--- loncom/interface/domainprefs.pm	2019/04/26 20:15:30	1.355
+++ loncom/interface/domainprefs.pm	2019/05/06 19:28:17	1.359
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.355 2019/04/26 20:15:30 raeburn Exp $
+# $Id: domainprefs.pm,v 1.359 2019/05/06 19:28:17 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -219,7 +219,7 @@ sub handler {
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
                 'requestauthor','selfenrollment','inststatus',
-                'ltitools','ssl','trust','lti','passwords'],$dom);
+                'ltitools','ssl','trust','lti','privacy','passwords'],$dom);
     my %encconfig =
         &Apache::lonnet::get_dom('encconfig',['ltitools','lti'],$dom);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
@@ -247,7 +247,7 @@ sub handler {
         }
     }
     my @prefs_order = ('rolecolors','login','defaults','passwords','quotas','autoenroll',
-                       'autoupdate','autocreate','directorysrch','contacts',
+                       'autoupdate','autocreate','directorysrch','contacts','privacy',
                        'usercreation','selfcreation','usermodification','scantron',
                        'requestcourses','requestauthor','coursecategories',
                        'serverstatuses','helpsettings','coursedefaults',
@@ -497,10 +497,16 @@ sub handler {
                   modify => \&modify_selfenrollment,
                  },
         'privacy' => 
-                 {text   => 'User Privacy',
+                 {text   => 'Availability of User Information',
                   help   => 'Domain_Configuration_User_Privacy',
-                  header => [{col1 => 'Setting',
-                              col2 => 'Value',}],
+                  header => [{col1 => 'Role assigned in different domain',
+                              col2 => 'Approval options'},
+                             {col1 => 'Role assigned in different domain to user of type',
+                              col2 => 'User information available in that domain'},
+                             {col1 => "Role assigned in user's domain",
+                              col2 => 'Information viewable by privileged user'},
+                             {col1 => "Role assigned in user's domain",
+                              col2 => 'Information viewable by unprivileged user'}],
                   print => \&print_privacy,
                   modify => \&modify_privacy,
                  },
@@ -771,6 +777,8 @@ sub process_changes {
         $output = &modify_trust($dom,$lastactref,%domconfig);
     } elsif ($action eq 'lti') {
         $output = &modify_lti($r,$dom,$action,$lastactref,%domconfig);
+    } elsif ($action eq 'privacy') {
+        $output = &modify_privacy($dom,%domconfig);
     } elsif ($action eq 'passwords') {
         $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
     }
@@ -844,7 +852,7 @@ sub print_config_box {
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'ssl') ||
             ($action eq 'directorysrch') || ($action eq 'trust') || ($action eq 'helpsettings') ||
-            ($action eq 'contacts')) {
+            ($action eq 'contacts') || ($action eq 'privacy')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'passwords') {
             $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
@@ -879,7 +887,8 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') || 
-            ($action eq 'trust') || ($action eq 'contacts') || ($action eq 'passwords')) {
+            ($action eq 'trust') || ($action eq 'contacts') ||
+            ($action eq 'privacy') || ($action eq 'passwords')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -932,7 +941,7 @@ sub print_config_box {
              </tr>'."\n";
                 if ($action eq 'coursecategories') {
                     $output .= &print_coursecategories('bottom',$dom,$item,$settings,\$rowtotal);
-                } elsif (($action eq 'contacts') || ($action eq 'passwords')) {
+                } elsif (($action eq 'contacts') || ($action eq 'privacy') || ($action eq 'passwords')) {
                     if ($action eq 'passwords') {
