File:
[LON-CAPA] /
loncom /
auth /
lonacc.pm
Revision
1.125:
download - view:
text,
annotated -
select for diffs
Tue Apr 14 23:52:07 2009 UTC (15 years, 1 month ago) by
raeburn
Branches:
MAIN
CVS tags:
bz5969,
HEAD,
BZ5971-printing-apage,
BZ5434-fox
- HTML documents uploaded directly to a course can be edited by a Course Coordinator (mdc priv).
- "Edit this resource" link displayed in inline menu.
- Link will switch server to course's home server if session is currently hoosted elsewehere (unless a lock is in place).
- Deep linking:
- origurl and symb args can be included in query string for switchserver call, so switched session will go to the same resource on the new server.
Work in progress.
Logging needed: changes, and by whom.
1: # The LearningOnline Network
2: # Cookie Based Access Handler
3: #
4: # $Id: lonacc.pm,v 1.125 2009/04/14 23:52:07 raeburn Exp $
5: #
6: # Copyright Michigan State University Board of Trustees
7: #
8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
9: #
10: # LON-CAPA is free software; you can redistribute it and/or modify
11: # it under the terms of the GNU General Public License as published by
12: # the Free Software Foundation; either version 2 of the License, or
13: # (at your option) any later version.
14: #
15: # LON-CAPA is distributed in the hope that it will be useful,
16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18: # GNU General Public License for more details.
19: #
20: # You should have received a copy of the GNU General Public License
21: # along with LON-CAPA; if not, write to the Free Software
22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23: #
24: # /home/httpd/html/adm/gpl.txt
25: #
26: # http://www.lon-capa.org/
27: #
28: ###
29:
30: =head1 NAME
31:
32: Apache::lonacc - Cookie Based Access Handler
33:
34: =head1 SYNOPSIS
35:
36: Invoked (for various locations) by /etc/httpd/conf/srm.conf:
37:
38: PerlAccessHandler Apache::lonacc
39:
40: =head1 INTRODUCTION
41:
42: This module enables cookie based authentication and is used
43: to control access for many different LON-CAPA URIs.
44:
45: Whenever the client sends the cookie back to the server,
46: this cookie is handled by either lonacc.pm or loncacc.pm
47: (see srm.conf for what is invoked when). If
48: the cookie is missing or invalid, the user is re-challenged
49: for login information.
50:
51: This is part of the LearningOnline Network with CAPA project
52: described at http://www.lon-capa.org.
53:
54: =head1 HANDLER SUBROUTINE
55:
56: This routine is called by Apache and mod_perl.
57:
58: =over 4
59:
60: =item *
61:
62: transfer profile into environment
63:
64: =item *
65:
66: load POST parameters
67:
68: =item *
69:
70: check access
71:
72: =item *
73:
74: if allowed, get symb, log, generate course statistics if applicable
75:
76: =item *
77:
78: otherwise return error
79:
80: =item *
81:
82: see if public resource
83:
84: =item *
85:
86: store attempted access
87:
88: =back
89:
90: =head1 NOTABLE SUBROUTINES
91:
92: =over
93:
94: =cut
95:
96:
97: package Apache::lonacc;
98:
99: use strict;
100: use Apache::Constants qw(:common :http :methods);
101: use Apache::File;
102: use Apache::lonnet;
103: use Apache::loncommon();
104: use Apache::lonlocal;
105: use Apache::restrictedaccess();
106: use Apache::blockedaccess();
107: use Fcntl qw(:flock);
108: use LONCAPA;
109:
110: sub cleanup {
111: my ($r)=@_;
112: if (! $r->is_initial_req()) { return DECLINED; }
113: &Apache::lonnet::save_cache();
114: &Apache::lontexconvert::jsMath_reset();
115: return OK;
116: }
117:
118: sub goodbye {
119: my ($r)=@_;
