--- loncom/auth/lonacc.pm	2006/08/29 20:04:41	1.93
+++ loncom/auth/lonacc.pm	2008/11/10 13:20:24	1.117
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Cookie Based Access Handler
 #
-# $Id: lonacc.pm,v 1.93 2006/08/29 20:04:41 albertel Exp $
+# $Id: lonacc.pm,v 1.117 2008/11/10 13:20:24 jms Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -36,7 +36,7 @@ use Apache::lonnet;
 use Apache::loncommon();
 use Apache::lonlocal;
 use Apache::restrictedaccess();
-use CGI::Cookie();
+use Apache::blockedaccess(); 
 use Fcntl qw(:flock);
 use LONCAPA;
 
@@ -44,6 +44,7 @@ sub cleanup {
     my ($r)=@_;
     if (! $r->is_initial_req()) { return DECLINED; }
     &Apache::lonnet::save_cache();
+    &Apache::lontexconvert::jsMath_reset();
     return OK;
 }
 
@@ -56,13 +57,14 @@ sub goodbye {
 ###############################################
 
 sub get_posted_cgi {
-    my ($r) = @_;
+    my ($r,$fields) = @_;
 
     my $buffer;
     if ($r->header_in('Content-length')) {
 	$r->read($buffer,$r->header_in('Content-length'),0);
     }
-    unless ($buffer=~/^(\-+\w+)\s+Content\-Disposition\:\s*form\-data/si) {
+    my $content_type = $r->header_in('Content-type');
+    if ($content_type !~ m{^multipart/form-data}) {
 	my @pairs=split(/&/,$buffer);
 	my $pair;
 	foreach $pair (@pairs) {
@@ -71,10 +73,13 @@ sub get_posted_cgi {
 	    $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
 	    $name  =~ tr/+/ /;
 	    $name  =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
+            if (ref($fields) eq 'ARRAY') {
+                next if (!grep(/^\Q$name\E$/,@{$fields}));
+            }
 	    &Apache::loncommon::add_to_env("form.$name",$value);
 	}
     } else {
-	my $contentsep=$1;
+	my ($contentsep) = ($content_type =~ /boundary=\"?([^\";,]+)\"?/);
 	my @lines = split (/\n/,$buffer);
 	my $name='';
 	my $value='';
@@ -82,7 +87,7 @@ sub get_posted_cgi {
 	my $fmime='';
 	my $i;
 	for ($i=0;$i<=$#lines;$i++) {
-	    if ($lines[$i]=~/^$contentsep/) {
+	    if ($lines[$i]=~/^--\Q$contentsep\E/) {
 		if ($name) {
 		    chomp($value);
 		    if ($fname) {
@@ -91,6 +96,9 @@ sub get_posted_cgi {
 		    } else {
 			$value=~s/\s+$//s;
 		    }
+                    if (ref($fields) eq 'ARRAY') {
+                        next if (!grep(/^\Q$name\E$/,@{$fields}));
+                    }
 		    &Apache::loncommon::add_to_env("form.$name",$value);
 		}
 		if ($i<$#lines) {
@@ -137,45 +145,107 @@ sub get_posted_cgi {
     $r->headers_in->unset('Content-length');
 }
 
-sub handler {
-    my $r = shift;
-    my $requrl=$r->uri;
-    my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
-    my $lonid=$cookies{'lonID'};
-    my $cookie;
-    my $lonidsdir=$r->dir_config('lonIDsDir');
+# handle the case of the single sign on user, at this point $r->user 
+# will be set and valid now need to find the loncapa user info and possibly
+# balance them
+# returns OK if it was a SSO and user was handled
+#         undef if not SSO or no means to hanle the user
 
-    my $handle;
-    if ($lonid) {
-	$handle=$lonid->value;
-        $handle=~s/\W//g;
+sub sso_login {
+    my ($r,$handle) = @_;
+
+    my $lonidsdir=$r->dir_config('lonIDsDir');
+    if (!($r->user 
+	  && (!defined($env{'user.name'}) && !defined($env{'user.domain'}))
+	  && ($handle eq ''))) {
+	# not an SSO case or already logged in
+	return undef;
     }
 