                         $output .= $item->{'print'}->('lower',$dom,$confname,$settings,\$rowtotal);
                     } else {
@@ -5800,6 +5809,124 @@ sub print_validation_rows {
     return $datatable;
 }
 
+sub print_privacy {
+    my ($position,$dom,$settings,$rowtotal) = @_;
+    my ($datatable,$css_class,$numinrow,@items,%names,$othertitle,$usertypes,$types);
+    my $itemcount = 0;
+    unless ($position eq 'top') {
+        @items = ('domain','author','course','community');
+        %names = &Apache::lonlocal::texthash (
+                     domain => 'Assigned domain role(s)',
+                     author => 'Assigned co-author role(s)',
+                     course => 'Assigned course role(s)',
+                     community => 'Assigned community role',
+                 );
+        $numinrow = 4;
+        ($othertitle,$usertypes,$types) =
+            &Apache::loncommon::sorted_inst_types($dom);
+    }
+    if (($position eq 'top') || ($position eq 'middle')) {
+        my (%by_ip,%by_location,@intdoms,@instdoms);
+        &build_location_hashes(\@intdoms,\%by_ip,\%by_location,\@instdoms);
+        if ($position eq 'top') {
+            my %curr;
+            my @options = ('none','user','domain','auto');
+            my %titles = &Apache::lonlocal::texthash (
+                none   => 'Not allowed',
+                user   => 'User authorizes',
+                domain => 'DC authorizes',
+                auto   => 'Unrestricted',
+                instdom => 'Other domain shares institution/provider',
+                extdom => 'Other domain has different institution/provider',
+            );
+            my %names = &Apache::lonlocal::texthash (
+                domain => 'Domain role',
+                author => 'Co-author role',
+                course => 'Course role',
+                community => 'Community role',
+            );
+            my $primary_id = &Apache::lonnet::domain($dom,'primary');
+            my $intdom = &Apache::lonnet::internet_dom($primary_id);
+            foreach my $domtype ('instdom','extdom') {
+                my (%checked,$skip);
+                $css_class = $itemcount%2?' class="LC_odd_row"':'';
+                $datatable .= '<tr'.$css_class.'><td>'.$titles{$domtype}.'</td>'.
+                              '<td class="LC_left_item">';
+                if ($domtype eq 'instdom') {
+                    unless (@instdoms > 1) {
+                        $datatable .= &mt('Nothing to set, as no domains besides [_1] are hosted by [_2]',$dom,$intdom);
+                        $skip = 1;
+                    }
+                } elsif ($domtype eq 'extdom') {
+                    if (keys(%by_location) == 0) {
+                        $datatable .= &mt('Nothing to set, as no other hosts besides [_1]',$intdom);
+                        $skip = 1;
+                    }
+                }
+                unless ($skip) {
+                    foreach my $roletype ('domain','author','course','community') {
+                        $checked{'auto'} = ' checked="checked"';
+                        if (ref($settings) eq 'HASH') {
+                            if (ref($settings->{approval}) eq 'HASH') {
+                                if (ref($settings->{approval}->{$domtype}) eq 'HASH') {
+                                    if ($settings->{approval}->{$domtype}->{$roletype}=~ /^(none|user|domain)$/) {
+                                        $checked{$1} = ' checked="checked"';
+                                        $checked{'auto'} = '';
+                                    }
+                                }
+                            }
+                        }
+                        $datatable .= '<fieldset><legend>'.$names{$roletype}.'</legend>';
+                        foreach my $option (@options) {
+                            $datatable .= '<span class="LC_nobreak"><label>'.
+                                          '<input type="radio" name="privacy_approval_'.$domtype.'_'.$roletype.'" '.
+                                          'value="'.$option.'"'.$checked{$option}.' />'.$titles{$option}.
