File:
[LON-CAPA] /
loncom /
auth /
lonacc.pm
Revision
1.175:
download - view:
text,
annotated -
select for diffs
Sun Jan 27 16:02:43 2019 UTC (5 years, 3 months ago) by
raeburn
Branches:
MAIN
CVS tags:
HEAD
- Bug 6400
- Enforce access restrictions for content which is deeplink-only (users
with "advanced priv for current role are exempt).
- Support "key" link type in deeplink parameter (requested link must either
be sent with linkkey as element in POSTed data, or with linkkey in query
string). Corresponding value must match key set in deeplink parameter.
1: # The LearningOnline Network
2: # Cookie Based Access Handler
3: #
4: # $Id: lonacc.pm,v 1.175 2019/01/27 16:02:43 raeburn Exp $
5: #
6: # Copyright Michigan State University Board of Trustees
7: #
8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
9: #
10: # LON-CAPA is free software; you can redistribute it and/or modify
11: # it under the terms of the GNU General Public License as published by
12: # the Free Software Foundation; either version 2 of the License, or
13: # (at your option) any later version.
14: #
15: # LON-CAPA is distributed in the hope that it will be useful,
16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18: # GNU General Public License for more details.
19: #
20: # You should have received a copy of the GNU General Public License
21: # along with LON-CAPA; if not, write to the Free Software
22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23: #
24: # /home/httpd/html/adm/gpl.txt
25: #
26: # http://www.lon-capa.org/
27: #
28: ###
29:
30: =head1 NAME
31:
32: Apache::lonacc - Cookie Based Access Handler
33:
34: =head1 SYNOPSIS
35:
36: Invoked (for various locations) by /etc/httpd/conf/srm.conf:
37:
38: PerlAccessHandler Apache::lonacc
39:
40: =head1 INTRODUCTION
41:
42: This module enables cookie based authentication and is used
43: to control access for many different LON-CAPA URIs.
44:
45: Whenever the client sends the cookie back to the server,
46: this cookie is handled by either lonacc.pm or loncacc.pm
47: (see srm.conf for what is invoked when). If
48: the cookie is missing or invalid, the user is re-challenged
49: for login information.
50:
51: This is part of the LearningOnline Network with CAPA project
52: described at http://www.lon-capa.org.
53:
54: =head1 HANDLER SUBROUTINE
55:
56: This routine is called by Apache and mod_perl.
57:
58: =over 4
59:
60: =item *
61:
62: transfer profile into environment
63:
64: =item *
65:
66: load POST parameters
67:
68: =item *
69:
70: check access
71:
72: =item *
73:
74: if allowed, get symb, log, generate course statistics if applicable
75:
76: =item *
77:
78: otherwise return error
79:
80: =item *
81:
82: see if public resource
83:
84: =item *
85:
86: store attempted access
87:
88: =back
89:
90: =head1 NOTABLE SUBROUTINES
91:
92: =cut
93:
94:
95: package Apache::lonacc;
96:
97: use strict;
98: use Apache::Constants qw(:common :http :methods);
99: use Apache::File;
100: use Apache::lonnet;
101: use Apache::loncommon();
102: use Apache::lonlocal;
103: use Apache::restrictedaccess();
104: use Apache::blockedaccess();
105: use Apache::lonprotected();
106: use Fcntl qw(:flock);
107: use LONCAPA qw(:DEFAULT :match);
108:
109: sub cleanup {
110: my ($r)=@_;
111: if (! $r->is_initial_req()) { return DECLINED; }
112: &Apache::lonnet::save_cache();
113: return OK;
114: }
115:
116: sub goodbye {
117: my ($r)=@_;
118: &Apache::lonnet::goodbye();
119: return DONE;
