Return to lonacc.pm CVS log

Up to [LON-CAPA] / loncom / auth

Add response code of 'B' to lonnet::allowed() to indicate access to a file is currently subject to a block, because the file owner is part of a course with active communications blocking, and file viewer does not have 'evb' privilege in the course to nullify the block.

Used to block access to portfolio files.  Response of 'B' triggers blockedaccess.pm which displays information about blocking conditions.

    1: # The LearningOnline Network
    2: # Cookie Based Access Handler
    3: #
    4: # $Id: lonacc.pm,v 1.103 2006/12/11 14:06:04 raeburn Exp $
    5: #
    6: # Copyright Michigan State University Board of Trustees
    7: #
    8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
    9: #
   10: # LON-CAPA is free software; you can redistribute it and/or modify
   11: # it under the terms of the GNU General Public License as published by
   12: # the Free Software Foundation; either version 2 of the License, or
   13: # (at your option) any later version.
   14: #
   15: # LON-CAPA is distributed in the hope that it will be useful,
   16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
   17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   18: # GNU General Public License for more details.
   19: #
   20: # You should have received a copy of the GNU General Public License
   21: # along with LON-CAPA; if not, write to the Free Software
   22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   23: #
   24: # /home/httpd/html/adm/gpl.txt
   25: #
   26: # http://www.lon-capa.org/
   27: #
   28: ###
   29: 
   30: package Apache::lonacc;
   31: 
   32: use strict;
   33: use Apache::Constants qw(:common :http :methods);
   34: use Apache::File;
   35: use Apache::lonnet;
   36: use Apache::loncommon();
   37: use Apache::lonlocal;
   38: use Apache::restrictedaccess();
   39: use Apache::blockedaccess(); 
   40: use CGI::Cookie();
   41: use Fcntl qw(:flock);
   42: use LONCAPA;
   43: 
   44: sub cleanup {
   45:     my ($r)=@_;
   46:     if (! $r->is_initial_req()) { return DECLINED; }
   47:     &Apache::lonnet::save_cache();
   48:     &Apache::lontexconvert::jsMath_reset();
   49:     return OK;
   50: }
   51: 
   52: sub goodbye {
   53:     my ($r)=@_;
   54:     &Apache::lonnet::goodbye();
   55:     return DONE;
   56: }
   57: 
   58: ###############################################
   59: 
   60: sub get_posted_cgi {
   61:     my ($r) = @_;
   62: 
   63:     my $buffer;
   64:     if ($r->header_in('Content-length')) {
   65: 	$r->read($buffer,$r->header_in('Content-length'),0);
   66:     }
   67:     unless ($buffer=~/^(\-+\w+)\s+Content\-Disposition\:\s*form\-data/si) {
   68: 	my @pairs=split(/&/,$buffer);
   69: 	my $pair;
   70: 	foreach $pair (@pairs) {
   71: 	    my ($name,$value) = split(/=/,$pair);
   72: 	    $value =~ tr/+/ /;
   73: 	    $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
   74: 	    $name  =~ tr/+/ /;
   75: 	    $name  =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
   76: 	    &Apache::loncommon::add_to_env("form.$name",$value);
   77: 	}
   78:     } else {
   79: 	my $contentsep=$1;
   80: 	my @lines = split (/\n/,$buffer);
   81: 	my $name='';
   82: 	my $value='';
   83: 	my $fname='';
   84: 	my $fmime='';
   85: 	my $i;
   86: 	for ($i=0;$i<=$#lines;$i++) {
   87: 	    if ($lines[$i]=~/^$contentsep/) {
   88: 		if ($name) {
   89: 		    chomp($value);
   90: 		    if ($fname) {
   91: 			$env{"form.$name.filename"}=$fname;
   92: 			$env{"form.$name.mimetype"}=$fmime;
   93: 		    } else {
   94: 			$value=~s/\s+$//s;
   95: 		    }
   96: 		    &Apache::loncommon::add_to_env("form.$name",$value);
   97: 		}
   98: 		if ($i<$#lines) {
   99: 		    $i++;
  100: 		    $lines[$i]=~
  101: 		/Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;
  102: 		    $name=$1;
  103: 		    $value='';
  104: 		    if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {
  105: 			$fname=$1;
  106: 			if 
  107:                             ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {
  108: 				$fmime=$1;
  109: 				$i++;
  110: 			    } else {
  111: 				$fmime='';
  112: 			    }
  113: 		    } else {
  114: 			$fname='';
  115: 			$fmime='';
  116: 		    }
  117: 		    $i++;
  118: 		}
  119: 	    } else {
  120: 		$value.=$lines[$i]."\n";
  121: 	    }
  122: 	}
  123:     }
  124: #
  125: # Digested POSTed values
  126: #
  127: # Remember the way this was originally done (GET or POST)
  128: #
  129:     $env{'request.method'}=$ENV{'REQUEST_METHOD'};
  130: #
  131: # There may also be stuff in the query string
  132: # Tell subsequent handlers that this was GET, not POST, so they can access query string.
