loncom/auth/lonacc.pm - view

File: [LON-CAPA] / loncom / auth / lonacc.pm
Revision 1.137: download - view: text, annotated - select for diffs
Tue Aug 9 01:35:31 2011 UTC (12 years, 9 months ago) by raeburn
Branches: MAIN
CVS tags: language_hyphenation_merge, language_hyphenation, HEAD, BZ4492-merge, BZ4492-feature_horizontal_radioresponse, BZ4492-feature_Support_horizontal_radioresponse, BZ4492-Support_horizontal_radioresponse

- Bug 6371.
  - Use of lonBalancer in Apache config file superceded by setting
    loadbalancing in domain configuration.
  - More granularity available in load balancing:
     - Rules can be defined for users in domain, based on institutional
       affiliation (e.g., Faculty, Staff, Student etc.).
     - Rules for advanced user or author trump rules based on affiliation
     - Rules can also be set for users from other domain hosted by
       institution (i.e., multi-domain server set-ups)
     - Rules can also be set for users from other institutions.

1: # The LearningOnline Network 2: # Cookie Based Access Handler 3: # 4: # $Id: lonacc.pm,v 1.137 2011/08/09 01:35:31 raeburn Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: ### 29: 30: =head1 NAME 31: 32: Apache::lonacc - Cookie Based Access Handler 33: 34: =head1 SYNOPSIS 35: 36: Invoked (for various locations) by /etc/httpd/conf/srm.conf: 37: 38: PerlAccessHandler Apache::lonacc 39: 40: =head1 INTRODUCTION 41: 42: This module enables cookie based authentication and is used 43: to control access for many different LON-CAPA URIs. 44: 45: Whenever the client sends the cookie back to the server, 46: this cookie is handled by either lonacc.pm or loncacc.pm 47: (see srm.conf for what is invoked when). If 48: the cookie is missing or invalid, the user is re-challenged 49: for login information. 50: 51: This is part of the LearningOnline Network with CAPA project 52: described at http://www.lon-capa.org. 53: 54: =head1 HANDLER SUBROUTINE 55: 56: This routine is called by Apache and mod_perl. 57: 58: =over 4 59: 60: =item * 61: 62: transfer profile into environment 63: 64: =item * 65: 66: load POST parameters 67: 68: =item * 69: 70: check access 71: 72: =item * 73: 74: if allowed, get symb, log, generate course statistics if applicable 75: 76: =item * 77: 78: otherwise return error 79: 80: =item * 81: 82: see if public resource 83: 84: =item * 85: 86: store attempted access 87: 88: =back 89: 90: =head1 NOTABLE SUBROUTINES 91: 92: =over 93: 94: =cut 95: 96: 97: package Apache::lonacc; 98: 99: use strict; 100: use Apache::Constants qw(:common :http :methods); 101: use Apache::File; 102: use Apache::lonnet; 103: use Apache::loncommon(); 104: use Apache::lonlocal; 105: use Apache::restrictedaccess(); 106: use Apache::blockedaccess(); 107: use Fcntl qw(:flock); 108: use LONCAPA; 109: 110: sub cleanup { 111: my ($r)=@_; 112: if (! $r->is_initial_req()) { return DECLINED; } 113: &Apache::lonnet::save_cache(); 114: &Apache::lontexconvert::jsMath_reset(); 115: return OK; 116: } 117: 118: sub goodbye { 119: my ($r)=@_; 120: &Apache::lonnet::goodbye(); 121: return DONE; 122: } 123: 124: ############################################### 125: 126: sub get_posted_cgi { 127: my ($r,$fields) = @_; 128: 129: my $buffer; 130: if ($r->header_in('Content-length')) { 131: $r->read($buffer,$r->header_in('Content-length'),0); 132: } 133: my $content_type = $r->header_in('Content-type'); 134: if ($content_type !~ m{^multipart/form-data}) { 135: my @pairs=split(/&/,$buffer); 136: my $pair; 137: foreach $pair (@pairs) { 138: my ($name,$value) = split(/=/,$pair); 139: $value =~ tr/+/ /; 140: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; 141: $name =~ tr/+/ /; 142: $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; 143: if (ref($fields) eq 'ARRAY') { 144: next if (!grep(/^\Q$name\E$/,@{$fields})); 145: } 146: &Apache::loncommon::add_to_env("form.$name",$value); 147: } 148: } else { 149: my ($contentsep) = ($content_type =~ /boundary=\"?([^\";,]+)\"?