--- loncom/auth/lonacc.pm 2006/06/22 13:20:46 1.81 +++ loncom/auth/lonacc.pm 2006/07/21 18:52:32 1.89 @@ -1,7 +1,7 @@ # The LearningOnline Network # Cookie Based Access Handler # -# $Id: lonacc.pm,v 1.81 2006/06/22 13:20:46 raeburn Exp $ +# $Id: lonacc.pm,v 1.89 2006/07/21 18:52:32 albertel Exp $ # # Copyright Michigan State University Board of Trustees # @@ -35,8 +35,10 @@ use Apache::File; use Apache::lonnet; use Apache::loncommon(); use Apache::lonlocal; +use Apache::restrictedaccess(); use CGI::Cookie(); use Fcntl qw(:flock); +use LONCAPA; sub cleanup { my ($r)=@_; @@ -135,174 +137,23 @@ sub get_posted_cgi { $r->headers_in->unset('Content-length'); } -sub portfolio_access { - my ($udom,$unum,$file_name,$group) = @_; - my $current_perms = &Apache::lonnet::get_portfile_permissions($udom,$unum); - my %access_controls = &Apache::lonnet::get_access_controls( - $current_perms,$group,$file_name); - my ($public,$guest,@domains,@users,@courses,@groups); - my $now = time; - my $access_hash = $access_controls{$file_name}; - if (ref($access_hash) eq 'HASH') { - foreach my $key (keys(%{$access_hash})) { - my ($num,$scope,$end,$start) = ($key =~ /^([^:]+):([a-z]+)_(\d*)_?(\d*)$/); - if ($start > $now) { - next; - } - if ($end && $end<$now) { - next; - } - if ($scope eq 'public') { - $public = $key; - last; - } elsif ($scope eq 'guest') { - $guest = $key; - } elsif ($scope eq 'domains') { - push(@domains,$key); - } elsif ($scope eq 'users') { - push(@users,$key); - } elsif ($scope eq 'course') { - push(@courses,$key); - } elsif ($scope eq 'group') { - push(@groups,$key); - } - } - if ($public) { - return 'ok'; - } - if ($env{'user.name'} eq 'public' && $env{'user.domain'} eq 'public') { - if ($guest) { - return 'guest:'.$guest; - } - } else { - if (@domains > 0) { - foreach my $domkey (@domains) { - my %content = &Apache::lonnet::parse_access_controls($$access_hash{$domkey}); - if (ref($content{'dom'}) eq 'ARRAY') { - if (grep(/^\Q$env{'user.domain'}\E$/,@{$content{'dom'}})) { - return 'ok'; - } - } - } - } - if (@users > 0) { - foreach my $userkey (@users) { - my %content = &Apache::lonnet::parse_access_controls($$access_hash{$userkey}); - if (exists($content{'users'}{$env{'user.name'}.':'.$env{'user.domain'}})) { - return 'ok'; - } - } - } - my %roleshash; - my @courses_and_groups = @courses; - push(@courses_and_groups,@groups); - if (@courses_and_groups > 0) { - my (%allgroups,%allroles); - my ($start,$end,$role,$sec,$group); - foreach my $envkey (%env) { - if ($envkey =~ m-^user\.role\.(gr|cc|in|ta|ep|st)\./([^/]+)/([^/]+)/?([^/]*)$-) { - my $cid = $2.'_'.$3; - if ($1 eq 'gr') { - $group = $4; - $allgroups{$cid}{$group} = $env{$envkey}; - } else { - if ($4 eq '') { - $sec = 'none'; - } else { - $sec = $4; - } - $allroles{$cid}{$1}{$sec} = $env{$envkey}; - } - } elsif ($envkey =~ m-^user\.role\./cr/(\w+/\w+/\w*)./([^/]+)/([^/]+)/?([^/]*)$-) { - my $cid = $2.'_'.$3; - if ($4 eq '') { - $sec = 'none'; - } else { - $sec = $4; - } - $allroles{$cid}{$1}{$sec} = $env{$envkey}; - } - } - if (keys(%allroles) == 0) { - return; - } - foreach my $key (@courses_and_groups) { - my %content = &Apache::lonnet::parse_access_controls($$access_hash{$key}); - my $cnum = $content{'number'}; - my $cdom = $content{'domain'}; - my $cid = $cdom.'_'.$cnum; - if (!exists($allroles{$cid})) { - next; - } - foreach my $role_id (keys(%{$content{'roles'}})) { - my @sections = @{$content{'roles'}{$role_id}{'section'}}; - my @groups = @{$content{'roles'}{$role_id}{'group'}}; - my @status = @{$content{'roles'}{$role_id}{'access'}}; - my @roles = @{$content{'roles'}{$role_id}{'role'}}; - foreach my $role (keys(%{$allroles{$cid}})) { - if ((grep/^all$/,@roles) || (grep/^\Q$role\E$/,@roles)) { - foreach my $sec (keys(%{$allroles{$cid}{$role}})) { - if (&course_group_datechecker($allroles{$cid}{$role}{$sec},$now,\@status) eq 'ok') { - if (grep/^all$/,@sections) { - return 'ok'; - } else { - if (grep/^$sec$/,@sections) { - return 'ok' - } - } - } - } - if (keys(%{$allgroups{$cid}}) == 0) { - if (grep/^none$/,@groups) { - return 'ok'; - } - } else { - if (grep/^all$/,@groups) { - return 'ok'; - } - foreach my $group (keys(%{$allgroups{$cid}})) { - if (grep/^$group$/,@groups) { - return 'ok'; - } - } - } - } - } - } - } - } - if ($guest) { - return 'guest:'.