+                                          '</label></span>&nbsp; ';
+                        }
+                        $datatable .= '</fieldset>';
+                    }
+                }
+                $datatable .= '</td></tr>';
+                $itemcount ++;
+            }
+        } elsif ($position eq 'middle') {
+            if ((@instdoms > 1) || (keys(%by_location) > 0)) {
+                if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                    foreach my $item (@{$types}) {
+                        $datatable .= &modifiable_userdata_row('privacy','othdom_'.$item,$settings,
+                                                               $numinrow,$itemcount,'','','','','',
+                                                               '',$usertypes->{$item});
+                        $itemcount ++;
+                    }
+                }
+                $datatable .= &modifiable_userdata_row('privacy','othdom_default',$settings,
+                                                       $numinrow,$itemcount,'','','','','',
+                                                       '',$othertitle);
+                $itemcount ++;
+            } else {
+                $datatable .= &mt('Nothing to set here, as there are no other domains');
+            }
+        }
+    } else {
+        my $prefix;
+        if ($position eq 'lower') {
+            $prefix = 'priv';
+        } else {
+            $prefix = 'unpriv';
+        }
+        foreach my $item (@items) {
+            $datatable .= &modifiable_userdata_row('privacy',$prefix.'_'.$item,$settings,
+                                                   $numinrow,$itemcount,'','','','','',
+                                                   '',$names{$item});
+            $itemcount ++;
+        }
+    }
+    if (ref($rowtotal)) {
+        $$rowtotal += $itemcount;
+    }
+    return $datatable;
+}
+
 sub print_passwords {
     my ($position,$dom,$confname,$settings,$rowtotal) = @_;
     my ($datatable,$css_class);
@@ -5822,6 +5949,7 @@ sub print_passwords {
         max            => 'Maximum password length',
         chars          => 'Required characters',
         expire         => 'Password expiration (days)',
+        numsaved       => 'Number of previous passwords to save and disallow reuse',
     );
     if ($position eq 'top') {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
@@ -6085,7 +6213,7 @@ sub print_passwords {
             $itemcount ++;
         }
     } elsif ($position eq 'lower') {
-        my ($min,$max,%chars,$expire);
+        my ($min,$max,%chars,$expire,$numsaved);
         if (ref($settings) eq 'HASH') {
             if ($settings->{min}) {
                 $min = $settings->{min};
@@ -6099,6 +6227,9 @@ sub print_passwords {
             if ($settings->{expire}) {
                 $expire = $settings->{expire};
             }
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
         } else {
             $min = '7';
         }
@@ -6161,30 +6292,68 @@ sub print_passwords {
                       '<input type="text" name="passwords_expire" value="'.$expire.'" size="4" />'.
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no expiration)').'</span>'.
                       '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
     } else {
-        my $checkedon;
-        my $checkedoff = ' checked="checked"';
+        my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+        my %ownerchg = (
+                          by  => {},
+                          for => {},
+                       );
+        my %ownertitles = &Apache::lonlocal::texthash (
+                            by  => 'Course owner status(es) allowed',
+                            for => 'Student status(es) allowed',
+                          );
         if (ref($settings) eq 'HASH') {
-            if ($settings->{crsownerchg}) {
-                $checkedon = $checkedoff;
-                $checkedoff = '';
+            if (ref($settings->{crsownerchg}) eq 'HASH') {
+                if (ref($settings->{crsownerchg}{'by'}) eq 'ARRAY') {
+                    map { $ownerchg{by}{$_} = 1; } (@{$settings->{crsownerchg}{'by'}});
+                }
+                if (ref($settings->{crsownerchg}{'for'}) eq 'ARRAY') {
+                    map { $ownerchg{for}{$_} = 1; } (@{$settings->{crsownerchg}{'for'}});
+                }
             }
         }
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr '.$css_class.'>'.
                       '<td>'.
                       &mt('Requirements').'<ul>'.
-                      '<li>'.&mt("Course 'type' is not a Community").'</li>'.
+                      '<li>'.&mt("Course 'type' is not a Community or Placement Test").'</li>'.
                       '<li>'.&mt('User is Course Coordinator and also course owner').'</li>'.
                       '<li>'.&mt("Student's only active roles are student role(s) in course(s) owned by this user").'</li>'.
+                      '<li>'.&mt('User, course, and student share same domain').'</li>'.
                       '</ul>'.
                       '</td>'.
-                      '<td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.
-                      '<label><input type="radio" name="passwords_crsowner" value="1"'.$checkedon.' />'.&mt('Yes').'</label></span> &nbsp;&nbsp;'.