/); 150: my @lines = split (/\n/,$buffer); 151: my $name=''; 152: my $value=''; 153: my $fname=''; 154: my $fmime=''; 155: my $i; 156: for ($i=0;$i<=$#lines;$i++) { 157: if ($lines[$i]=~/^--\Q$contentsep\E/) { 158: if ($name) { 159: $value=~s/[\r\n]+$//; 160: if (ref($fields) eq 'ARRAY') { 161: next if (!grep(/^\Q$name\E$/,@{$fields})); 162: } 163: if ($fname) { 164: if ($env{'form.symb'} ne '') { 165: my $size = (length($value))/(1024.0 * 1024.0); 166: if (&upload_size_allowed($name,$size,$fname) eq 'ok') { 167: $env{"form.$name.filename"}=$fname; 168: $env{"form.$name.mimetype"}=$fmime; 169: &Apache::loncommon::add_to_env("form.$name",$value); 170: } 171: } else { 172: $env{"form.$name.filename"}=$fname; 173: $env{"form.$name.mimetype"}=$fmime; 174: &Apache::loncommon::add_to_env("form.$name",$value); 175: } 176: } else { 177: $value=~s/\s+$//s; 178: &Apache::loncommon::add_to_env("form.$name",$value); 179: } 180: } 181: if ($i<$#lines) { 182: $i++; 183: $lines[$i]=~ 184: /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i; 185: $name=$1; 186: $value=''; 187: if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) { 188: $fname=$1; 189: if 190: ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) { 191: $fmime=$1; 192: $i++; 193: } else { 194: $fmime=''; 195: } 196: } else { 197: $fname=''; 198: $fmime=''; 199: } 200: $i++; 201: } 202: } else { 203: $value.=$lines[$i]."\n"; 204: } 205: } 206: } 207: # 208: # Digested POSTed values 209: # 210: # Remember the way this was originally done (GET or POST) 211: # 212: $env{'request.method'}=$ENV{'REQUEST_METHOD'}; 213: # 214: # There may also be stuff in the query string 215: # Tell subsequent handlers that this was GET, not POST, so they can access query string. 216: # Also, unset POSTed content length to cover all tracks. 217: # 218: 219: $r->method_number(M_GET); 220: 221: $r->method('GET'); 222: $r->headers_in->unset('Content-length'); 223: } 224: 225: =pod 226: 227: =item upload_size_allowed() 228: 229: Perform size checks for file uploads to essayresponse items in course context. 230: 231: Add form.HWFILESIZE.$part_$id to %env with file size (MB) 232: If file exceeds maximum allowed size, add form.HWFILETOOBIG.$part_$id to %env. 233: 234: =cut 235: 236: sub upload_size_allowed { 237: my ($name,$size,$fname) = @_; 238: if ($name =~ /^HWFILE(\w+)$/) { 239: my $ident = $1; 240: my $item = 'HWFILESIZE'.$ident; 241: my $savesize = sprintf("%.6f",$size); 242: &Apache::loncommon::add_to_env("form.$item",$savesize); 243: my $maxsize= &Apache::lonnet::EXT("resource.$ident.maxfilesize"); 244: if (!$maxsize) { 245: $maxsize = 10.0; # FIXME This should become a domain configuration. 246: } 247: if ($size > $maxsize) { 248: my $warn = 'HWFILETOOBIG'.$ident; 249: &Apache::loncommon::add_to_env("form.$warn",$fname); 250: return; 251: } 252: } 253: return 'ok'; 254: } 255: 256: =pod 257: 258: =item sso_login() 259: 260: handle the case of the single sign on user, at this point $r->user 261: will be set and valid now need to find the loncapa user info and possibly 262: balance them 263: returns OK if it was a SSO and user was handled 264: undef if not SSO or no means to hanle the user 265: 266: =cut 267: 268: sub sso_login { 269: my ($r,$handle) = @_; 270: 271: my $lonidsdir=$r->dir_config('lonIDsDir'); 272: if (!($r->user 273: && (!defined($env{'user.name'}) && !defined($env{'user.domain'})) 274: && ($handle eq ''))) { 275: # not an SSO case or already logged in 276: return undef; 277: } 278: 279: my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/); 280: 281: my $query = $r->args; 282: my %form; 283: if ($query) { 284: my @items = ('role','symb'); 285: &Apache::loncommon::get_unprocessed_cgi($query,\@items); 286: foreach my $item (@items) { 287: if (defined($env{'form.'.$item})) { 288: $form{$item} = $env{'form.'.$item}; 289: } 290: } 291: } 292: 293: my $domain = $r->dir_config('lonSSOUserDomain'); 294: if ($domain eq '') { 295: $domain = $r->dir_config('lonDefDomain'); 296: } 297: my $home=&Apache::lonnet::homeserver($user,$domain); 298: if ($home !