-    my ($sso_login);
-    if ($r->user 
-	#&& $r->user ne 'lonadm'
-	&& (!$lonid || !-e "$lonidsdir/$handle.id" || $handle eq '') ) {
-	&Apache::lonnet::logthis("$handle and -e ".(-e "$lonidsdir/$handle.id"));
-
-	my $domain = $r->dir_config('lonDefDomain');
-	my $home=&Apache::lonnet::homeserver($r->user,$domain);
-	if ($home !~ /(con_lost|no_host|no_such_host)/) {
+    my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/);
+
+    my $domain = $r->dir_config('lonDefDomain');
+    my $home=&Apache::lonnet::homeserver($user,$domain);
+    if ($home !~ /(con_lost|no_host|no_such_host)/) {
+	&Apache::lonnet::logthis(" SSO authorized user $user ");
+	if ($r->dir_config("lonBalancer") eq 'yes') {
+	    # login but immeaditly go to switch server to find us a new 
+	    # machine
+	    &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
+            $env{'request.sso.login'} = 1;
+            if (defined($r->dir_config("lonSSOReloginServer"))) {
+                $env{'request.sso.reloginserver'} =
+                    $r->dir_config('lonSSOReloginServer');
+            }
+	    $r->internal_redirect('/adm/switchserver');
+	    $r->set_handlers('PerlHandler'=> undef);
+	} else {
+	    # need to login them in, so generate the need data that
+	    # migrate expects to do login
 	    my %info=('ip'        => $r->connection->remote_ip(),
 		      'domain'    => $domain,
-		      'username'  => $r->user,
+		      'username'  => $user,
 		      'server'    => $r->dir_config('lonHostID'),
 		      'sso.login' => 1
 		      );
-	    my $token = &Apache::lonnet::tmpput(\%info,
-						$r->dir_config('lonHostID'));
+            if ($r->dir_config("ssodirecturl") == 1) {
+                $info{'origurl'} = $r->uri;
+            }
+            if (defined($r->dir_config("lonSSOReloginServer"))) {
+                $info{'sso.reloginserver'} = 
+                    $r->dir_config('lonSSOReloginServer'); 
+            }
+	    my $token = 
+		&Apache::lonnet::tmpput(\%info,
+					$r->dir_config('lonHostID'));
 	    $env{'form.token'} = $token;
 	    $r->internal_redirect('/adm/migrateuser');
-	    return OK;
-	} elsif (defined($r->dir_config('lonSSOUserUnkownRedirect'))) {
-	    $r->internal_redirect($r->dir_config('lonSSOUserUnkownRedirect'));
-	    return OK;
+	    $r->set_handlers('PerlHandler'=> undef);
 	}
+	return OK;
+    } elsif (defined($r->dir_config('lonSSOUserUnknownRedirect'))) {
+	&Apache::lonnet::logthis(" SSO authorized unknown user $user ");
+        $r->subprocess_env->set('SSOUserUnknown' => $user);
+        $r->subprocess_env->set('SSOUserDomain' => $domain);
+        my @cancreate;
+        my %domconfig =
+            &Apache::lonnet::get_dom('configuration',['usercreation'],$domain);
+        if (ref($domconfig{'usercreation'}) eq 'HASH') {
+            if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
+                if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
+                    @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
+                } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') && 
+                         ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
+                    @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
+                }
+            }
+        }
+        if (grep(/^sso$/,@cancreate)) {
+            $r->internal_redirect('/adm/createaccount');
+        } else {
+	    $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect'));
+        }
+	$r->set_handlers('PerlHandler'=> undef);
+	return OK;
     }
+    return undef;
+}
+
+sub handler {
+    my $r = shift;
+    my $requrl=$r->uri;
+    if (&Apache::lonnet::is_domainimage($requrl)) {
+        return OK;
+    }
+
+    
+    my $handle = &Apache::lonnet::check_for_valid_session($r);
+
+    my $result = &sso_login($r,$handle);
+    if (defined($result)) {
+	return $result;
+    }
+
 
     if ($r->dir_config("lonBalancer") eq 'yes') {
 	$r->set_handlers('PerlResponseHandler'=>
@@ -184,10 +254,10 @@ sub handler {
     
     if ($handle eq '') {
 	$r->log_reason("Cookie $handle not valid", $r->filename); 
-    } elsif ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {
+    } elsif ($handle ne '') {
 
 # ------------------------------------------------------ Initialize Environment
-
+	my $lonidsdir=$r->dir_config('lonIDsDir');
 	&Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
 
 # --------------------------------------------------------- Initialize Language
@@ -213,7 +283,8 @@ sub handler {
 
 # ---------------------------------------------------------------- Check access
 	my $now = time;
-	if ($requrl!~/^\/adm|public|prtspool\//) {
+	if ($requrl !~ m{^/(?:adm|public|prtspool)/}
+	    || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
 	    my $access=&Apache::lonnet::allowed('bre',$requrl);
 	    if ($access eq '1') {
 		$env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
@@ -223,6 +294,10 @@ sub handler {
 		&Apache::restrictedaccess::setup_handler($r);
 		return OK;
 	    }
+            if ($access eq 'B') {
+                &Apache::blockedaccess::setup_handler($r);
+                return OK;
+            }
 	    if (($access ne '2') && ($access ne 'F')) {
 		$env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
 		return HTTP_NOT_ACCEPTABLE; 
@@ -233,6 +308,14 @@ sub handler {
 		$env{'user.domain'};
 	    if ($requrl !~ /^\Q$start\E/) {
 		$env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
+		return HTTP_NOT_ACCEPTABLE;
+	    }
+	}
+	if ($requrl =~ m|^/zipspool/|) {
+	    my $start='/zipspool/zipout/'.$env{'user.name'}.":".
+		$env{'user.domain'};
+	    if ($requrl !~ /^\Q$start\E/) {
+		$env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
 		return HTTP_NOT_ACCEPTABLE;
 	    }
 	}