-                      '<span class="LC_nobreak"><label><input type="radio" name="passwords_crsowner" value="0"'.$checkedoff.' />'.
-                      &mt('No').'</label></span>'.
-                      '</td></tr>';
-
+                      '<td class="LC_left_item">';
+        foreach my $item ('by','for') {
+            $datatable .= '<fieldset style="display: inline-block;">'.
+                          '<legend>'.$ownertitles{$item}.'</legend>';
+            if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                foreach my $type (@{$types}) {
+                    my $checked;
+                    if ($ownerchg{$item}{$type}) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<span class="LC_nobreak"><label>'.
+                                  '<input type="checkbox" name="passwords_crsowner_'.$item.'" value="'.
+                                  $type.'"'.$checked.' />'.$usertypes->{$type}.'</label>'.
+                                  '<span>&nbsp;&nbsp; ';
+                }
+            }
+            my $checked;
+            if ($ownerchg{$item}{'default'}) {
+                $checked = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label><input type="checkbox" '.
+                          'name="passwords_crsowner_'.$item.'" value="default"'.$checked.' />'.
+                          $othertitle.'</label></span></fieldset>';
+        }
+        $datatable .= '</td></tr>';
     }
     return $datatable;
 }
@@ -9355,7 +9524,7 @@ sub build_category_rows {
 
 sub modifiable_userdata_row {
     my ($context,$item,$settings,$numinrow,$rowcount,$usertypes,$fieldsref,$titlesref,
-        $rowid,$customcss,$rowstyle) = @_;
+        $rowid,$customcss,$rowstyle,$itemdesc) = @_;
     my ($role,$rolename,$statustype);
     $role = $item;
     if ($context eq 'cancreate') {
@@ -9378,6 +9547,8 @@ sub modifiable_userdata_row {
         }
     } elsif ($context eq 'lti') {
         $rolename = &mt('Institutional data used (if available)');
+    } elsif ($context eq 'privacy') {
+        $rolename = $itemdesc;
     } else {
         if ($role eq 'cr') {
             $rolename = &mt('Custom role');
@@ -9427,6 +9598,13 @@ sub modifiable_userdata_row {
             if (ref($settings) eq 'HASH') {
                 $hashref = $settings->{'instdata'};
             }
+        } elsif ($context eq 'privacy') {
+            my ($key,$inner) = split(/_/,$role);
+            if (ref($settings) eq 'HASH') {
+                if (ref($settings->{$key}) eq 'HASH') {
+                    $hashref = $settings->{$key}->{$inner};
+                }
+            }
         } elsif (ref($settings->{$context}) eq 'HASH') {
             if (ref($settings->{$context}->{$role}) eq 'HASH') {
                 $hashref = $settings->{'lti_instdata'};
@@ -9465,6 +9643,24 @@ sub modifiable_userdata_row {
         unless ($role eq 'emailusername') {
             if (exists($checks{$fields[$i]})) {
                 $check = $checks{$fields[$i]};
+            } elsif ($context eq 'privacy') {
+                if ($role =~ /^priv_(domain|course)$/) {
+                    if (ref($settings) ne 'HASH') {
+                        $check = ' checked="checked" ';
+                    }
+                } elsif ($role =~ /^priv_(author|community)$/) {
+                    if (ref($settings) ne 'HASH') {
+                        unless ($fields[$i] eq 'id') {
+                            $check = ' checked="checked" ';
+                        }
+                    }
+                } elsif ($role =~ /^(unpriv|othdom)_/) {
+                    if (ref($settings) ne 'HASH') {
+                        if (($fields[$i] eq 'lastname') || ($fields[$i] eq 'firstname')) {
+                            $check = ' checked="checked" ';
+                        }
+                    }
+                }
             } elsif ($context ne 'lti') {
                 if ($role eq 'st') {
                     if (ref($settings) ne 'HASH') {
@@ -9493,6 +9689,8 @@ sub modifiable_userdata_row {
         } else {
             if ($context eq 'lti') {
                 $prefix = 'lti';
+            } elsif ($context eq 'privacy') {
+                $prefix = 'privacy';
             }
             $output .= '<label>'.