  133: # Also, unset POSTed content length to cover all tracks.
  134: #
  135: 
  136:     $r->method_number(M_GET);
  137: 
  138:     $r->method('GET');
  139:     $r->headers_in->unset('Content-length');
  140: }
  141: 
  142: # handle the case of the single sign on user, at this point $r->user 
  143: # will be set and valid now need to find the loncapa user info and possibly
  144: # balance them
  145: # returns OK if it was a SSO and user was handled
  146: #         undef if not SSO or no means to hanle the user
  147: sub sso_login {
  148:     my ($r,$lonid,$handle) = @_;
  149: 
  150:     my $lonidsdir=$r->dir_config('lonIDsDir');
  151:     if (!($r->user 
  152: 	  && (!defined($env{'user.name'}) && !defined($env{'user.domain'}))
  153: 	  && (!$lonid || !-e "$lonidsdir/$handle.id" || $handle eq ''))) {
  154: 	# not an SSO case or already logged in
  155: 	return undef;
  156:     }
  157: 
  158:     my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/);
  159: 
  160:     my $domain = $r->dir_config('lonDefDomain');
  161:     my $home=&Apache::lonnet::homeserver($user,$domain);
  162:     if ($home !~ /(con_lost|no_host|no_such_host)/) {
  163: 	if ($r->dir_config("lonBalancer") eq 'yes') {
  164: 	    # login but immeaditly go to switch server to find us a new 
  165: 	    # machine
  166: 	    &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
  167: 	    $r->internal_redirect('/adm/switchserver');
  168: 	    $r->set_handlers('PerlHandler'=> undef);
  169: 	} else {
  170: 	    # need to login them in, so generate the need data that
  171: 	    # migrate expects to do login
  172: 	    my %info=('ip'        => $r->connection->remote_ip(),
  173: 		      'domain'    => $domain,
  174: 		      'username'  => $user,
  175: 		      'server'    => $r->dir_config('lonHostID'),
  176: 		      'sso.login' => 1
  177: 		      );
  178: 	    my $token = 
  179: 		&Apache::lonnet::tmpput(\%info,
  180: 					$r->dir_config('lonHostID'));
  181: 	    $env{'form.token'} = $token;
  182: 	    $r->internal_redirect('/adm/migrateuser');
  183: 	    $r->set_handlers('PerlHandler'=> undef);
  184: 	}
  185: 	return OK;
  186:     } elsif (defined($r->dir_config('lonSSOUserUnknownRedirect'))) {
  187: 	$r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect'));
  188: 	$r->set_handlers('PerlHandler'=> undef);
  189: 	return OK;
  190:     }
  191:     return undef;
  192: }
  193: 
  194: sub handler {
  195:     my $r = shift;
  196:     my $requrl=$r->uri;
  197:     my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
  198:     my $lonid=$cookies{'lonID'};
  199:     my $cookie;
  200:     my $lonidsdir=$r->dir_config('lonIDsDir');
  201: 
  202:     my $handle;
  203:     if ($lonid) {
  204: 	$handle=&LONCAPA::clean_handle($lonid->value);
  205:     }
  206: 
  207:     my $result = &sso_login($r,$lonid,$handle);
  208:     if (defined($result)) {
  209: 	return $result
  210:     }
  211: 
  212: 
  213:     if ($r->dir_config("lonBalancer") eq 'yes') {
  214: 	$r->set_handlers('PerlResponseHandler'=>
  215: 			 [\&Apache::switchserver::handler]);
  216:     }
  217:     
  218:     if ($handle eq '') {
  219: 	$r->log_reason("Cookie $handle not valid", $r->filename); 
  220:     } elsif ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {
  221: 
  222: # ------------------------------------------------------ Initialize Environment
  223: 
  224: 	&Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
  225: 
  226: # --------------------------------------------------------- Initialize Language
  227: 
  228: 	&Apache::lonlocal::get_language_handle($r);
  229: 
  230:     }
  231: 
  232: # -------------------------------------------------- Should be a valid user now
  233:     if ($env{'user.name'} ne '' && $env{'user.domain'} ne '') {