120: &Apache::lonnet::goodbye();
121: return DONE;
122: }
123:
124: ###############################################
125:
126: sub get_posted_cgi {
127: my ($r,$fields) = @_;
128:
129: my $buffer;
130: if ($r->header_in('Content-length')) {
131: $r->read($buffer,$r->header_in('Content-length'),0);
132: }
133: my $content_type = $r->header_in('Content-type');
134: if ($content_type !~ m{^multipart/form-data}) {
135: my @pairs=split(/&/,$buffer);
136: my $pair;
137: foreach $pair (@pairs) {
138: my ($name,$value) = split(/=/,$pair);
139: $value =~ tr/+/ /;
140: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
141: $name =~ tr/+/ /;
142: $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
143: if (ref($fields) eq 'ARRAY') {
144: next if (!grep(/^\Q$name\E$/,@{$fields}));
145: }
146: &Apache::loncommon::add_to_env("form.$name",$value);
147: }
148: } else {
149: my ($contentsep) = ($content_type =~ /boundary=\"?([^\";,]+)\"?/);
150: my @lines = split (/\n/,$buffer);
151: my $name='';
152: my $value='';
153: my $fname='';
154: my $fmime='';
155: my $i;
156: for ($i=0;$i<=$#lines;$i++) {
157: if ($lines[$i]=~/^--\Q$contentsep\E/) {
158: if ($name) {
159: chomp($value);
160: if (ref($fields) eq 'ARRAY') {
161: next if (!grep(/^\Q$name\E$/,@{$fields}));
162: }
163: if ($fname) {
164: if ($env{'form.symb'} ne '') {
165: my $size = (length($value))/(1024.0 * 1024.0);
166: if (&upload_size_allowed($name,$size,$fname) eq 'ok') {
167: $env{"form.$name.filename"}=$fname;
168: $env{"form.$name.mimetype"}=$fmime;
169: &Apache::loncommon::add_to_env("form.$name",$value);
170: }
171: } else {
172: $env{"form.$name.filename"}=$fname;
173: $env{"form.$name.mimetype"}=$fmime;
174: &Apache::loncommon::add_to_env("form.$name",$value);
175: }
176: } else {
177: $value=~s/\s+$//s;
178: &Apache::loncommon::add_to_env("form.$name",$value);
179: }
180: }
181: if ($i<$#lines) {
182: $i++;
183: $lines[$i]=~
184: /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;
185: $name=$1;
186: $value='';
187: if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {
188: $fname=$1;
189: if
190: ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {
191: $fmime=$1;
192: $i++;
193: } else {
194: $fmime='';
195: }
196: } else {
197: $fname='';
198: $fmime='';
199: }
200: $i++;
201: }
202: } else {
203: $value.=$lines[$i]."\n";
204: }
205: }
206: }
207: #
208: # Digested POSTed values
209: #
210: # Remember the way this was originally done (GET or POST)
211: #
212: $env{'request.method'}=$ENV{'REQUEST_METHOD'};
213: #
214: # There may also be stuff in the query string
215: # Tell subsequent handlers that this was GET, not POST, so they can access query string.
216: # Also, unset POSTed content length to cover all tracks.
217: #
218:
219: $r->method_number(M_GET);
220:
221: $r->method('GET');
222: $r->headers_in->unset('Content-length');
223: }
224:
225: =pod
226:
227: =item upload_size_allowed()
228:
229: Perform size checks for file uploads to essayresponse items in course context.
230:
231: Add form.HWFILESIZE.$part_$id to %env with file size (MB)
232: If file exceeds maximum allowed size, add form.HWFILETOOBIG.$part_$id to %env.
233:
234: =cut
235:
236: sub upload_size_allowed {
237: my ($name,$size,$fname) = @_;
238: if ($name =~ /^HWFILE(\w+)$/) {
239: my $ident = $1;
240: my $item = 'HWFILESIZE'.$ident;
241: my $savesize = sprintf("%.6f",$size);
242: &Apache::loncommon::add_to_env("form.$item",$savesize);
243: my $maxsize= &Apache::lonnet::EXT("resource.$ident.maxfilesize");
244: if (!$maxsize) {
245: $maxsize = 10.0; # FIXME This should become a domain configuration.
