--- loncom/auth/lonacc.pm 2002/06/15 19:45:26 1.33
+++ loncom/auth/lonacc.pm 2005/02/08 01:20:11 1.62
@@ -1,7 +1,7 @@
# The LearningOnline Network
# Cookie Based Access Handler
#
-# $Id: lonacc.pm,v 1.33 2002/06/15 19:45:26 www Exp $
+# $Id: lonacc.pm,v 1.62 2005/02/08 01:20:11 albertel Exp $
#
# Copyright Michigan State University Board of Trustees
#
@@ -32,7 +32,6 @@
# 12/25,12/26,
# YEAR=2001
# 01/06/01,05/28,8/11,9/26,11/29 Gerd Kortemeyer
-# 12/15 Scott Harrison
# YEAR=2002
# 1/4,2/25 Gerd Kortemeyer
#
@@ -45,6 +44,7 @@ use Apache::Constants qw(:common :http :
use Apache::File;
use Apache::lonnet;
use Apache::loncommon();
+use Apache::lonlocal;
use CGI::Cookie();
use Fcntl qw(:flock);
@@ -60,102 +60,30 @@ sub handler {
my $lonidsdir=$r->dir_config('lonIDsDir');
if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {
-# ------------------------------------------- Transfer profile into environment
+# ------------------------------------------------------ Initialize Environment
- my @profile;
- {
- my $idf=Apache::File->new("$lonidsdir/$handle.id");
- flock($idf,LOCK_SH);
- @profile=<$idf>;
- $idf->close();
- }
- my $envi;
- for ($envi=0;$envi<=$#profile;$envi++) {
- chomp($profile[$envi]);
- my ($envname,$envvalue)=split(/=/,$profile[$envi]);
- $ENV{$envname} = $envvalue;
- }
- $ENV{'user.environment'} = "$lonidsdir/$handle.id";
- if ($requrl=~/^\/res\//) {
+ &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
+
+# --------------------------------------------------------- Initialize Language
+
+ &Apache::lonlocal::get_language_handle($r);
+
+# -------------------------------------------------------------- Resource State
+
+ if ($requrl=~/^\/+(res|uploaded)\//) {
$ENV{'request.state'} = "published";
} else {
$ENV{'request.state'} = 'unknown';
}
$ENV{'request.filename'} = $r->filename;
-
+ $ENV{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
# -------------------------------------------------------- Load POST parameters
-
-
- my $buffer;
-
- $r->read($buffer,$r->header_in('Content-length'));
-
- unless ($buffer=~/^(\-+\w+)\s+Content\-Disposition\:\s*form\-data/si) {
- my @pairs=split(/&/,$buffer);
- my $pair;
- foreach $pair (@pairs) {
- my ($name,$value) = split(/=/,$pair);
- $value =~ tr/+/ /;
- $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
- $name =~ tr/+/ /;
- $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
- &Apache::loncommon::add_to_env("form.$name",$value);
- }
- } else {
- my $contentsep=$1;
- my @lines = split (/\n/,$buffer);
- my $name='';
- my $value='';
- my $fname='';
- my $fmime='';
- my $i;
- for ($i=0;$i<=$#lines;$i++) {
- if ($lines[$i]=~/^$contentsep/) {
- if ($name) {
- chomp($value);
- if ($fname) {
- $ENV{"form.$name.filename"}=$fname;
- $ENV{"form.$name.mimetype"}=$fmime;
- } else {
- $value=~s/\s+$//s;
- }
- &Apache::loncommon::add_to_env("form.$name",$value);
- }
- if ($i<$#lines) {
- $i++;
- $lines[$i]=~
- /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;
- $name=$1;
- $value='';
- if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {
- $fname=$1;
- if
- ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {
- $fmime=$1;
- $i++;
- } else {
- $fmime='';
- }
- } else {
- $fname='';
- $fmime='';
- }
- $i++;
- }
- } else {
- $value.=$lines[$i]."\n";
- }
- }
- }
- $ENV{'request.method'}=$ENV{'REQUEST_METHOD'};
- $r->method_number(M_GET);
- $r->method('GET');
- $r->headers_in->unset('Content-length');
+ &Apache::loncommon::get_posted_cgi($r);
# ---------------------------------------------------------------- Check access
- if ($requrl!~/^\/adm\//) {
+ if ($requrl!~/^\/adm|public|prtspool\//) {
my $access=&Apache::lonnet::allowed('bre',$requrl);
if ($access eq '1') {
$ENV{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
@@ -166,11 +94,23 @@ sub handler {
return HTTP_NOT_ACCEPTABLE;
}
}
+ if ($requrl =~ m|^/prtspool/|) {
+ my $start='/prtspool/'.$ENV{'user.name'}.'_'.
