } elsif ($item eq 'intauth_check') {
+                my @options = (0,1,2);
+                my %optiondesc = &Apache::lonlocal::texthash (
+                                   0 => 'No',
+                                   1 => 'Yes, allow login then update passwd file using default cost (if higher)',
+                                   2 => 'Yes, disallow login if stored cost is less than domain default',
+                                 );
+                $datatable .= '<table wisth="100%">';
+                foreach my $option (@options) {
+                    my $checked = ' ';
+                    my $onclick;
+                    if ($defaults{$item} eq $option) {
+                        $checked = ' checked="checked"';
+                    }
+                    if ($option == 2) {
+                        $onclick = ' onclick="javascript:warnIntAuth(this);"';
+                    }
+                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
+                                  '<label><input type="radio" name="'.$item.
+                                  '" value="'.$option.'"'.$checked.$onclick.' />'.
+                                  $optiondesc{$option}.'</label></span></td></tr>';
+                }
+                $datatable .= '</table>';
+            } else {
+                $datatable .= '<input type="text" name="'.$item.'" value="'.
+                              $defaults{$item}.'" size="3" onblur="javascript:warnIntAuth(this);" />';
+            }
+            $datatable .= '</td></tr>';
+            $rownum ++;
+        }
     } else {
-        my (%defaults);
+        my %defaults;
         if (ref($settings) eq 'HASH') {
             if ((ref($settings->{'inststatusorder'}) eq 'ARRAY') && (ref($settings->{'inststatustypes'}) eq 'HASH') &&
                 (ref($settings->{'inststatusguest'}) eq 'ARRAY')) {
@@ -5559,6 +5644,9 @@ sub defaults_titles {
                    'timezone_def'  => 'Default timezone',
                    'datelocale_def' => 'Default locale for dates',
                    'portal_def'     => 'Portal/Default URL',
+                   'intauth_cost'   => 'Encryption cost for bcrypt (positive integer)',
+                   'intauth_check'  => 'Check bcrypt cost if authenticated',
+                   'intauth_switch' => 'Existing crypt-based switched to bcrypt on authentication',
                  );
     if ($dom) {
         my $uprimary_id = &Apache::lonnet::domain($dom,'primary');
@@ -6062,7 +6150,35 @@ sub serverstatus_pages {
 
 sub defaults_javascript {
     my ($settings) = @_;
-    return unless (ref($settings) eq 'HASH');
+    my $intauthcheck = &mt('Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.');
+    my $intauthcost = &mt('Warning: bcrypt encryption cost for internal authentication must be an integer.');
+    &js_escape(\$intauthcheck);
+    &js_escape(\$intauthcost);
+    my $intauthjs = <<"ENDSCRIPT";
+
+function warnIntAuth(field) {
+    if (field.name == 'intauth_check') {
+        if (field.value == '2') {
+            alert('$intauthcheck');
+        }
+    }
+    if (field.name == 'intauth_cost') {
+        field.value.replace(/\s/g,'');
+        if (field.value != '') {
+            var regexdigit=/^\\d+\$/;
+            if (!regexdigit.test(field.value)) {
+                alert('$intauthcost');
+            }
+        }
+    }
+    return;
+}
+
+ENDSCRIPT
+
+    if (ref($settings) ne 'HASH') {
+        return &Apache::lonhtmlcommon::scripttag($intauthjs);
+    }
     if ((ref($settings->{'inststatusorder'}) eq 'ARRAY') && (ref($settings->{'inststatustypes'}) eq 'HASH')) {
         my $maxnum = scalar(@{$settings->{'inststatusorder'}});
         if ($maxnum eq '') {
@@ -6116,10 +6232,14 @@ $jstext
     return;
 }
 
+$intauthjs
+
 // ]]>
 </script>
 
 ENDSCRIPT
+    } else {
+        return &Apache::lonhtmlcommon::scripttag($intauthjs);
     }
 }
 
@@ -8644,9 +8764,9 @@ sub modify_autoenroll {
             }
             if ($changes{'autofailsafe'}) {
                 if ($failsafe ne '') {
-                    $resulttext .= '<li>'.&mt("$title{'failsafe'} set to [_1]",$failsafe).'</li>';
+                    $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section set to: [_1]',$failsafe).'</li>';
                 } else {
-                    $resulttext .= '<li>'.&mt("$title{'failsafe'} deleted");
+                    $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section: deleted');
                 }
                 &Apache::lonnet::get_domain_defaults($dom,1);
                 if (ref($lastactref) eq 'HASH') {
@@ -8925,7 +9045,7 @@ sub modify_autocreate {
 }
 
