--- loncom/auth/lonacc.pm 2006/07/21 16:07:48 1.88 +++ loncom/auth/lonacc.pm 2006/07/21 18:52:32 1.89 @@ -1,7 +1,7 @@ # The LearningOnline Network # Cookie Based Access Handler # -# $Id: lonacc.pm,v 1.88 2006/07/21 16:07:48 albertel Exp $ +# $Id: lonacc.pm,v 1.89 2006/07/21 18:52:32 albertel Exp $ # # Copyright Michigan State University Board of Trustees # @@ -137,168 +137,6 @@ sub get_posted_cgi { $r->headers_in->unset('Content-length'); } -sub portfolio_access { - my ($r,$requrl) = @_; - my $access=&Apache::lonnet::allowed('bre',$requrl); - if ($access eq '2' || $access eq 'F') { - return OK; - } - my (undef,$udom,$unum,$file_name,$group) = &parse_portfolio_url($requrl); - my $result = &get_portfolio_access($udom,$unum,$file_name,$group); - &Apache::lonnet::logthis("got pa of $result"); - if ($result eq 'ok') { - return OK; - } elsif ($result =~ /^[^:]+:guest_/) { - &Apache::lonnet::logthis("doign pac $result"); - &passphrase_access_checker($r,$result,$requrl); - return OK; - } - return undef; -} - -sub get_portfolio_access { - my ($udom,$unum,$file_name,$group) = @_; - - my $current_perms = &Apache::lonnet::get_portfile_permissions($udom,$unum); - my %access_controls = &Apache::lonnet::get_access_controls( - $current_perms,$group,$file_name); - my ($public,$guest,@domains,@users,@courses,@groups); - my $now = time; - my $access_hash = $access_controls{$file_name}; - if (ref($access_hash) eq 'HASH') { - foreach my $key (keys(%{$access_hash})) { - my ($num,$scope,$end,$start) = ($key =~ /^([^:]+):([a-z]+)_(\d*)_?(\d*)$/); - if ($start > $now) { - next; - } - if ($end && $end<$now) { - next; - } - if ($scope eq 'public') { - $public = $key; - last; - } elsif ($scope eq 'guest') { - $guest = $key; - } elsif ($scope eq 'domains') { - push(@domains,$key); - } elsif ($scope eq 'users') { - push(@users,$key); - } elsif ($scope eq 'course') { - push(@courses,$key); - } elsif ($scope eq 'group') { - push(@groups,$key); - } - } - if ($public) { - return 'ok'; - } - if ($env{'user.name'} eq 'public' && $env{'user.domain'} eq 'public') { - if ($guest) { - return $guest; - } - } else { - if (@domains > 0) { - foreach my $domkey (@domains) { - if (ref($access_hash->{$domkey}{'dom'}) eq 'ARRAY') { - if (grep(/^\Q$env{'user.domain'}\E$/,@{$access_hash->{$domkey}{'dom'}})) { - return 'ok'; - } - } - } - } - if (@users > 0) { - foreach my $userkey (@users) { - if (exists($access_hash->{$userkey}{'users'}{$env{'user.name'}.':'.$env{'user.domain'}})) { - return 'ok'; - } - } - } - my %roleshash; - my @courses_and_groups = @courses; - push(@courses_and_groups,@groups); - if (@courses_and_groups > 0) { - my (%allgroups,%allroles); - my ($start,$end,$role,$sec,$group); - foreach my $envkey (%env) { - if ($envkey =~ m-^user\.role\.(gr|cc|in|ta|ep|st)\./([^/]+)/([^/]+)/?([^/]*)$-) { - my $cid = $2.'_'.$3; - if ($1 eq 'gr') { - $group = $4; - $allgroups{$cid}{$group} = $env{$envkey}; - } else { - if ($4 eq '') { - $sec = 'none'; - } else { - $sec = $4; - } - $allroles{$cid}{$1}{$sec} = $env{$envkey}; - } - } elsif ($envkey =~ m-^user\.role\./cr/(\w+/\w+/\w*)./([^/]+)/([^/]+)/?([^/]*)$-) { - my $cid = $2.'_'.$3; - if ($4 eq '') { - $sec = 'none'; - } else { - $sec = $4; - } - $allroles{$cid}{$1}{$sec} = $env{$envkey}; - } - } - if (keys(%allroles) == 0) { - return; - } - foreach my $key (@courses_and_groups) { - my %content = %{$$access_hash{$key}}; - my $cnum = $content{'number'}; - my $cdom = $content{'domain'}; - my $cid = $cdom.'_'.