+ $ENV{'user.domain'};
+ if ($requrl !~ /^\Q$start\E/) {
+ $ENV{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
+ return HTTP_NOT_ACCEPTABLE;
+ }
+ }
# ------------------------------------------------------------- This is allowed
if ($ENV{'request.course.id'}) {
&Apache::lonnet::countacc($requrl);
$requrl=~/\.(\w+)$/;
- if (&Apache::loncommon::fileembstyle($1) eq 'ssi') {
+ if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
+ ($requrl=~/^\/adm\/.*\/(aboutme|navmaps|smppg|bulletinboard)(\?|$)/) ||
+ ($requrl=~/^\/adm\/wrapper\//) ||
+ ($requrl=~m|\.problem/smpedit$|) ||
+ ($requrl=~/^\/public\/.*\/syllabus$/)) {
# ------------------------------------- This is serious stuff, get symb and log
my $query=$r->args;
my $symb;
@@ -179,8 +119,14 @@ sub handler {
}
if ($ENV{'form.symb'}) {
$symb=&Apache::lonnet::symbclean($ENV{'form.symb'});
- if (&Apache::lonnet::symbverify($symb,$requrl)) {
- my ($map,$mid,$murl)=split(/\_\_\_/,$symb);
+ if ($requrl =~ m|^/adm/wrapper/|) {
+ my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
+ &Apache::lonnet::symblist($map,$murl => $mid,
+ 'last_known' => $murl);
+ } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) ||
+ (($requrl=~m|(.*)/smpedit$|) &&
+ &Apache::lonnet::symbverify($symb,$1))) {
+ my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
&Apache::lonnet::symblist($map,$murl => $mid,
'last_known' => $murl);
} else {
@@ -191,7 +137,19 @@ sub handler {
return HTTP_NOT_ACCEPTABLE;
}
} else {
- $symb=&Apache::lonnet::symbread;
+ $symb=&Apache::lonnet::symbread($requrl);
+ if (&Apache::lonnet::is_on_map($requrl) && $symb &&
+ !&Apache::lonnet::symbverify($symb,$requrl)) {
+ $r->log_reason('Invalid symb for '.$requrl.': '.$symb);
+ $ENV{'user.error.msg'}=
+ "$requrl:bre:1:1:Invalid Access";
+ return HTTP_NOT_ACCEPTABLE;
+ }
+ if ($symb) {
+ my ($map,$mid,$murl)=split(/\_\_\_/,$symb);
+ &Apache::lonnet::symblist($map,$murl => $mid,
+ 'last_known' => $murl);
+ }
}
$ENV{'request.symb'}=$symb;
&Apache::lonnet::courseacclog($symb);
@@ -207,19 +165,39 @@ sub handler {
}
# -------------------------------------------- See if this is a public resource
- if (&Apache::lonnet::metadata($requrl,'copyright') eq 'public') {
+ if ($requrl=~m|^/public/|
+ || (&Apache::lonnet::metadata($requrl,'copyright') eq 'public')) {
&Apache::lonnet::logthis('Granting public access: '.$requrl);
+ &Apache::loncommon::get_posted_cgi($r);
$ENV{'user.name'}='public';
$ENV{'user.domain'}='public';
$ENV{'request.state'} = "published";
$ENV{'request.publicaccess'} = 1;
$ENV{'request.filename'} = $r->filename;
+ my ($httpbrowser, $clientbrowser, $clientversion,
+ $clientmathml, $clientunicode, $clientos) =
+ &Apache::loncommon::decode_user_agent($r);
+ $ENV{'browser.type'}=$clientbrowser;
+ $ENV{'browser.version'}=$clientversion;
+ $ENV{'browser.mathml'}=$clientmathml;
+ $ENV{'browser.unicode'}=$clientunicode;
+ $ENV{'browser.os'}=$clientos;
+
return OK;
}
-# ----------------------------------------------- Store where they wanted to go
-
- $ENV{'request.firsturl'}=$requrl;
- return FORBIDDEN;
+# -------------------------------------------------------------- Not authorized
+ $requrl=~/\.(\w+)$/;
+# if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
+# ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) ||
+# ($requrl=~m|^/prtspool/|)) {
+# -------------------------- Store where they wanted to go and get login screen
+ $ENV{'request.querystring'}=$r->args;
+ $ENV{'request.firsturl'}=$requrl;
+ return FORBIDDEN;
+# } else {
+# --------------------------------------------------------------------- Goodbye
+# return HTTP_BAD_REQUEST;
+# }
}
1;
500 Internal Server Error
Internal Server Error
The server encountered an internal error or
misconfiguration and was unable to complete
your request.
Please contact the server administrator at
root@localhost to inform them of the time this error occurred,
and the actions you performed just before this error.
More information about this error may be available
in the server error log.