  234: # -------------------------------------------------------------- Resource State
  235: 
  236: 	if ($requrl=~/^\/+(res|uploaded)\//) {
  237: 	    $env{'request.state'} = "published";
  238: 	} else {
  239: 	    $env{'request.state'} = 'unknown';
  240: 	}
  241: 	$env{'request.filename'} = $r->filename;
  242: 	$env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
  243: # -------------------------------------------------------- Load POST parameters
  244: 
  245: 	&Apache::lonacc::get_posted_cgi($r);
  246: 
  247: # ---------------------------------------------------------------- Check access
  248: 	my $now = time;
  249: 	if ($requrl !~ m{^/(?:adm|public|prtspool)/}
  250: 	    || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
  251: 	    my $access=&Apache::lonnet::allowed('bre',$requrl);
  252: 	    if ($access eq '1') {
  253: 		$env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
  254: 		return HTTP_NOT_ACCEPTABLE; 
  255: 	    }
  256: 	    if ($access eq 'A') {
  257: 		&Apache::restrictedaccess::setup_handler($r);
  258: 		return OK;
  259: 	    }
  260:             if ($access eq 'B') {
  261:                 &Apache::blockedaccess::setup_handler($r);
  262:                 return OK;
  263:             }
  264: 	    if (($access ne '2') && ($access ne 'F')) {
  265: 		$env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
  266: 		return HTTP_NOT_ACCEPTABLE; 
  267: 	    }
  268: 	}
  269: 	if ($requrl =~ m|^/prtspool/|) {
  270: 	    my $start='/prtspool/'.$env{'user.name'}.'_'.
  271: 		$env{'user.domain'};
  272: 	    if ($requrl !~ /^\Q$start\E/) {
  273: 		$env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
  274: 		return HTTP_NOT_ACCEPTABLE;
  275: 	    }
  276: 	}
  277: 	if ($env{'user.name'} eq 'public' && 
  278: 	    $env{'user.domain'} eq 'public' &&
  279: 	    $requrl !~ m{^/+(res|public|uploaded)/} &&
  280: 	    $requrl !~ m{^/adm/[^/]+/[^/]+/aboutme/portfolio$ }x &&
  281: 	    $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) {
  282: 	    $env{'request.querystring'}=$r->args;
  283: 	    $env{'request.firsturl'}=$requrl;
  284: 	    return FORBIDDEN;
  285: 	}
  286: # ------------------------------------------------------------- This is allowed
  287: 	if ($env{'request.course.id'}) {
  288: 	    &Apache::lonnet::countacc($requrl);
  289: 	    $requrl=~/\.(\w+)$/;
  290: 	    if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
  291: 		($requrl=~/^\/adm\/.*\/(aboutme|navmaps|smppg|bulletinboard)(\?|$ )/x) ||
  292: 		($requrl=~/^\/adm\/wrapper\//) ||
  293: 		($requrl=~m|^/adm/coursedocs/showdoc/|) ||
  294: 		($requrl=~m|\.problem/smpedit$|) ||
  295: 		($requrl=~/^\/public\/.*\/syllabus$/)) {
  296: # ------------------------------------- This is serious stuff, get symb and log
  297: 		my $query=$r->args;
  298: 		my $symb;
  299: 		if ($query) {
  300: 		    &Apache::loncommon::get_unprocessed_cgi($query,['symb']);
  301: 		}
  302: 		if ($env{'form.symb'}) {
  303: 		    $symb=&Apache::lonnet::symbclean($env{'form.symb'});
  304: 		    if ($requrl =~ m|^/adm/wrapper/|
  305: 			|| $requrl =~ m|^/adm/coursedocs/showdoc/|) {
  306: 			my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
  307: 			&Apache::lonnet::symblist($map,$murl => [$murl,$mid],
  308: 						  'last_known' =>[$murl,$mid]);
  309: 		    } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) ||
  310: 			     (($requrl=~m|(.*)/smpedit$|) &&
  311: 			      &Apache::lonnet::symbverify($symb,$1))) {
  312: 			my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
  313: 			&Apache::lonnet::symblist($map,$murl => [$murl,$mid],
  314: 						  'last_known' =>[$murl,$mid]);
  315: 		    } else {
  316: 			$r->log_reason('Invalid symb for '.$requrl.': '.