246: }
247: if ($size > $maxsize) {
248: my $warn = 'HWFILETOOBIG'.$ident;
249: &Apache::loncommon::add_to_env("form.$warn",$fname);
250: return;
251: }
252: }
253: return 'ok';
254: }
255:
256: =pod
257:
258: =item sso_login()
259:
260: handle the case of the single sign on user, at this point $r->user
261: will be set and valid now need to find the loncapa user info and possibly
262: balance them
263: returns OK if it was a SSO and user was handled
264: undef if not SSO or no means to hanle the user
265:
266: =cut
267:
268: sub sso_login {
269: my ($r,$handle) = @_;
270:
271: my $lonidsdir=$r->dir_config('lonIDsDir');
272: if (!($r->user
273: && (!defined($env{'user.name'}) && !defined($env{'user.domain'}))
274: && ($handle eq ''))) {
275: # not an SSO case or already logged in
276: return undef;
277: }
278:
279: my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/);
280:
281: my $domain = $r->dir_config('lonDefDomain');
282: my $home=&Apache::lonnet::homeserver($user,$domain);
283: if ($home !~ /(con_lost|no_host|no_such_host)/) {
284: &Apache::lonnet::logthis(" SSO authorized user $user ");
285: if ($r->dir_config("lonBalancer") eq 'yes') {
286: # login but immeaditly go to switch server to find us a new
287: # machine
288: &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
289: $env{'request.sso.login'} = 1;
290: if (defined($r->dir_config("lonSSOReloginServer"))) {
291: $env{'request.sso.reloginserver'} =
292: $r->dir_config('lonSSOReloginServer');
293: }
294: $r->internal_redirect('/adm/switchserver');
295: $r->set_handlers('PerlHandler'=> undef);
296: } else {
297: # need to login them in, so generate the need data that
298: # migrate expects to do login
299: my %info=('ip' => $r->connection->remote_ip(),
300: 'domain' => $domain,
301: 'username' => $user,
302: 'server' => $r->dir_config('lonHostID'),
303: 'sso.login' => 1
304: );
305: if ($r->dir_config("ssodirecturl") == 1) {
306: $info{'origurl'} = $r->uri;
307: }
308: if (defined($r->dir_config("lonSSOReloginServer"))) {
309: $info{'sso.reloginserver'} =
310: $r->dir_config('lonSSOReloginServer');
311: }
312: my $token =
313: &Apache::lonnet::tmpput(\%info,
314: $r->dir_config('lonHostID'));
315: $env{'form.token'} = $token;
316: $r->internal_redirect('/adm/migrateuser');
317: $r->set_handlers('PerlHandler'=> undef);
318: }
319: return OK;
320: } elsif (defined($r->dir_config('lonSSOUserUnknownRedirect'))) {
321: &Apache::lonnet::logthis(" SSO authorized unknown user $user ");
322: $r->subprocess_env->set('SSOUserUnknown' => $user);
323: $r->subprocess_env->set('SSOUserDomain' => $domain);
324: my @cancreate;
325: my %domconfig =
326: &Apache::lonnet::get_dom('configuration',['usercreation'],$domain);
327: if (ref($domconfig{'usercreation'}) eq 'HASH') {
328: if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
329: if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
330: @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
331: } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') &&
332: ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
333: @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
334: }
335: }
336: }
337: if (grep(/^sso$/,@cancreate)) {
338: $r->internal_redirect('/adm/createaccount');
339: } else {
340: $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect'));
341: }
342: $r->set_handlers('PerlHandler'=> undef);
343: return OK;
344: }
345: return undef;
346: }
347:
348: sub handler {
349: my $r = shift;
350: my $requrl=$r->uri;
351: if (&Apache::lonnet::is_domainimage($requrl)) {
352: return OK;
353: }
354:
355: if ($requrl =~ m{^/res/adm/pages/[^/]+\.(gif|png)$}) {
356: return OK;
357: }
358:
359: my $handle = &Apache::lonnet::check_for_valid_session($r);
360:
361: my $result = &sso_login($r,$handle);
362: if (defined($result)) {
363: return $result;
364: }
365:
366:
367: if ($r->dir_config("lonBalancer") eq 'yes') {
368: $r->set_handlers('PerlResponseHandler'=>
369: [\&Apache::switchserver::handler]);
370: }
371:
372: if ($handle eq '') {
373: $r->log_reason("Cookie $handle not valid", $r->filename);
