--- loncom/auth/lonacc.pm 2006/04/13 20:47:39 1.77 +++ loncom/auth/lonacc.pm 2006/07/10 03:58:45 1.85 @@ -1,7 +1,7 @@ # The LearningOnline Network # Cookie Based Access Handler # -# $Id: lonacc.pm,v 1.77 2006/04/13 20:47:39 albertel Exp $ +# $Id: lonacc.pm,v 1.85 2006/07/10 03:58:45 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -37,6 +37,7 @@ use Apache::loncommon(); use Apache::lonlocal; use CGI::Cookie(); use Fcntl qw(:flock); +use LONCAPA; sub cleanup { my ($r)=@_; @@ -135,6 +136,191 @@ sub get_posted_cgi { $r->headers_in->unset('Content-length'); } +sub portfolio_access { + my ($udom,$unum,$file_name,$group) = @_; + my $current_perms = &Apache::lonnet::get_portfile_permissions($udom,$unum); + my %access_controls = &Apache::lonnet::get_access_controls( + $current_perms,$group,$file_name); + my ($public,$guest,@domains,@users,@courses,@groups); + my $now = time; + my $access_hash = $access_controls{$file_name}; + if (ref($access_hash) eq 'HASH') { + foreach my $key (keys(%{$access_hash})) { + my ($num,$scope,$end,$start) = ($key =~ /^([^:]+):([a-z]+)_(\d*)_?(\d*)$/); + if ($start > $now) { + next; + } + if ($end && $end<$now) { + next; + } + if ($scope eq 'public') { + $public = $key; + last; + } elsif ($scope eq 'guest') { + $guest = $key; + } elsif ($scope eq 'domains') { + push(@domains,$key); + } elsif ($scope eq 'users') { + push(@users,$key); + } elsif ($scope eq 'course') { + push(@courses,$key); + } elsif ($scope eq 'group') { + push(@groups,$key); + } + } + if ($public) { + return 'ok'; + } + if ($env{'user.name'} eq 'public' && $env{'user.domain'} eq 'public') { + if ($guest) { + return $guest; + } + } else { + if (@domains > 0) { + foreach my $domkey (@domains) { + my %content = &Apache::lonnet::parse_access_controls($$access_hash{$domkey}); + if (ref($content{'dom'}) eq 'ARRAY') { + if (grep(/^\Q$env{'user.domain'}\E$/,@{$content{'dom'}})) { + return 'ok'; + } + } + } + } + if (@users > 0) { + foreach my $userkey (@users) { + my %content = &Apache::lonnet::parse_access_controls($$access_hash{$userkey}); + if (exists($content{'users'}{$env{'user.name'}.':'.$env{'user.domain'}})) { + return 'ok'; + } + } + } + my %roleshash; + my @courses_and_groups = @courses; + push(@courses_and_groups,@groups); + if (@courses_and_groups > 0) { + my (%allgroups,%allroles); + my ($start,$end,$role,$sec,$group); + foreach my $envkey (%env) { + if ($envkey =~ m-^user\.role\.(gr|cc|in|ta|ep|st)\./([^/]+)/([^/]+)/?([^/]*)$-) { + my $cid = $2.'_'.$3; + if ($1 eq 'gr') { + $group = $4; + $allgroups{$cid}{$group} = $env{$envkey}; + } else { + if ($4 eq '') { + $sec = 'none'; + } else { + $sec = $4; + } + $allroles{$cid}{$1}{$sec} = $env{$envkey}; + } + } elsif ($envkey =~ m-^user\.role\./cr/(\w+/\w+/\w*)./([^/]+)/([^/]+)/?([^/]*)$-) { + my $cid = $2.'_'.$3; + if ($4 eq '') { + $sec = 'none'; + } else { + $sec = $4; + } + $allroles{$cid}{$1}{$sec} = $env{$envkey}; + } + } + if (keys(%allroles) == 0) { + return; + } + foreach my $key (@courses_and_groups) { + my %content = &Apache::lonnet::parse_access_controls($$access_hash{$key}); + my $cnum = $content{'number'}; + my $cdom = $content{'domain'}; + my $cid = $cdom.'_'.$cnum; + if (!exists($allroles{$cid})) { + next; + } + foreach my $role_id (keys(%{$content{'roles'}})) { + my @sections = @{$content{'roles'}{$role_id}{'section'}}; + my @groups = @{$content{'roles'}{$role_id}{'group'}}; + my @status = @{$content{'roles'}{$role_id}{'access'}}; + my @roles = @{$content{'roles'}{$role_id}{'role'}}; + foreach my $role (keys(%{$allroles{$cid}})) { + if ((grep/^all$/,@roles) || (grep/^\Q$role\E$/,@roles)) { + foreach my $sec (keys(%{$allroles{$cid}{$role}})) { + if (&course_group_datechecker($allroles{$cid}{$role}{$sec},$now,\@status) eq 'ok') { + if (grep/^all$/,@sections) { + return 'ok'; + } else { + if (grep/^$sec$/,@sections) { + return 'ok'; + } + } + } + } + if (keys(%{$allgroups{$cid}}) == 0) { + if (grep/^none$/,@groups) { + return 'ok'; + } + } else { + if (grep/^all$/,@groups) { + return 'ok'; + } + foreach my $group (keys(%{$allgroups{$cid}})) { + if (grep/^$group$/,@groups) { + return 'ok'; + } + } + } + } + } + } + } + } + if ($guest) { + return $guest; + } + } + } + return; +} + +sub passphrase_access_checker { + my ($r,$guestkey,$requrl) = @_; + my ($num,$scope,$end,$start) = ($guestkey =~ /^([^:]+):([a-z]+)_(\d*)_?