$cnum; - if (!exists($allroles{$cid})) { - next; - } - foreach my $role_id (keys(%{$content{'roles'}})) { - my @sections = @{$content{'roles'}{$role_id}{'section'}}; - my @groups = @{$content{'roles'}{$role_id}{'group'}}; - my @status = @{$content{'roles'}{$role_id}{'access'}}; - my @roles = @{$content{'roles'}{$role_id}{'role'}}; - foreach my $role (keys(%{$allroles{$cid}})) { - if ((grep/^all$/,@roles) || (grep/^\Q$role\E$/,@roles)) { - foreach my $sec (keys(%{$allroles{$cid}{$role}})) { - if (&course_group_datechecker($allroles{$cid}{$role}{$sec},$now,\@status) eq 'ok') { - if (grep/^all$/,@sections) { - return 'ok'; - } else { - if (grep/^$sec$/,@sections) { - return 'ok'; - } - } - } - } - if (keys(%{$allgroups{$cid}}) == 0) { - if (grep/^none$/,@groups) { - return 'ok'; - } - } else { - if (grep/^all$/,@groups) { - return 'ok'; - } - foreach my $group (keys(%{$allgroups{$cid}})) { - if (grep/^$group$/,@groups) { - return 'ok'; - } - } - } - } - } - } - } - } - if ($guest) { - return $guest; - } - } - } - return; -} - sub passphrase_access_checker { my ($r,$guestkey,$requrl) = @_; my ($num,$scope,$end,$start) = ($guestkey =~ /^([^:]+):([a-z]+)_(\d*)_?(\d*)$/); @@ -316,58 +154,6 @@ sub passphrase_access_checker { return; } -sub course_group_datechecker { - my ($dates,$now,$status) = @_; - my ($start,$end) = split(/\./,$dates); - if (!$start && !$end) { - return 'ok'; - } - if (grep/^active$/,@{$status}) { - if (((!$start) || ($start && $start <= $now)) && ((!$end) || ($end && $end >= $now))) { - return 'ok'; - } - } - if (grep/^previous$/,@{$status}) { - if ($end > $now ) { - return 'ok'; - } - } - if (grep/^future$/,@{$status}) { - if ($start > $now) { - return 'ok'; - } - } - return; -} - -sub parse_portfolio_url { - my ($url) = @_; - - my ($type,$udom,$unum,$group,$file_name); - - if ($url =~ m-/+uploaded/([^/]+)/([^/]+)/portfolio(/.+)$-) { - $type = 1; - $udom = $1; - $unum = $2; - $file_name = $3; - } elsif ($url =~ m-/+uploaded/([^/]+)/([^/]+)/groups/([^/]+)/portfolio/(.+)$-) { - $type = 2; - $udom = $1; - $unum = $2; - $group = $3; - $file_name = $3.'/'.$4; - } - if (wantarray) { - return ($type,$udom,$unum,$file_name,$group); - } - return $type; -} - -sub is_portfolio_url { - my ($url) = @_; - return scalar(&parse_portfolio_url($url)); -} - sub handler { my $r = shift; my $requrl=$r->uri; @@ -430,9 +216,9 @@ sub handler { # ---------------------------------------------------------------- Check access my $now = time; - if (&is_portfolio_url($requrl)) { - my $result = &portfolio_access($r,$requrl); - if (defined($result)) { return $result; } + if (&Apache::lonnet::is_portfolio_url($requrl)) { + my $result = &Apache::lonnet::portfolio_access($r,$requrl); + if ($result eq 'ok') { return OK; } } if ($requrl!~/^\/adm|public|prtspool\//) { my $access=&Apache::lonnet::allowed('bre',$requrl); @@ -456,7 +242,7 @@ sub handler { if ($env{'user.name'} eq 'public' && $env{'user.domain'} eq 'public' && $requrl !~ m{^/+(res|public)/} && - $requrl !~ m{^/+adm/(help|logout|randomlabel\.png)}) { + $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) { $env{'request.querystring'}=$r->args; $env{'request.firsturl'}=$requrl; return FORBIDDEN; @@ -544,12 +330,12 @@ sub handler { return OK; } if ($requrl=~m|^/+adm/+help/+|) { - return OK; + return OK; } # ------------------------------------- See if this is a viewable portfolio file - if (&is_portfolio_url($requrl)) { - my $result = &portfolio_access($r,$requrl); - if (defined($result)) { return $result; } + if (&Apache::lonnet::is_portfolio_url($requrl)) { + my $result = &Apache::lonnet::portfolio_access($r,$requrl); + if ($result eq 'ok' ) { return OK; } } # -------------------------------------------------------------- Not authorized