$guest; +sub passphrase_access_checker { + my ($r,$guestkey,$requrl) = @_; + my ($num,$scope,$end,$start) = ($guestkey =~ /^([^:]+):([a-z]+)_(\d*)_?(\d*)$/); + if ($scope eq 'guest') { + if (exists($env{'user.passphrase_access_'.$requrl})) { + if (($env{'user.passphrase_access_'.$requrl} == 0) || + ($env{'user.passphrase_access_'.$requrl} > time)) { + $env{'request.publicaccess'} = 1; + return 'ok'; } } } + $r->set_handlers('PerlHandler'=> \&Apache::restrictedaccess::handler); + $r->content_type('perl-script'); return; } -sub course_group_datechecker { - my ($dates,$now,$status) = @_; - my ($start,$end) = split(/\./,$dates); - if (!$start && !$end) { - return 'ok'; - } - if (grep/^active$/,@{$status}) { - if (((!$start) || ($start && $start <= $now)) && ((!$end) || ($end && $end >= $now))) { - return 'ok'; - } - } - if (grep/^previous$/,@{$status}) { - if ($end > $now ) { - return 'ok'; - } - } - if (grep/^future$/,@{$status}) { - if ($start > $now) { - return 'ok'; - } - } - return; -} - sub handler { my $r = shift; my $requrl=$r->uri; @@ -365,23 +216,10 @@ sub handler { # ---------------------------------------------------------------- Check access my $now = time; - if ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/portfolio(/.+)$|) { - my $result = &portfolio_access($1,$2,$3); - if ($result eq 'ok') { - return OK; - } elsif ($result =~ /^guest:(\w+)$/) { - my $guestkey = $1; - #FIXME need to cause generation of an intermediate page - } - } elsif ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/groups/([^/]+)/portfolio/(.+)$|) { - my $result = &portfolio_access($1,$2,$3.'/'.$4,$3); - if ($result eq 'ok') { - return OK; - } elsif ($result =~ /^guest:(\w+)$/) { - my $guestkey = $1; - #FIXME need to cause generation of an intermediate page -} - } + if (&Apache::lonnet::is_portfolio_url($requrl)) { + my $result = &Apache::lonnet::portfolio_access($r,$requrl); + if ($result eq 'ok') { return OK; } + } if ($requrl!~/^\/adm|public|prtspool\//) { my $access=&Apache::lonnet::allowed('bre',$requrl); if ($access eq '1') { @@ -404,7 +242,7 @@ sub handler { if ($env{'user.name'} eq 'public' && $env{'user.domain'} eq 'public' && $requrl !~ m{^/+(res|public)/} && - $requrl !~ m{^/+adm/(help|logout|randomlabel\.png)}) { + $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) { $env{'request.querystring'}=$r->args; $env{'request.firsturl'}=$requrl; return FORBIDDEN; @@ -472,7 +310,7 @@ sub handler { } else { $r->log_reason("Cookie $handle not valid", $r->filename); } - } + } # -------------------------------------------- See if this is a public resource if ($requrl=~m|^/public/| @@ -492,26 +330,14 @@ sub handler { return OK; } if ($requrl=~m|^/+adm/+help/+|) { - return OK; + return OK; } # ------------------------------------- See if this is a viewable portfolio file - if ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/portfolio(/.+)$|) { - my $result = &portfolio_access($1,$2,$3); - if ($result eq 'ok') { - return OK; - } elsif ($result =~ /^guest:(\w+)$/) { - my $guestkey = $1; - #FIXME need to cause generation of an intermediate page - } - } elsif ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/groups/([^/]+)/portfolio/(.+)$|) { - my $result = &portfolio_access($1,$2,$4.'/'.$3,$3); - if ($result eq 'ok') { - return OK; - } elsif ($result =~ /^guest:(\w+)$/) { - my $guestkey = $1; - #FIXME need to cause generation of an intermediate page - } + if (&Apache::lonnet::is_portfolio_url($requrl)) { + my $result = &Apache::lonnet::portfolio_access($r,$requrl); + if ($result eq 'ok' ) { return OK; } } + # -------------------------------------------------------------- Not authorized $requrl=~/\.(\w+)$/; # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||