(\d*)$/); + if ($scope eq 'guest') { + if (exists($env{'user.passphrase_access_'.$requrl})) { + if (($env{'user.passphrase_access_'.$requrl} == 0) || + ($env{'user.passphrase_access_'.$requrl} > time)) { + $env{'request.publicaccess'} = 1; + return 'ok'; + } + } + } + my $login = $r->dir_config('Login'); + $login .= '?origurl='.&escape($requrl); + $r->custom_response(FORBIDDEN,$login); + return; +} + +sub course_group_datechecker { + my ($dates,$now,$status) = @_; + my ($start,$end) = split(/\./,$dates); + if (!$start && !$end) { + return 'ok'; + } + if (grep/^active$/,@{$status}) { + if (((!$start) || ($start && $start <= $now)) && ((!$end) || ($end && $end >= $now))) { + return 'ok'; + } + } + if (grep/^previous$/,@{$status}) { + if ($end > $now ) { + return 'ok'; + } + } + if (grep/^future$/,@{$status}) { + if ($start > $now) { + return 'ok'; + } + } + return; +} sub handler { my $r = shift; @@ -150,8 +336,10 @@ sub handler { $handle=~s/\W//g; } + my ($sso_login); if ($r->user && (!$lonid || !-e "$lonidsdir/$handle.id" || $handle eq '') ) { + $sso_login = 1; my $domain = $r->dir_config('lonDefDomain'); my $home=&Apache::lonnet::homeserver($r->user,$domain); if ($home !~ /(con_lost|no_such_host)/) { @@ -161,6 +349,10 @@ sub handler { } } + if ($sso_login) { + &Apache::lonnet::appenv('request.sso.login' => 1); + } + if ($r->dir_config("lonBalancer") eq 'yes') { $r->set_handlers('PerlResponseHandler'=> [\&Apache::switchserver::handler]); @@ -191,7 +383,30 @@ sub handler { &Apache::lonacc::get_posted_cgi($r); # ---------------------------------------------------------------- Check access - + my $now = time; + if ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/portfolio(/.+)$|) { + my $result = &portfolio_access($1,$2,$3); + if ($result eq 'ok') { + return OK; + } elsif ($result =~ /^[^:]+:guest_/) { + if (&passphrase_access_checker($r,$result,$requrl) eq 'ok') { + return OK; + } else { + return FORBIDDEN; + } + } + } elsif ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/groups/([^/]+)/portfolio/(.+)$|) { + my $result = &portfolio_access($1,$2,$3.'/'.$4,$3); + if ($result eq 'ok') { + return OK; + } elsif ($result =~ /^[^:]+:guest_/) { + if (&passphrase_access_checker($r,$result,$requrl) eq 'ok') { + return OK; + } else { + return FORBIDDEN; + } + } + } if ($requrl!~/^\/adm|public|prtspool\//) { my $access=&Apache::lonnet::allowed('bre',$requrl); if ($access eq '1') { @@ -304,6 +519,30 @@ sub handler { if ($requrl=~m|^/+adm/+help/+|) { return OK; } +# ------------------------------------- See if this is a viewable portfolio file + if ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/portfolio(/.+)$|) { + my $result = &portfolio_access($1,$2,$3); + if ($result eq 'ok') { + return OK; + } elsif ($result =~ /^[^:]+:guest_/) { + if (&passphrase_access_checker($r,$result,$requrl) eq 'ok') { + return OK; + } else { + return FORBIDDEN; + } + } + } elsif ($requrl =~ m|/+uploaded/([^/]+)/([^/]+)/groups/([^/]+)/portfolio/(.+)$|) { + my $result = &portfolio_access($1,$2,$3.'/'.$4,$3); + if ($result eq 'ok') { + return OK; + } elsif ($result =~ /^[^:]+:guest_/) { + if (&passphrase_access_checker($r,$result,$requrl) eq 'ok') { + return OK; + } else { + return FORBIDDEN; + } + } + } # -------------------------------------------------------------- Not authorized $requrl=~/\.(\w+)$/; # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||