~ /(con_lost|no_host|no_such_host)/) { 299: &Apache::lonnet::logthis(" SSO authorized user $user "); 300: my ($is_balancer,$otherserver) = 301: &Apache::lonnet::check_loadbalancing($user,$domain); 302: if ($is_balancer) { 303: # login but immediately go to switch server to find us a new 304: # machine 305: &Apache::lonauth::success($r,$user,$domain,$home,'noredirect'); 306: $env{'request.sso.login'} = 1; 307: if (defined($r->dir_config("lonSSOReloginServer"))) { 308: $env{'request.sso.reloginserver'} = 309: $r->dir_config('lonSSOReloginServer'); 310: } 311: my $redirecturl = '/adm/switchserver'; 312: if ($otherserver ne '') { 313: $redirecturl .= '?otherserver='.$otherserver; 314: } 315: $r->internal_redirect($redirecturl); 316: $r->set_handlers('PerlHandler'=> undef); 317: } else { 318: # need to login them in, so generate the need data that 319: # migrate expects to do login 320: my %info=('ip' => $r->connection->remote_ip(), 321: 'domain' => $domain, 322: 'username' => $user, 323: 'server' => $r->dir_config('lonHostID'), 324: 'sso.login' => 1 325: ); 326: foreach my $item ('role','symb') { 327: if (exists($form{$item})) { 328: $info{$item} = $form{$item}; 329: } 330: } 331: if ($r->dir_config("ssodirecturl") == 1) { 332: $info{'origurl'} = $r->uri; 333: } 334: if (defined($r->dir_config("lonSSOReloginServer"))) { 335: $info{'sso.reloginserver'} = 336: $r->dir_config('lonSSOReloginServer'); 337: } 338: my $token = 339: &Apache::lonnet::tmpput(\%info, 340: $r->dir_config('lonHostID')); 341: $env{'form.token'} = $token; 342: $r->internal_redirect('/adm/migrateuser'); 343: $r->set_handlers('PerlHandler'=> undef); 344: } 345: return OK; 346: } elsif (defined($r->dir_config('lonSSOUserUnknownRedirect'))) { 347: &Apache::lonnet::logthis(" SSO authorized unknown user $user "); 348: $r->subprocess_env->set('SSOUserUnknown' => $user); 349: $r->subprocess_env->set('SSOUserDomain' => $domain); 350: my @cancreate; 351: my %domconfig = 352: &Apache::lonnet::get_dom('configuration',['usercreation'],$domain); 353: if (ref($domconfig{'usercreation'}) eq 'HASH') { 354: if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') { 355: if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') { 356: @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}}; 357: } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') && 358: ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) { 359: @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}); 360: } 361: } 362: } 363: if (grep(/^sso$/,@cancreate)) { 364: $r->internal_redirect('/adm/createaccount'); 365: } else { 366: $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect')); 367: } 368: $r->set_handlers('PerlHandler'=> undef); 369: return OK; 370: } 371: return undef; 372: } 373: 374: sub handler { 375: my $r = shift; 376: my $requrl=$r->uri; 377: if (&Apache::lonnet::is_domainimage($requrl)) { 378: return OK; 379: } 380: 381: if ($requrl =~ m{^/res/adm/pages/[^/]+\.(gif|png)$}) { 382: return OK; 383: } 384: 385: my $handle = &Apache::lonnet::check_for_valid_session($r); 386: 387: my $result = &sso_login($r,$handle); 388: if (defined($result)) { 389: return $result; 390: } 391: 392: my ($is_balancer,$otherserver); 393: 394: if ($handle eq '') { 395: $r->log_reason("Cookie $handle not valid", $r->filename); 396: } elsif ($handle ne '') { 397: 398: # ------------------------------------------------------ Initialize Environment 399: my $lonidsdir=$r->dir_config('lonIDsDir'); 400: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); 401: 402: # --------------------------------------------------------- Initialize Language 403: 404: &Apache::lonlocal::get_language_handle($r); 405: 406: } 407: 408: # -------------------------------------------------- Should be a valid user now 409: if ($env{'user.name'} ne '' && $env{'user.domain'} ne '') { 410: # -------------------------------------------------------------- Resource State 411: 412: if ($requrl=~/^\/+(res|uploaded)\//) { 413: $env{'request.state'} = "published"; 414: } else { 415: $env{'request.state'} = 'unknown'; 416: } 417: $env{'request.filename'} = $r->filename; 418: $env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl); 419: if ($requrl =~ m{^/adm/wrapper/ext/}) { 420: my $query = $r->args; 421: if ($query) { 422: my $preserved; 423: foreach my $pair (split(/&/,$query)) { 424: my ($name, $value) = split(/=/,$pair); 425: unless ($name eq 'symb') { 426: $preserved .