                        '<input type="checkbox" name="'.$prefix.'_'.$role.'" '.
@@ -13958,6 +14156,230 @@ sub modify_contacts {
     return $resulttext;
 }
 
+sub modify_privacy {
+    my ($dom,%domconfig) = @_;
+    my ($resulttext,%current,%changes);
+    if (ref($domconfig{'privacy'}) eq 'HASH') {
+        %current = %{$domconfig{'privacy'}};
+    }
+    my @fields = ('lastname','firstname','middlename','generation','permanentemail','id');
+    my @items = ('domain','author','course','community');
+    my %names = &Apache::lonlocal::texthash (
+                   domain => 'Assigned domain role(s)',
+                   author => 'Assigned co-author role(s)',
+                   course => 'Assigned course role(s)',
+                   community => 'Assigned community role',
+                );
+    my %roles = &Apache::lonlocal::texthash (
+                   domain => 'Domain role',
+                   author => 'Co-author role',
+                   course => 'Course role',
+                   community => 'Community role',
+                );
+    my %titles = &Apache::lonlocal::texthash (
+                  approval => 'Approval for role in different domain',
+                  othdom   => 'User information available in other domain',
+                  priv     => 'Information viewable by privileged user in same domain',
+                  unpriv   => 'Information viewable by unprivileged user in same domain',
+                  instdom  => 'Other domain shares institution/provider',
+                  extdom   => 'Other domain has different institution/provider',
+                  none     => 'Not allowed',
+                  user     => 'User authorizes',
+                  domain   => 'Domain Coordinator authorizes',
+                  auto     => 'Unrestricted',
+    );
+    my %fieldnames = &Apache::lonlocal::texthash (
+                        id => 'Student/Employee ID',
+                        permanentemail => 'E-mail address',
+                        lastname => 'Last Name',
+                        firstname => 'First Name',
+                        middlename => 'Middle Name',
+                        generation => 'Generation',
+    );
+    my ($othertitle,$usertypes,$types) =
+        &Apache::loncommon::sorted_inst_types($dom);
+    my (%by_ip,%by_location,@intdoms,@instdoms);
+    &build_location_hashes(\@intdoms,\%by_ip,\%by_location,\@instdoms);
+
+    my %privacyhash = (
+                       'approval' => {
+                                       instdom => {},
+                                       extdom  => {},
+                                     },
+                       'othdom'   => {},
+                       'priv'     => {},
+                       'unpriv'   => {},
+                      );
+    foreach my $item (@items) {
+        if (@instdoms > 1) {
+            if ($env{'form.privacy_approval_instdom'.$item} =~ /^(none|user|domain|auto)$/) {
+                $privacyhash{'approval'}{'instdom'}{$item} = $env{'form.privacy_approval_instdom_'.$item};
+            }
+            if (ref($current{'approval'}) eq 'HASH') {
+                if (ref($current{'approval'}{'instdom'}) eq 'HASH') {
+                    unless ($privacyhash{'approval'}{'instdom'}{$item} eq $current{'approval'}{'instdom'}{$item}) {
+                        $changes{'approval'} = 1;
+                    }
+                }
+            } elsif ($privacyhash{'approval'}{'instdom'}{$item} ne 'auto') {
+                $changes{'approval'} = 1;
+            }
+        }
+        if (keys(%by_location) > 0) {
+            if ($env{'form.privacy_approval_extdom_'.$item} =~ /^(none|user|domain|auto)$/) {
+                $privacyhash{'approval'}{'extdom'}{$item} = $env{'form.privacy_approval_extdom_'.$item};
+            }
+            if (ref($current{'approval'}) eq 'HASH') {
+                if (ref($current{'approval'}{'extdom'}) eq 'HASH') {
+                    unless ($privacyhash{'approval'}{'extdom'}{$item} eq $current{'approval'}{'extdom'}{$item}) {
+                        $changes{'approval'} = 1;
+                    }
+                }
+            } elsif ($privacyhash{'approval'}{'extdom'}{$item} ne 'auto') {
+                $changes{'approval'} = 1;
+            }
+        }
+        foreach my $status ('priv','unpriv') {