  317: 				       $symb);
  318: 			$env{'user.error.msg'}=
  319: 			    "$requrl:bre:1:1:Invalid Access";
  320: 			return HTTP_NOT_ACCEPTABLE; 
  321: 		    }
  322: 		} else {
  323: 		    $symb=&Apache::lonnet::symbread($requrl);
  324: 		    if (&Apache::lonnet::is_on_map($requrl) && $symb &&
  325: 			!&Apache::lonnet::symbverify($symb,$requrl)) {
  326: 			$r->log_reason('Invalid symb for '.$requrl.': '.$symb);
  327: 			$env{'user.error.msg'}=
  328: 			    "$requrl:bre:1:1:Invalid Access";
  329: 			return HTTP_NOT_ACCEPTABLE; 
  330: 		    }
  331: 		    if ($symb) {
  332: 			my ($map,$mid,$murl)=
  333: 			    &Apache::lonnet::decode_symb($symb);
  334: 			&Apache::lonnet::symblist($map,$murl =>[$murl,$mid],
  335: 						  'last_known' =>[$murl,$mid]);
  336: 		    }
  337: 		}
  338: 		$env{'request.symb'}=$symb;
  339: 		&Apache::lonnet::courseacclog($symb);
  340: 	    } else {
  341: # ------------------------------------------------------- This is other content
  342: 		&Apache::lonnet::courseacclog($requrl);    
  343: 	    }
  344: 	}
  345: 	return OK;
  346:     }
  347: # -------------------------------------------- See if this is a public resource
  348:     if ($requrl=~m|^/+adm/+help/+|) {
  349:  	return OK;
  350:     }
  351: # ------------------------------------ See if this is a viewable portfolio file
  352:     if (&Apache::lonnet::is_portfolio_url($requrl)) {
  353: 	my $access=&Apache::lonnet::allowed('bre',$requrl);
  354: 	if ($access eq 'A') {
  355: 	    &Apache::restrictedaccess::setup_handler($r);
  356: 	    return OK;
  357: 	}
  358: 	if (($access ne '2') && ($access ne 'F')) {
  359: 	    $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
  360: 	    return HTTP_NOT_ACCEPTABLE;
  361: 	}
  362:     }
  363: 
  364: # -------------------------------------------------------------- Not authorized
  365:     $requrl=~/\.(\w+)$/;
  366: #    if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
  367: #        ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) ||
  368: #        ($requrl=~m|^/prtspool/|)) {
  369: # -------------------------- Store where they wanted to go and get login screen
  370: 	$env{'request.querystring'}=$r->args;
  371: 	$env{'request.firsturl'}=$requrl;
  372:        return FORBIDDEN;
  373: #   } else {
  374: # --------------------------------------------------------------------- Goodbye
  375: #       return HTTP_BAD_REQUEST;
  376: #   }
  377: }
  378: 
  379: 1;
  380: __END__
  381: 
  382: =head1 NAME
  383: 
  384: Apache::lonacc - Cookie Based Access Handler
  385: 
  386: =head1 SYNOPSIS
  387: 
  388: Invoked (for various locations) by /etc/httpd/conf/srm.conf:
  389: 
  390:  PerlAccessHandler       Apache::lonacc
  391: 
  392: =head1 INTRODUCTION
  393: 
  394: This module enables cookie based authentication and is used
  395: to control access for many different LON-CAPA URIs.
  396: 
  397: Whenever the client sends the cookie back to the server, 
  398: this cookie is handled by either lonacc.pm or loncacc.pm
  399: (see srm.conf for what is invoked when).  If
  400: the cookie is missing or invalid, the user is re-challenged
  401: for login information.
  402: 
  403: This is part of the LearningOnline Network with CAPA project
  404: described at http://www.lon-capa.org.
  405: 
  406: =head1 HANDLER SUBROUTINE
  407: 
  408: This routine is called by Apache and mod_perl.
  409: 
  410: =over 4
  411: 
  412: =item *
  413: 
  414: transfer profile into environment
  415: 
  416: =item *
  417: 
  418: load POST parameters
  419: 
  420: =item *
  421: 
  422: check access
  423: 
  424: =item *
  425: 
  426: if allowed, get symb, log, generate course statistics if applicable
  427: 
  428: =item *
  429: 
  430: otherwise return error
  431: 
  432: =item *
  433: 
  434: see if public resource
  435: 
  436: =item *
  437: 
  438: store attempted access
  439: 
  440: =back
  441: 
  442: =cut