= $pair.'&'; 427: } 428: } 429: $preserved =~ s/\&$//; 430: if ($preserved) { 431: $env{'request.external.querystring'} = $preserved; 432: } 433: } 434: } 435: # -------------------------------------------------------- Load POST parameters 436: 437: &Apache::lonacc::get_posted_cgi($r); 438: 439: # ------------------------------------------------------ Check if load balancer 440: 441: ($is_balancer,$otherserver) = 442: &Apache::lonnet::check_loadbalancing($env{'user.name'}, 443: $env{'user.domain'}); 444: if ($is_balancer) { 445: $r->set_handlers('PerlResponseHandler'=> 446: [\&Apache::switchserver::handler]); 447: if ($otherserver ne '') { 448: $env{'form.otherserver'} = $otherserver; 449: } 450: } 451: 452: # ---------------------------------------------------------------- Check access 453: my $now = time; 454: if ($requrl !~ m{^/(?:adm|public|prtspool)/} 455: || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) { 456: my $access=&Apache::lonnet::allowed('bre',$requrl); 457: if ($access eq '1') { 458: $env{'user.error.msg'}="$requrl:bre:0:0:Choose Course"; 459: return HTTP_NOT_ACCEPTABLE; 460: } 461: if ($access eq 'A') { 462: &Apache::restrictedaccess::setup_handler($r); 463: return OK; 464: } 465: if ($access eq 'B') { 466: &Apache::blockedaccess::setup_handler($r); 467: return OK; 468: } 469: if (($access ne '2') && ($access ne 'F')) { 470: if ($requrl =~ m{^/res/}) { 471: $access = &Apache::lonnet::allowed('bro',$requrl); 472: if ($access ne 'F') { 473: if ($requrl eq '/res/lib/templates/simpleproblem.problem/smpedit') { 474: $access = &Apache::lonnet::allowed('bre','/res/lib/templates/simpleproblem.problem'); 475: if ($access ne 'F') { 476: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 477: return HTTP_NOT_ACCEPTABLE; 478: } 479: } else { 480: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 481: return HTTP_NOT_ACCEPTABLE; 482: } 483: } 484: } else { 485: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 486: return HTTP_NOT_ACCEPTABLE; 487: } 488: } 489: } 490: if ($requrl =~ m|^/prtspool/|) { 491: my $start='/prtspool/'.$env{'user.name'}.'_'. 492: $env{'user.domain'}; 493: if ($requrl !~ /^\Q$start\E/) { 494: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 495: return HTTP_NOT_ACCEPTABLE; 496: } 497: } 498: if ($requrl =~ m|^/zipspool/|) { 499: my $start='/zipspool/zipout/'.$env{'user.name'}.":". 500: $env{'user.domain'}; 501: if ($requrl !~ /^\Q$start\E/) { 502: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 503: return HTTP_NOT_ACCEPTABLE; 504: } 505: } 506: if ($env{'user.name'} eq 'public' && 507: $env{'user.domain'} eq 'public' && 508: $requrl !~ m{^/+(res|public|uploaded)/} && 509: $requrl !~ m{^/adm/[^/]+/[^/]+/aboutme/portfolio$ }x && 510: $requrl !~ m{^/adm/blockingstatus/.*$} && 511: $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) { 512: $env{'request.querystring'}=$r->args; 513: $env{'request.firsturl'}=$requrl; 514: return FORBIDDEN; 515: } 516: # ------------------------------------------------------------- This is allowed 517: if ($env{'request.course.id'}) { 518: &Apache::lonnet::countacc($requrl); 519: $requrl=~/\.(\w+)$/; 520: my $query=$r->args; 521: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') || 522: ($requrl=~/^\/adm\/.*\/(aboutme|smppg|bulletinboard)(\?|$ )/x) || 523: ($requrl=~/^\/adm\/wrapper\//) || 524: ($requrl=~m|^/adm/coursedocs/showdoc/|) || 525: ($requrl=~m|\.problem/smpedit$|) || 526: ($requrl=~/^\/public\/.*\/syllabus$/) || 527: ($requrl=~/^\/adm\/(viewclasslist|navmaps)$/) || 528: ($requrl=~/^\/adm\/.*\/aboutme\/portfolio(\?