374: } elsif ($handle ne '') {
375:
376: # ------------------------------------------------------ Initialize Environment
377: my $lonidsdir=$r->dir_config('lonIDsDir');
378: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
379:
380: # --------------------------------------------------------- Initialize Language
381:
382: &Apache::lonlocal::get_language_handle($r);
383:
384: }
385:
386: # -------------------------------------------------- Should be a valid user now
387: if ($env{'user.name'} ne '' && $env{'user.domain'} ne '') {
388: # -------------------------------------------------------------- Resource State
389:
390: if ($requrl=~/^\/+(res|uploaded)\//) {
391: $env{'request.state'} = "published";
392: } else {
393: $env{'request.state'} = 'unknown';
394: }
395: $env{'request.filename'} = $r->filename;
396: $env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
397: # -------------------------------------------------------- Load POST parameters
398:
399: &Apache::lonacc::get_posted_cgi($r);
400:
401: # ---------------------------------------------------------------- Check access
402: my $now = time;
403: if ($requrl !~ m{^/(?:adm|public|prtspool)/}
404: || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
405: my $access=&Apache::lonnet::allowed('bre',$requrl);
406: if ($access eq '1') {
407: $env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
408: return HTTP_NOT_ACCEPTABLE;
409: }
410: if ($access eq 'A') {
411: &Apache::restrictedaccess::setup_handler($r);
412: return OK;
413: }
414: if ($access eq 'B') {
415: &Apache::blockedaccess::setup_handler($r);
416: return OK;
417: }
418: if (($access ne '2') && ($access ne 'F')) {
419: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
420: return HTTP_NOT_ACCEPTABLE;
421: }
422: }
423: if ($requrl =~ m|^/prtspool/|) {
424: my $start='/prtspool/'.$env{'user.name'}.'_'.
425: $env{'user.domain'};
426: if ($requrl !~ /^\Q$start\E/) {
427: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
428: return HTTP_NOT_ACCEPTABLE;
429: }
430: }
431: if ($requrl =~ m|^/zipspool/|) {
432: my $start='/zipspool/zipout/'.$env{'user.name'}.":".
433: $env{'user.domain'};
434: if ($requrl !~ /^\Q$start\E/) {
435: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
436: return HTTP_NOT_ACCEPTABLE;
437: }
438: }
439: if ($env{'user.name'} eq 'public' &&
440: $env{'user.domain'} eq 'public' &&
441: $requrl !~ m{^/+(res|public|uploaded)/} &&
442: $requrl !~ m{^/adm/[^/]+/[^/]+/aboutme/portfolio$ }x &&
443: $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) {
444: $env{'request.querystring'}=$r->args;
445: $env{'request.firsturl'}=$requrl;
446: return FORBIDDEN;
447: }
448: # ------------------------------------------------------------- This is allowed
449: if ($env{'request.course.id'}) {
450: &Apache::lonnet::countacc($requrl);
451: $requrl=~/\.(\w+)$/;
452: my $query=$r->args;
453: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
454: ($requrl=~/^\/adm\/.*\/(aboutme|navmaps|smppg|bulletinboard)(\?|$ )/x) ||
455: ($requrl=~/^\/adm\/wrapper\//) ||
456: ($requrl=~m|^/adm/coursedocs/showdoc/|) ||
457: ($requrl=~m|\.problem/smpedit$|) ||
458: ($requrl=~/^\/public\/.*\/syllabus$/)) {
459: # ------------------------------------- This is serious stuff, get symb and log
460: my $symb;
461: if ($query) {
462: &Apache::loncommon::get_unprocessed_cgi($query,['symb']);
463: }
464: if ($env{'form.symb'}) {
465: $symb=&Apache::lonnet::symbclean($env{'form.symb'});
466: if ($requrl =~ m|^/adm/wrapper/|
467: || $requrl =~ m|^/adm/coursedocs/showdoc/|) {
468: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
469: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
470: 'last_known' =>[$murl,$mid]);
471: } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) ||
472: (($requrl=~m|(.*)/smpedit$|) &&
473: &Apache::lonnet::symbverify($symb,$1))) {
474: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
475: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
476: 'last_known' =>[$murl,$mid]);
477: } else {
478: $r->log_reason('Invalid symb for '.$requrl.': '.