 sub modify_directorysrch {
-    my ($dom,%domconfig) = @_;
+    my ($dom,$lastactref,%domconfig) = @_;
     my ($resulttext,%changes);
     my %currdirsrch;
     if (ref($domconfig{'directorysrch'}) eq 'HASH') {
@@ -9119,6 +9239,10 @@ sub modify_directorysrch {
                 $resulttext .= '<li>'.&mt($title{'searchtypes'}.' set to: "[_1]"',$chgtext).'</li>';
             }
             $resulttext .= '</ul>';
+            &Apache::lonnet::do_cache_new('directorysrch',$dom,$dirsrch_hash{'directorysrch'},3600);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'directorysrch'} = 1;
+            }
         } else {
             $resulttext = &mt('No changes made to directory search settings');
         }
@@ -10008,7 +10132,7 @@ sub modify_selfcreation {
         $save_usercreate{'cancreate'}{'shibenv'} = $cancreate{'shibenv'};
     }
     $save_usercreate{'cancreate'}{'emailusername'} = $cancreate{'emailusername'};
-    $save_usercreate{'emailrule'} = \@email_rule;
+    $save_usercreate{'email_rule'} = \@email_rule;
 
     my %userconfig_hash = (
             usercreation     => \%save_usercreate,
@@ -10444,7 +10568,8 @@ sub modify_defaults {
     my ($dom,$lastactref,%domconfig) = @_;
     my ($resulttext,$mailmsgtxt,%newvalues,%changes,@errors);
     my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
-    my @items = ('auth_def','auth_arg_def','lang_def','timezone_def','datelocale_def','portal_def');
+    my @items = ('auth_def','auth_arg_def','lang_def','timezone_def','datelocale_def',
+                 'portal_def','intauth_cost','intauth_check','intauth_switch');
     my @authtypes = ('internal','krb4','krb5','localauth');
     foreach my $item (@items) {
         $newvalues{$item} = $env{'form.'.$item};
@@ -10486,6 +10611,24 @@ sub modify_defaults {
                     push(@errors,$item);
                 }
             }
+        } elsif ($item eq 'intauth_cost') {
+            if ($newvalues{$item} ne '') {
+                if ($newvalues{$item} =~ /\D/) {
+                    push(@errors,$item);
+                }
+            }
+        } elsif ($item eq 'intauth_check') {
+            if ($newvalues{$item} ne '') {
+                unless ($newvalues{$item} =~ /^(0|1|2)$/) {
+                    push(@errors,$item);
+                }
+            }
+        } elsif ($item eq 'intauth_switch') {
+            if ($newvalues{$item} ne '') {
+                unless ($newvalues{$item} =~ /^(0|1|2)$/) {
+                    push(@errors,$item);
+                }
+            }
         }
         if (grep(/^\Q$item\E$/,@errors)) {
             $newvalues{$item} = $domdefaults{$item};
@@ -10640,6 +10783,28 @@ sub modify_defaults {
                                           localauth  => 'loc',
                         );
                         $value = $authnames{$shortauth{$value}};
+                    } elsif ($item eq 'intauth_switch') {
+                        my %optiondesc = &Apache::lonlocal::texthash (
+                                            0 => 'No',
+                                            1 => 'Yes',
+                                            2 => 'Yes, and copy existing passwd file to passwd.bak file',
+                                         );
+                        if ($value =~ /^(0|1|2)$/) {
+                            $value = $optiondesc{$value};
+                        } else {
+                            $value = &mt('none -- defaults to No');
+                        }
+                    } elsif ($item eq 'intauth_check') {
+                        my %optiondesc = &Apache::lonlocal::texthash (
+                                             0 => 'No',
+                                             1 => 'Yes, allow login then update passwd file using default cost (if higher)',
+                                             2 => 'Yes, disallow login if stored cost is less than domain default',
+                                         );
+                        if ($value =~ /^(0|1|2)$/) {
+                            $value = $optiondesc{$value};
+                        } else {
+                            $value = &mt('none -- defaults to No');
+                        }
                     }
                     $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$title->{$item},$value).'</li>';
                     $mailmsgtext .= "$title->{$item} set to $value\n";  
@@ -11400,7 +11565,7 @@ sub modify_helpsettings {
                                                                    order  => 'Order',
                                                                    desc   => 'Role description',
                                                                    access => 'Role usage',
-                                                                   status => 'Allowed instituional types',
+                                                                   status => 'Allowed institutional types',
                                                                    exc    => 'Allowed personnel',
                                                                    inc    => 'Disallowed personnel',
                         );
@@ -12316,8 +12481,10 @@ sub modify_usersessions {
             }
             my $cachetime = 24*60*60;
             &Apache::lonnet::do_cache_new('domdefaults',$dom,\%domdefaults,$cachetime);
+            &Apache::lonnet::do_cache_new('usersessions',$dom,$defaultshash{'usersessions'},3600);
             if (ref($lastactref) eq 'HASH') {
                 $lastactref->{'domdefaults'} = 1;
+                $lastactref->{'usersessions'} = 1;
             }
             if (keys(%changes) > 0) {
                 my %lt = &usersession_titles();
@@ -13401,7 +13568,7 @@ sub devalidate_remote_domconfs {
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
     my %thismachine;
     map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
-    my @posscached = ('domainconfig','domdefaults');
+    my @posscached = ('domainconfig','domdefaults','usersessions','directorysrch');
     if (keys(%servers)) {
         foreach my $server (keys(%servers)) {
             next if ($thismachine{$server});