|$)/)) { 529: # ------------------------------------- This is serious stuff, get symb and log 530: my $symb; 531: if ($query) { 532: &Apache::loncommon::get_unprocessed_cgi($query,['symb']); 533: } 534: if ($env{'form.symb'}) { 535: $symb=&Apache::lonnet::symbclean($env{'form.symb'}); 536: if ($requrl =~ m|^/adm/wrapper/| 537: || $requrl =~ m|^/adm/coursedocs/showdoc/|) { 538: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb); 539: &Apache::lonnet::symblist($map,$murl => [$murl,$mid], 540: 'last_known' =>[$murl,$mid]); 541: } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) || 542: (($requrl=~m|(.*)/smpedit$|) && 543: &Apache::lonnet::symbverify($symb,$1)) || 544: (($requrl=~m|(.*/aboutme)/portfolio$|) && 545: &Apache::lonnet::symbverify($symb,$1))) { 546: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb); 547: &Apache::lonnet::symblist($map,$murl => [$murl,$mid], 548: 'last_known' =>[$murl,$mid]); 549: } else { 550: $r->log_reason('Invalid symb for '.$requrl.': '. 551: $symb); 552: $env{'user.error.msg'}= 553: "$requrl:bre:1:1:Invalid Access"; 554: return HTTP_NOT_ACCEPTABLE; 555: } 556: } else { 557: if ($requrl=~m{^(/adm/.*/aboutme)/portfolio$}) { 558: $requrl = $1; 559: } 560: $symb=&Apache::lonnet::symbread($requrl); 561: if (&Apache::lonnet::is_on_map($requrl) && $symb && 562: !&Apache::lonnet::symbverify($symb,$requrl)) { 563: $r->log_reason('Invalid symb for '.$requrl.': '.$symb); 564: $env{'user.error.msg'}= 565: "$requrl:bre:1:1:Invalid Access"; 566: return HTTP_NOT_ACCEPTABLE; 567: } 568: if ($symb) { 569: my ($map,$mid,$murl)= 570: &Apache::lonnet::decode_symb($symb); 571: &Apache::lonnet::symblist($map,$murl =>[$murl,$mid], 572: 'last_known' =>[$murl,$mid]); 573: } 574: } 575: $env{'request.symb'}=$symb; 576: &Apache::lonnet::courseacclog($symb); 577: } else { 578: # ------------------------------------------------------- This is other content 579: &Apache::lonnet::courseacclog($requrl); 580: } 581: my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};; 582: my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};; 583: if ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/docs/.+\.html?$}) { 584: if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) { 585: if ($query) { 586: &Apache::loncommon::get_unprocessed_cgi($query,['forceedit']); 587: if ($env{'form.forceedit'}) { 588: $env{'request.state'} = 'edit'; 589: } 590: } 591: } 592: } 593: } 594: return OK; 595: } else { 596: my $defdom=$r->dir_config('lonDefDomain'); 597: ($is_balancer,$otherserver) = 598: &Apache::lonnet::check_loadbalancing(undef,$defdom); 599: if ($is_balancer) { 600: $r->set_handlers('PerlResponseHandler'=> 601: [\&Apache::switchserver::handler]); 602: if ($otherserver ne '') { 603: $env{'form.otherserver'} = $otherserver; 604: } 605: } 606: } 607: # -------------------------------------------- See if this is a public resource 608: if ($requrl=~m|^/+adm/+help/+|) { 609: return OK; 610: } 611: # ------------------------------------ See if this is a viewable portfolio file 612: if (&Apache::lonnet::is_portfolio_url($requrl)) { 613: my $access=&Apache::lonnet::allowed('bre',$requrl); 614: if ($access eq 'A') { 615: &Apache::restrictedaccess::setup_handler($r); 616: return OK; 617: } 618: if (($access ne '2') && ($access ne 'F')) { 619: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 620: return HTTP_NOT_ACCEPTABLE; 621: } 622: } 623: 624: # -------------------------------------------------------------- Not authorized 625: $requrl=~/\.(\w+)$/; 626: # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') || 627: # ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) || 628: # ($requrl=~m|^/prtspool/|)) { 629: # -------------------------- Store where they wanted to go and get login screen 630: $env{'request.querystring'}=$r->args; 631: $env{'request.firsturl'}=$requrl; 632: return FORBIDDEN; 633: # } else { 634: # --------------------------------------------------------------------- Goodbye 635: # return HTTP_BAD_REQUEST; 636: # } 637: } 638: 639: 1; 640: __END__ 641: 642: =pod 643: 644: =back 645: 646: =cut 647: