--- rat/lonpageflip.pm	2006/05/30 19:47:40	1.69
+++ rat/lonpageflip.pm	2008/12/21 05:00:52	1.75.2.1
@@ -2,7 +2,7 @@
 #
 # Page flip handler
 #
-# $Id: lonpageflip.pm,v 1.69 2006/05/30 19:47:40 www Exp $
+# $Id: lonpageflip.pm,v 1.75.2.1 2008/12/21 05:00:52 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -33,6 +33,7 @@ use strict;
 use LONCAPA;
 use Apache::Constants qw(:common :http REDIRECT);
 use Apache::lonnet;
+use Apache::loncommon();
 use HTML::TokeParser;
 use GDBM_File;
 
@@ -86,6 +87,39 @@ sub hash_src {
 }
 
 sub move {
+    my ($next,$endupmap,$direction) = @_;
+    my $safecount=0;
+    my $allowed=0;
+    do {
+	($next,$endupmap)=&get_next_possible_move($next,$endupmap,$direction);
+
+	my $url = $hash{'src_'.$next};
+	my ($mapid,$resid)=split(/\./,$next);
+	my $symb = &Apache::lonnet::encode_symb($hash{'map_id_'.$mapid},
+						$resid,$url);
+	if ($url eq '' || $symb eq '') {
+	    $allowed = 0;
+	} else {
+	    my $priv = &Apache::lonnet::allowed('bre',$url,$symb);
+	    $allowed = (($priv eq 'F') || ($priv eq '2'));
+	}
+	$safecount++;
+    } while (   ($next)
+	     && ($next!~/\,/)
+	     && (
+		    (!$hash{'src_'.$next})
+		 || (
+		        (!$env{'request.role.adv'})
+		     &&  $hash{'randomout_'.$next}
+		    )
+		 || (!$allowed)
+		)
+	     && ($safecount<10000));
+
+    return ($next,$endupmap);
+}
+
+sub get_next_possible_move {
     my ($rid,$mapurl,$direction)=@_;
     my $startoutrid=$rid;
 
@@ -206,11 +240,17 @@ sub first_accessible_resource {
     if (tie(%hash,'GDBM_File',$env{'request.course.fn'}.'.db',
 	    &GDBM_READER(),0640)) {
 	$furl=$hash{'first_url'};
-        if (!&Apache::lonnet::allowed('bre',$furl)) {
+	my %args;
+	my ($url,$args) = split(/\?/,$furl);
+	foreach my $pair (split(/\&/,$args)) {
+	    my ($name,$value) = split(/=/,$pair);
+	    $args{&unescape($name)} = &unescape($value);
+	}
+        if (!&Apache::lonnet::allowed('bre',$url,$args{'symb'})) {
 # Wow, we cannot see this ... move forward to the next one that we can see
 	    my ($newrid,$newmap)=&move($hash{'first_rid'},$hash{'first_mapurl'},'forward');
 # Build the new URL
-	    my ($newresid,$newmapid)=split(/\./,$newrid);
+	    my ($newmapid,$newresid)=split(/\./,$newrid);
 	    my $symb=&Apache::lonnet::encode_symb($newmap,$newresid,$hash{'src_'.$newrid});
 	    $furl=&add_get_param($hash{'src_'.$newrid},{ 'symb' => $symb });
 	    if ($hash{'encrypted_'.$newrid}) {
@@ -256,7 +296,7 @@ sub handler {
 	  my $furl=&first_accessible_resource();
 	  &Apache::loncommon::content_type($r,'text/html');
 	  $r->header_out(Location => 
-			 'http://'.$ENV{'HTTP_HOST'}.$furl);
+			 &Apache::lonnet::absolute_url().$furl);
 	     
 	  return REDIRECT;
       }
@@ -290,12 +330,12 @@ sub handler {
 	 } else {
 	     &Apache::loncommon::content_type($r,'text/html');
 	     $r->header_out(Location => 
-			    'http://'.$ENV{'HTTP_HOST'}.$newloc);
+			    &Apache::lonnet::absolute_url().$newloc);
 	     
 	     return REDIRECT;
 	 }
       }
-      $currenturl=~s/^http\:\/\///;
+      $currenturl=~s/^https?\:\/\///;
       $currenturl=~s/^[^\/]+//;
 #
 # Is the current URL on the map? If not, start with last known URL
@@ -313,7 +353,8 @@ sub handler {
 	     if ($direction eq 'return') {
 		 &Apache::loncommon::content_type($r,'text/html');
 		 $r->header_out(Location => 
-				'http://'.$ENV{'HTTP_HOST'}.'/adm/noidea.html');
+				&Apache::lonnet::absolute_url().
+				'/adm/noidea.html');
 		 return REDIRECT;
 	     } else {
 		 &navlaunch($r);
@@ -340,14 +381,6 @@ sub handler {
               my $endupmap;
               ($next,$endupmap)=&move($rid,$startoutmap,$direction);
 # -------------------------------------- Do we have one and only one empty URL?
-              my $safecount=0;
-              while (($next) && ($next!~/\,/) && 
-                     ((!$hash{'src_'.$next}) || 
-		      ((!$env{'request.role.adv'}) && $hash{'randomout_'.$next}))
-                     && ($safecount<10000)) {
-                  ($next,$endupmap)=&move($next,$endupmap,$direction);
-                  $safecount++;
-              }
 # We are now at at least one non-empty URL
 # ----------------------------------------------------- Check out possibilities
               if ($next) {
@@ -411,11 +444,11 @@ sub handler {
 			   $redirectsymb='';
                         }
                      }
-                     &Apache::lonnet::appenv('user.criticalcheck.time'=>time);
+                     &Apache::lonnet::appenv({'user.criticalcheck.time'=>time});
 		  }
 
 		  &Apache::loncommon::content_type($r,'text/html');
-		  my $url='http://'.$ENV{'HTTP_HOST'}.$redirecturl;
+		  my $url=&Apache::lonnet::absolute_url().$redirecturl;
 		  $url = &add_get_param($url, { 'symb' => $redirectsymb});
                   $r->header_out(Location => $url);
                   return REDIRECT;