479: $symb);
480: $env{'user.error.msg'}=
481: "$requrl:bre:1:1:Invalid Access";
482: return HTTP_NOT_ACCEPTABLE;
483: }
484: } else {
485: $symb=&Apache::lonnet::symbread($requrl);
486: if (&Apache::lonnet::is_on_map($requrl) && $symb &&
487: !&Apache::lonnet::symbverify($symb,$requrl)) {
488: $r->log_reason('Invalid symb for '.$requrl.': '.$symb);
489: $env{'user.error.msg'}=
490: "$requrl:bre:1:1:Invalid Access";
491: return HTTP_NOT_ACCEPTABLE;
492: }
493: if ($symb) {
494: my ($map,$mid,$murl)=
495: &Apache::lonnet::decode_symb($symb);
496: &Apache::lonnet::symblist($map,$murl =>[$murl,$mid],
497: 'last_known' =>[$murl,$mid]);
498: }
499: }
500: $env{'request.symb'}=$symb;
501: &Apache::lonnet::courseacclog($symb);
502: } else {
503: # ------------------------------------------------------- This is other content
504: &Apache::lonnet::courseacclog($requrl);
505: }
506: my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};;
507: my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};;
508: if ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/docs/.+\.html?$}) {
509: if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) {
510: if ($query) {
511: &Apache::loncommon::get_unprocessed_cgi($query,['forceedit']);
512: if ($env{'form.forceedit'}) {
513: $env{'request.state'} = 'edit';
514: }
515: }
516: }
517: }
518: }
519: return OK;
520: }
521: # -------------------------------------------- See if this is a public resource
522: if ($requrl=~m|^/+adm/+help/+|) {
523: return OK;
524: }
525: # ------------------------------------ See if this is a viewable portfolio file
526: if (&Apache::lonnet::is_portfolio_url($requrl)) {
527: my $access=&Apache::lonnet::allowed('bre',$requrl);
528: if ($access eq 'A') {
529: &Apache::restrictedaccess::setup_handler($r);
530: return OK;
531: }
532: if (($access ne '2') && ($access ne 'F')) {
533: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
534: return HTTP_NOT_ACCEPTABLE;
535: }
536: }
537:
538: # -------------------------------------------------------------- Not authorized
539: $requrl=~/\.(\w+)$/;
540: # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
541: # ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) ||
542: # ($requrl=~m|^/prtspool/|)) {
543: # -------------------------- Store where they wanted to go and get login screen
544: $env{'request.querystring'}=$r->args;
545: $env{'request.firsturl'}=$requrl;
546: return FORBIDDEN;
547: # } else {
548: # --------------------------------------------------------------------- Goodbye
549: # return HTTP_BAD_REQUEST;
550: # }
551: }
552:
553: 1;
554: __END__
555:
556: =pod
557:
558: =back
559:
560: =cut
561:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to lonacc.pm CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [LON-CAPA] / loncom / auth