+            my @possibles = sort(&Apache::loncommon::get_env_multiple('form.privacy_'.$status.'_'.$item));
+            my @newvalues;
+            foreach my $field (@possibles) {
+                if (grep(/^\Q$field\E$/,@fields)) {
+                    $privacyhash{$status}{$item}{$field} = 1;
+                    push(@newvalues,$field);
+                }
+            }
+            @newvalues = sort(@newvalues);
+            if (ref($current{$status}) eq 'HASH') {
+                if (ref($current{$status}{$item}) eq 'HASH') {
+                    my @currvalues = sort(keys(%{$current{$status}{$item}}));
+                    my @diffs = &Apache::loncommon::compare_arrays(\@currvalues,\@newvalues);
+                    if (@diffs > 0) {
+                        $changes{$status} = 1;
+                    }
+                }
+            } else {
+                my @stdfields;
+                foreach my $field (@fields) {
+                    if ($field eq 'id') {
+                        next if ($status eq 'unpriv');
+                        next if (($status eq 'priv') && ($item eq 'community'));
+                    }
+                    push(@stdfields,$field);
+                }
+                my @diffs = &Apache::loncommon::compare_arrays(\@stdfields,\@newvalues);
+                if (@diffs > 0) {
+                    $changes{$status} = 1;
+                }
+            }
+        }
+    }
+    if ((@instdoms > 1) || (keys(%by_location) > 0)) {
+        my @statuses;
+        if (ref($types) eq 'ARRAY') {
+            @statuses = @{$types};
+        }
+        foreach my $type (@statuses,'default') {
+            my @possfields = &Apache::loncommon::get_env_multiple('form.privacy_othdom_'.$type);
+            my @newvalues;
+            foreach my $field (sort(@possfields)) {
+                if (grep(/^\Q$field\E$/,@fields)) {
+                    $privacyhash{'othdom'}{$type}{$field} = 1;
+                    push(@newvalues,$field);
+                }
+            }
+            @newvalues = sort(@newvalues);
+            if (ref($current{'othdom'}) eq 'HASH') {
+                if (ref($current{'othdom'}{$type}) eq 'HASH') {
+                    my @currvalues = sort(keys(%{$current{'othdom'}{$type}}));
+                    my @diffs = &Apache::loncommon::compare_arrays(\@currvalues,\@newvalues);
+                    if (@diffs > 0) {
+                        $changes{'othdom'} = 1;
+                    }
+                }
+            } else {
+                my @stdfields = ('lastname','firstname','middlename','generation','permanentemail');
+                my @diffs = &Apache::loncommon::compare_arrays(\@stdfields,\@newvalues);
+                if (@diffs > 0) {
+                    $changes{'othdom'} = 1;
+                }
+            }
+        }
+    }
+    my %confighash = (
+                        privacy => \%privacyhash,
+                     );
+    my $putresult = &Apache::lonnet::put_dom('configuration',\%confighash,$dom);
+    if ($putresult eq 'ok') {
+        if (keys(%changes) > 0) {
+            $resulttext = &mt('Changes made: ').'<ul>';
+            foreach my $key ('approval','othdom','priv','unpriv') {
+                if ($changes{$key}) {
+                    $resulttext .= '<li>'.$titles{$key}.':<ul>';
+                    if ($key eq 'approval') {
+                        if (keys(%{$privacyhash{$key}{instdom}})) {
+                            $resulttext .= '<li>'.$titles{'instdom'}.'<ul>';
+                            foreach my $item (@items) {
+                                $resulttext .=  '<li>'.$roles{$item}.': '.$titles{$privacyhash{$key}{instdom}{$item}}.'</li>';
+                            }
+                            $resulttext .= '</ul></li>';
+                        }
+                        if (keys(%{$privacyhash{$key}{extdom}})) {
+                            $resulttext .= '<li>'.$titles{'extdom'}.'<ul>';
+                            foreach my $item (@items) {
+                                $resulttext .=  '<li>'.$roles{$item}.': '.$titles{$privacyhash{$key}{extdom}{$item}}.'</li>';
+                            }
+                            $resulttext .= '</ul></li>';
+                        }
+                    } elsif ($key eq 'othdom') {
+                        my @statuses;
+                        if (ref($types) eq 'ARRAY') {
+                            @statuses = @{$types};
+                        }
+                        if (ref($privacyhash{$key}) eq 'HASH') {
+                            foreach my $status (@statuses,'default') {
+                                if ($status eq 'default') {
+                                    $resulttext .= '<li>'.$othertitle.': ';
+                                } elsif (ref($usertypes) eq 'HASH') {
+                                    $resulttext .= '<li>'.$usertypes->{$status}.': ';
+                                } else {
+                                    next;
+                                }
+                                if (ref($privacyhash{$key}{$status}) eq 'HASH') {
+                                    if (keys(%{$privacyhash{$key}{$status}})) {
+                                        $resulttext .= join(', ', map { $fieldnames{$_}; } (sort(keys(%{$privacyhash{$key}{$status}}))));
+                                    } else {
+                                        $resulttext .= &mt('none');
+                                    }
+                                }
+                                $resulttext .= '</li>';
+                            }
+                        }
+                    } else {
+                        foreach my $item (@items) {
+                            if (ref($privacyhash{$key}{$item}) eq 'HASH') {
+                                $resulttext .= '<li>'.$names{$item}.': ';
+                                if (keys(%{$privacyhash{$key}{$item}})) {
+                                    $resulttext .= join(', ', map { $fieldnames{$_}; } (sort(keys(%{$privacyhash{$key}{$item}}))));
+                                } else {
+                                    $resulttext .= &mt('none');
+                                }
+                                $resulttext .= '</li>';
+                            }
+                        }
+                    }
+                    $resulttext .= '</ul></li>';
+                }
+            }
+        } else {
+            $resulttext = &mt('No changes made to user information settings');
+        }
+    } else {
+        $resulttext = '<span class="LC_error">'.
+            &mt('An error occurred: [_1]',$putresult).'</span>';
+    }
+    return $resulttext;
+}
+
 sub modify_passwords {
     my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
     my ($resulttext,%current,%changes,%newvalues,@oktypes,$errors,
@@ -13984,6 +14406,7 @@ sub modify_passwords {
         max            => 'Maximum password length',
         chars          => 'Required characters',
         expire         => 'Password expiration (days)',
+        numsaved       => 'Number of previous passwords to save',
         reset          => 'Resetting Forgotten Password',
         intauth        => 'Encryption of Stored Passwords (Internal Auth)',
         rules          => 'Rules for LON-CAPA Passwords',
@@ -14191,9 +14614,17 @@ sub modify_passwords {
             $updatedefaults = 1;
         }
     }
-    foreach my $rule ('min','max','expire') {
+    foreach my $rule ('min','max','expire','numsaved') {
         $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
-        if ($env{'form.passwords_'.$rule} =~ /^(|\d+(|\.\d*))$/) {
+        my $ruleok;
+        if ($rule eq 'expire') {
+            if ($env{'form.passwords_'.$rule} =~ /^\d+(|\.\d*)$/) {
+                $ruleok = 1;
+            }
+        } elsif ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
             $newvalues{$rule} = $env{'form.passwords_'.$rule};
             if (exists($current{$rule})) {
                 if ($newvalues{$rule} ne $current{$rule}) {
@@ -14228,13 +14659,36 @@ sub modify_passwords {
             }
         }
     }
-    if ($env{'form.passwords_crsowner'}) {
-        $newvalues{'crsownerchg'} = 1;
-        unless ($current{'crsownerchg'}) {
-            $changes{'crsownerchg'} = 1;
+    my %crsownerchg = (
+                        by => [],
+                        for => [],
+                      );
+    foreach my $item ('by','for') {
+        my @posstypes = &Apache::loncommon::get_env_multiple('form.passwords_crsowner_'.$item);
+        foreach my $type (sort(@posstypes)) {
+            if (grep(/^\Q$type\E$/,@oktypes)) {
+                push(@{$crsownerchg{$item}},$type);
+            }
+        }
+    }
+    $newvalues{'crsownerchg'} = \%crsownerchg;
+    if (ref($current{'crsownerchg'}) eq 'HASH') {
+        foreach my $item ('by','for') {
+            if (ref($current{'crsownerchg'}{$item}) eq 'ARRAY') {
+                my @diffs = &Apache::loncommon::compare_arrays($current{'crsownerchg'}{$item},$crsownerchg{$item});
+                if (@diffs > 0) {
+                    $changes{'crsownerchg'} = 1;
+                    last;
+                }
+            }
+        }
+    } elsif (!exists($domconfig{passwords})) {
+        foreach my $item ('by','for') {
+            if (@{$crsownerchg{$item}} > 0) {
+                $changes{'crsownerchg'} = 1;
+                last;
+            }
         }
-    } elsif ($current{'crsownerchg'}) {
-        $changes{'crsownerchg'} = 1;
     }
 
     my %confighash = (
@@ -14373,22 +14827,42 @@ sub modify_passwords {
                             $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$titles{$key.'_'.$item},$value).'</li>';
                         }
                     } elsif ($key eq 'rules') {
-                        foreach my $rule ('min','max','expire') {
+                        foreach my $rule ('min','max','expire','numsaved') {
                             if ($confighash{'passwords'}{$rule} eq '') {
-                                $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
                                 if ($rule eq 'min') {
-                                   $resulttext .= ' '.&mt('Default of 7 will be used');
+                                    $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                                   ' '.&mt('Default of 7 will be used').'</li>';
+                                } else {
+                                    $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
                                 }
-                                $resulttext .= '</li>';
                             } else {
                                 $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$confighash{'passwords'}{$rule}).'</li>';
                             }
                         }
                     } elsif ($key eq 'crsownerchg') {
-                        if ($confighash{'passwords'}{'crsownerchg'}) {
-                            $resulttext .= '<li>'.&mt('Course owner may change student passwords.').'</li>';
+                        if (ref($confighash{'passwords'}{'crsownerchg'}) eq 'HASH') {
+                            if ((@{$confighash{'passwords'}{'crsownerchg'}{'by'}} == 0) ||
+                                (@{$confighash{'passwords'}{'crsownerchg'}{'for'}} == 0)) {
+                                $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
+                            } else {
+                                my %crsownerstr;
+                                foreach my $item ('by','for') {
+                                    if (ref($confighash{'passwords'}{'crsownerchg'}{$item}) eq 'ARRAY') {
+                                        foreach my $type (@{$confighash{'passwords'}{'crsownerchg'}{$item}}) {
+                                            if ($type eq 'default') {
+                                                $crsownerstr{$item} .= $othertitle.', ';
+                                            } elsif ($usertypes->{$type} ne '') {
+                                                $crsownerstr{$item} .= $usertypes->{$type}.', ';
+                                            }
+                                        }
+                                        $crsownerstr{$item} =~ s/\Q, \E$//;
+                                    }
+                                }
+                                $resulttext .= '<li>'.&mt('Course owner (with status: [_1]) may change passwords for students (with status: [_2]).',
+                                           $crsownerstr{'by'},$crsownerstr{'for'}).'</li>';
+                            }
                         } else {
-                            $resulttext .= '<li>'.&mt('Course owner may not change student passwords.');
+                            $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
                         }
                     }
                     $resulttext .= '</ul></li>';