120: }
121:
122: ###############################################
123:
124: sub get_posted_cgi {
125: my ($r,$fields) = @_;
126:
127: my $buffer;
128: if ($r->header_in('Content-length')) {
129: $r->read($buffer,$r->header_in('Content-length'),0);
130: }
131: my $content_type = $r->header_in('Content-type');
132: if ($content_type !~ m{^multipart/form-data}) {
133: my @pairs=split(/&/,$buffer);
134: my $pair;
135: foreach $pair (@pairs) {
136: my ($name,$value) = split(/=/,$pair);
137: $value =~ tr/+/ /;
138: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
139: $name =~ tr/+/ /;
140: $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
141: if (ref($fields) eq 'ARRAY') {
142: next if (!grep(/^\Q$name\E$/,@{$fields}));
143: }
144: &Apache::loncommon::add_to_env("form.$name",$value);
145: }
146: } else {
147: my ($contentsep) = ($content_type =~ /boundary=\"?([^\";,]+)\"?/);
148: my @lines = split (/\n/,$buffer);
149: my $name='';
150: my $value='';
151: my $fname='';
152: my $fmime='';
153: my $i;
154: for ($i=0;$i<=$#lines;$i++) {
155: if ($lines[$i]=~/^--\Q$contentsep\E/) {
156: if ($name) {
157: chomp($value);
158: if (($r->uri eq '/adm/portfolio') &&
159: ($name eq 'uploaddoc')) {
160: if (length($value) == 1) {
161: $value=~s/[\r\n]$//;
162: }
163: } elsif ($fname =~ /\.(xls|doc|ppt)(x|m)$/i) {
164: $value=~s/[\r\n]$//;
165: }
166: if (ref($fields) eq 'ARRAY') {
167: next if (!grep(/^\Q$name\E$/,@{$fields}));
168: }
169: if ($fname) {
170: if ($env{'form.symb'} ne '') {
171: my $size = (length($value))/(1024.0 * 1024.0);
172: if (&upload_size_allowed($name,$size,$fname) eq 'ok') {
173: $env{"form.$name.filename"}=$fname;
174: $env{"form.$name.mimetype"}=$fmime;
175: &Apache::loncommon::add_to_env("form.$name",$value);
176: }
177: } else {
178: $env{"form.$name.filename"}=$fname;
179: $env{"form.$name.mimetype"}=$fmime;
180: &Apache::loncommon::add_to_env("form.$name",$value);
181: }
182: } else {
183: $value=~s/\s+$//s;
184: &Apache::loncommon::add_to_env("form.$name",$value);
185: }
186: }
187: if ($i<$#lines) {
188: $i++;
189: $lines[$i]=~
190: /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;
191: $name=$1;
192: $value='';
193: if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {
194: $fname=$1;
195: if
196: ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {
197: $fmime=$1;
198: $i++;
199: } else {
200: $fmime='';
201: }
202: } else {
203: $fname='';
204: $fmime='';
205: }
206: if ($i<$#lines && $lines[$i+1]=~/^Content\-Type\:\s*([\w\-\/]+)/i) {
207: # TODO: something with $1 !
208: $i++;
209: }
210: if ($i<$#lines && $lines[$i+1]=~/^Content\-transfer\-encoding\:\s*([\w\-\/]+)/i) {
211: # TODO: something with $1 !
212: $i++;
213: }
214: $i++;
215: }
216: } else {
217: $value.=$lines[$i]."\n";
218: }
219: }
220: }
221: #
222: # Digested POSTed values
223: #
224: # Remember the way this was originally done (GET or POST)
225: #
226: $env{'request.method'}=$ENV{'REQUEST_METHOD'};
227: #
228: # There may also be stuff in the query string
229: # Tell subsequent handlers that this was GET, not POST, so they can access query string.
230: # Also, unset POSTed content length to cover all tracks.
231: #
232:
233: $r->method_number(M_GET);
234:
235: $r->method('GET');
236: $r->headers_in->unset('Content-length');
237: }
238:
239: =pod
240:
241: =over
242:
243: =item upload_size_allowed()
244:
245: Perform size checks for file uploads to essayresponse items in course context.
246:
247: Add form.HWFILESIZE.$part_$id to %env with file size (MB)
248: If file exceeds maximum allowed size, add form.HWFILETOOBIG.$part_$id to %env.
249:
250: =cut
251:
252: sub upload_size_allowed {
253: my ($name,$size,$fname) = @_;
254: if ($name =~ /^HWFILE(\w+)$/) {
255: my $ident = $1;
256: my $item = 'HWFILESIZE'.$ident;
257: my $savesize = sprintf("%.6f",$size);
258: &Apache::loncommon::add_to_env("form.$item",$savesize);
259: my $maxsize= &Apache::lonnet::EXT("resource.$ident.maxfilesize");
260: if (!$maxsize) {
261: $maxsize = 10.0; # FIXME This should become a domain configuration.
262: }
263: if ($size > $maxsize) {
264: my $warn = 'HWFILETOOBIG'.$ident;
265: &Apache::loncommon::add_to_env("form.$warn",$fname);
266: return;
267: }
268: }
269: return 'ok';
270: }
271:
272: =pod
273:
274: =item sso_login()
275:
276: handle the case of the single sign on user, at this point $r->user
277: will be set and valid; now need to find the loncapa user info, and possibly
278: balance them. If $r->user() is set this means either it was either set by
279: SSO or by checkauthen.pm, if a valid cookie was found. The latter case can
280: be identified by the third arg ($usename), except when lonacc is called in
281: an internal redirect to /adm/switchserver (e.g., load-balancing following
282: successful authentication) -- no cookie set yet. For that particular case
283: simply skip the call to sso_login().
284:
285: returns OK if it was SSO and user was handled.
286: returns undef if not SSO or no means to handle the user.
287:
288: =cut
289:
290: sub sso_login {
291: my ($r,$handle,$username) = @_;
292:
293: if (($r->user eq '') || ($username ne '') || ($r->user eq 'public:public') ||
294: (defined($env{'user.name'}) && (defined($env{'user.domain'}))
295: && ($handle ne ''))) {
296: # not an SSO case or already logged in
297: return undef;
298: }
299:
300: my ($user) = ($r->user =~ m/^($match_username)$/);
301: if ($user eq '') {
302: return undef;
303: }
304:
305: my $query = $r->args;
306: my %form;
307: if ($query) {
308: my @items = ('role','symb','iptoken');
309: &Apache::loncommon::get_unprocessed_cgi($query,\@items);
310: foreach my $item (@items) {
311: if (defined($env{'form.'.$item})) {
312: $form{$item} = $env{'form.'.$item};
313: }
314: }
315: }
316:
317: my %sessiondata;
318: if ($form{'iptoken'}) {
319: %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'});
320: my $delete = &Apache::lonnet::tmpdel($form{'iptoken'});
321: unless ($sessiondata{'sessionserver'}) {
322: delete($form{'iptoken'});
323: }
324: }
325:
326: my $domain = $r->dir_config('lonSSOUserDomain');
327: if ($domain eq '') {
328: $domain = $r->dir_config('lonDefDomain');
329: }
330: my $home=&Apache::lonnet::homeserver($user,$domain);
331: if ($home !~ /(con_lost|no_host|no_such_host)/) {
332: &Apache::lonnet::logthis(" SSO authorized user $user ");
333: my ($is_balancer,$otherserver,$hosthere);
334: if ($form{'iptoken'}) {
335: if (($sessiondata{'domain'} eq $domain) &&
336: ($sessiondata{'username'} eq $user)) {
337: $hosthere = 1;
338: }
339: }
340: unless ($hosthere) {
341: ($is_balancer,$otherserver) =
342: &Apache::lonnet::check_loadbalancing($user,$domain,'login');
343: if ($is_balancer) {
344: # Check if browser sent a LON-CAPA load balancer cookie (and this is a balancer)
345: my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r);
346: if (($found_server) && ($balancer_cookie =~ /^\Q$domain\E_\Q$user\E_/)) {
347: $otherserver = $found_server;
348: } elsif ($otherserver eq '') {
349: my $lowest_load;
350: ($otherserver,undef,undef,undef,$lowest_load) = &Apache::lonnet::choose_server($domain);
351: if ($lowest_load > 100) {
352: $otherserver = &Apache::lonnet::spareserver($lowest_load,$lowest_load,1,$domain);
353: }
354: if ($otherserver ne '') {
355: my @hosts = &Apache::lonnet::current_machine_ids();
356: if (grep(/^\Q$otherserver\E$/,@hosts)) {
357: $hosthere = $otherserver;
358: }
359: }
360: }
361: }
362: }
363: if (($is_balancer) && (!$hosthere)) {
364: # login but immediately go to switch server to find us a new
365: # machine
366: &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
367: foreach my $item (keys(%form)) {
368: $env{'form.'.$item} = $form{$item};
369: }
370: unless ($form{'symb'}) {
371: unless (($r->uri eq '/adm/roles') || ($r->uri eq '/adm/sso')) {
372: $env{'form.origurl'} = $r->uri;
373: }
374: }
375: $env{'request.sso.login'} = 1;
376: if (defined($r->dir_config("lonSSOReloginServer"))) {
377: $env{'request.sso.reloginserver'} =
378: $r->dir_config('lonSSOReloginServer');
379: }
380: my $redirecturl = '/adm/switchserver';
381: if ($otherserver ne '') {
382: $redirecturl .= '?otherserver='.$otherserver;
383: }
384: $r->internal_redirect($redirecturl);
385: $r->set_handlers('PerlHandler'=> undef);
386: } else {
387: # need to login them in, so generate the need data that
388: # migrate expects to do login
389: my $ip = $r->get_remote_host();
390: my %info=('ip' => $ip,
391: 'domain' => $domain,
392: 'username' => $user,
393: 'server' => $r->dir_config('lonHostID'),
394: 'sso.login' => 1
395: );
396: foreach my $item ('role','symb','iptoken') {
397: if (exists($form{$item})) {
398: $info{$item} = $form{$item};
399: }
400: }
401: unless ($info{'symb'}) {
402: unless (($r->uri eq '/adm/roles') || ($r->uri eq '/adm/sso')) {
403: $info{'origurl'} = $r->uri;
404: }
405: }
406: if ($r->dir_config("ssodirecturl") == 1) {
407: $info{'origurl'} = $r->uri;
408: }
409: if (defined($r->dir_config("lonSSOReloginServer"))) {
410: $info{'sso.reloginserver'} =
411: $r->dir_config('lonSSOReloginServer');
412: }
413: if (($is_balancer) && ($hosthere)) {
414: $info{'noloadbalance'} = $hosthere;
415: }
416: my $token =
417: &Apache::lonnet::tmpput(\%info,
418: $r->dir_config('lonHostID'));
419: $env{'form.token'} = $token;
420: $r->internal_redirect('/adm/migrateuser');
421: $r->set_handlers('PerlHandler'=> undef);
422: }
423: return OK;
424: } else {
425: &Apache::lonnet::logthis(" SSO authorized unknown user $user ");
426: my @cancreate;
427: my %domconfig =
428: &Apache::lonnet::get_dom('configuration',['usercreation'],$domain);
429: if (ref($domconfig{'usercreation'}) eq 'HASH') {
430: if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
431: if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
432: @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
433: } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') &&
434: ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
435: @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
436: }
437: }
438: }
439: if ((grep(/^sso$/,@cancreate)) || (defined($r->dir_config('lonSSOUserUnknownRedirect')))) {
440: $r->subprocess_env->set('SSOUserUnknown' => $user);
441: $r->subprocess_env->set('SSOUserDomain' => $domain);
442: if (grep(/^sso$/,@cancreate)) {
443: $r->set_handlers('PerlHandler'=> [\&Apache::createaccount::handler]);
444: $r->handler('perl-script');
445: } else {
446: $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect'));
447: $r->set_handlers('PerlHandler'=> undef);
448: }
449: return OK;
450: }
451: }
452: return undef;
453: }
454:
455: sub handler {
456: my $r = shift;
457: my $requrl=$r->uri;
458:
459: if ($requrl =~ m{^/res/adm/pages/[^/]+\.(gif|png)$}) {
460: return OK;
461: }
462:
463: if (&Apache::lonnet::is_domainimage($requrl)) {
464: return OK;
465: }
466:
467: my %user;
468: my $handle = &Apache::lonnet::check_for_valid_session($r,undef,\%user);
469:
470: unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) {
471: my $result = &sso_login($r,$handle,$user{'name'});
472: if (defined($result)) {
473: return $result;
474: }
475: }
476:
477: my ($is_balancer,$otherserver);
478:
479: if ($handle eq '') {
480: unless ((($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) ||
481: ($requrl =~ m{^/public/$match_domain/$match_courseid/syllabus}) ||
482: ($requrl =~ m{^/adm/help/}) ||
483: ($requrl =~ m{^/res/$match_domain/$match_username/})) {
484: $r->log_reason("Cookie not valid", $r->filename);
485: }
486: } elsif ($handle ne '') {
487:
488: # ------------------------------------------------------ Initialize Environment
489: my $lonidsdir=$r->dir_config('lonIDsDir');
490: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
491:
492: # --------------------------------------------------------- Initialize Language
493:
494: &Apache::lonlocal::get_language_handle($r);
495:
496: }
497:
498: # -------------------------------------------------- Should be a valid user now
499: if ($env{'user.name'} ne '' && $env{'user.domain'} ne '') {
500: # -------------------------------------------------------------- Resource State
501:
502: my ($cdom,$cnum);
503: if ($env{'request.course.id'}) {
504: $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
505: $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
506: }
507: if ($requrl=~/^\/+(res|uploaded)\//) {
508: $env{'request.state'} = "published";
509: } else {
510: $env{'request.state'} = 'unknown';
511: }
512: $env{'request.filename'} = $r->filename;
513: $env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
514: my ($suppext,$checkabsolute);
515: if ($requrl =~ m{^/adm/wrapper/ext/}) {
516: my $query = $r->args;
517: if ($query) {
518: my $preserved;
519: foreach my $pair (split(/&/,$query)) {
520: my ($name, $value) = split(/=/,$pair);
521: unless (($name eq 'symb') || ($name eq 'usehttp')) {
522: $preserved .= $pair.'&';
523: }
524: if (($env{'request.course.id'}) && ($name eq 'folderpath')) {
525: if ($value =~ /^supplemental/) {
526: $suppext = 1;
527: }
528: }
529: }
530: $preserved =~ s/\&$//;
531: if ($preserved) {
532: $env{'request.external.querystring'} = $preserved;
533: }
534: }
535: if ($env{'request.course.id'}) {
536: $checkabsolute = 1;
537: }
538: } elsif ($env{'request.course.id'} &&
539: (($requrl =~ m{^/adm/$match_domain/$match_username/aboutme$}) ||
540: ($requrl eq "/public/$cdom/$cnum/syllabus") ||
541: ($requrl =~ m{^/adm/$cdom/$cnum/\d+/ext\.tool$}))) {
542: my $query = $r->args;
543: if ($query) {
544: foreach my $pair (split(/&/,$query)) {
545: my ($name, $value) = split(/=/,$pair);
546: if ($name eq 'folderpath') {
547: if ($value =~ /^supplemental/) {
548: $suppext = 1;
549: }
550: }
551: }
552: }
553: if ($requrl =~ m{^/public/$cdom/$cnum/syllabus$}) {
554: $checkabsolute = 1;
555: }
556: }
557: if ($checkabsolute) {
558: my $hostname = $r->hostname();
559: my $lonhost = &Apache::lonnet::host_from_dns($hostname);
560: if ($lonhost) {
561: my $actual = &Apache::lonnet::absolute_url($hostname);
562: my $exphostname = &Apache::lonnet::hostname($lonhost);
563: my $expected = $Apache::lonnet::protocol{$lonhost}.'://'.$hostname;
564: unless ($actual eq $expected) {
565: $env{'request.use_absolute'} = $expected;
566: }
567: }
568: }
569: # -------------------------------------------------------- Load POST parameters
570:
571: &Apache::lonacc::get_posted_cgi($r);
572:
573: # ------------------------------------------------------ Check if load balancer
574:
575: my $checkexempt;
576: if ($env{'user.loadbalexempt'} eq $r->dir_config('lonHostID')) {
577: if ($env{'user.loadbalcheck.time'} + 600 > time) {
578: $checkexempt = 1;
579: }
580: }
581: if ($env{'user.noloadbalance'} eq $r->dir_config('lonHostID')) {
582: $checkexempt = 1;
583: }
584: unless ($checkexempt) {
585: ($is_balancer,$otherserver) =
586: &Apache::lonnet::check_loadbalancing($env{'user.name'},
587: $env{'user.domain'});
588: if ($is_balancer) {
589: unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) {
590: # Check if browser sent a LON-CAPA load balancer cookie (and this is a balancer)
591: my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r);
592: if (($found_server) && ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) {
593: $otherserver = $found_server;
594: }
595: }
596: }
597: }
598: if ($is_balancer) {
599: unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) {
600: $r->set_handlers('PerlResponseHandler'=>
601: [\&Apache::switchserver::handler]);
602: if ($otherserver ne '') {
603: $env{'form.otherserver'} = $otherserver;
604: }
605: }
606: unless (($env{'form.origurl'}) || ($r->uri eq '/adm/roles') ||
607: ($r->uri eq '/adm/switchserver') || ($r->uri eq '/adm/sso')) {
608: $env{'form.origurl'} = $r->uri;
609: }
610: }
611: if ($requrl=~m{^/+tiny/+$match_domain/+\w+$}) {
612: return OK;
613: }
614: # ---------------------------------------------------------------- Check access
615: my $now = time;
616: if ($requrl !~ m{^/(?:adm|public|prtspool)/}
617: || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
618: my $access=&Apache::lonnet::allowed('bre',$requrl);
619: if ($handle eq '') {
620: unless ($access eq 'F') {
621: if ($requrl =~ m{^/res/$match_domain/$match_username/}) {
622: $r->log_reason("Cookie not valid", $r->filename);
623: }
624: }
625: }
626: if ($access eq '1') {
627: $env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
628: return HTTP_NOT_ACCEPTABLE;
629: }
630: if ($access eq 'A') {
631: &Apache::restrictedaccess::setup_handler($r);
632: return OK;
633: }
634: if ($access eq 'B') {
635: &Apache::blockedaccess::setup_handler($r);
636: return OK;
637: }
638: if ($access eq 'D') {
639: &Apache::lonprotected::setup_handler($r);
640: return OK;
641: }
642: if (($access ne '2') && ($access ne 'F')) {
643: if ($requrl =~ m{^/res/}) {
644: $access = &Apache::lonnet::allowed('bro',$requrl);
645: if ($access ne 'F') {
646: if ($requrl eq '/res/lib/templates/simpleproblem.problem/smpedit') {
647: $access = &Apache::lonnet::allowed('bre','/res/lib/templates/simpleproblem.problem');
648: if ($access ne 'F') {
649: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
650: return HTTP_NOT_ACCEPTABLE;
651: }
652: } else {
653: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
654: return HTTP_NOT_ACCEPTABLE;
655: }
656: }
657: } elsif (($handle =~ /^publicuser_\d+$/) && (&Apache::lonnet::is_portfolio_url($requrl))) {
658: my $clientip = $r->get_remote_host();
659: if (&Apache::lonnet::allowed('bre',$requrl,undef,undef,$clientip) ne 'F') {
660: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
661: return HTTP_NOT_ACCEPTABLE;
662: }
663: } else {
664: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
665: return HTTP_NOT_ACCEPTABLE;
666: }
667: }
668: }
669: if ($requrl =~ m|^/prtspool/|) {
670: my $start='/prtspool/'.$env{'user.name'}.'_'.
671: $env{'user.domain'};
672: if ($requrl !~ /^\Q$start\E/) {
673: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
674: return HTTP_NOT_ACCEPTABLE;
675: }
676: }
677: if ($requrl =~ m|^/zipspool/|) {
678: my $start='/zipspool/zipout/'.$env{'user.name'}.":".
679: $env{'user.domain'};
680: if ($requrl !~ /^\Q$start\E/) {
681: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
682: return HTTP_NOT_ACCEPTABLE;
683: }
684: }
685: if ($env{'user.name'} eq 'public' &&
686: $env{'user.domain'} eq 'public' &&
687: $requrl !~ m{^/+(res|public|uploaded)/} &&
688: $requrl !~ m{^/adm/[^/]+/[^/]+/aboutme/portfolio$ }x &&
689: $requrl !~ m{^/adm/blockingstatus/.*$} &&
690: $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) {
691: $env{'request.querystring'}=$r->args;
692: $env{'request.firsturl'}=$requrl;
693: return FORBIDDEN;
694: }
695: # ------------------------------------------------------------- This is allowed
696: if ($env{'request.course.id'}) {
697: &Apache::lonnet::countacc($requrl);
698: $requrl=~/\.(\w+)$/;
699: my $query=$r->args;
700: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
701: ($requrl=~/^\/adm\/.*\/(aboutme|smppg|bulletinboard)(\?|$ )/x) ||
702: ($requrl=~/^\/adm\/wrapper\//) ||
703: ($requrl=~m|^/adm/coursedocs/showdoc/|) ||
704: ($requrl=~m|\.problem/smpedit$|) ||
705: ($requrl=~/^\/public\/.*\/syllabus$/) ||
706: ($requrl=~/^\/adm\/(viewclasslist|navmaps)$/) ||
707: ($requrl=~/^\/adm\/.*\/aboutme\/portfolio(\?|$)/) ||
708: ($requrl=~m{^/adm/$cdom/$cnum/\d+/ext\.tool$})) {
709: # ------------------------------------- This is serious stuff, get symb and log
710: my $symb;
711: if ($query) {
712: &Apache::loncommon::get_unprocessed_cgi($query,['symb','folderpath']);
713: }
714: if ($env{'form.symb'}) {
715: $symb=&Apache::lonnet::symbclean($env{'form.symb'});
716: if ($requrl =~ m|^/adm/wrapper/|
717: || $requrl =~ m|^/adm/coursedocs/showdoc/|) {
718: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
719: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
720: 'last_known' =>[$murl,$mid]);
721: } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) ||
722: (($requrl=~m|(.*)/smpedit$|) &&
723: &Apache::lonnet::symbverify($symb,$1)) ||
724: (($requrl=~m|(.*/aboutme)/portfolio$|) &&
725: &Apache::lonnet::symbverify($symb,$1))) {
726: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
727: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
728: 'last_known' =>[$murl,$mid]);
729: } else {
730: $r->log_reason('Invalid symb for '.$requrl.': '.
731: $symb);
732: $env{'user.error.msg'}=
733: "$requrl:bre:1:1:Invalid Access";
734: return HTTP_NOT_ACCEPTABLE;
735: }
736: } else {
737: if ($requrl=~m{^(/adm/.*/aboutme)/portfolio$}) {
738: $requrl = $1;
739: }
740: unless ($suppext) {
741: $symb=&Apache::lonnet::symbread($requrl);
742: if (&Apache::lonnet::is_on_map($requrl) && $symb &&
743: !&Apache::lonnet::symbverify($symb,$requrl)) {
744: $r->log_reason('Invalid symb for '.$requrl.': '.$symb);
745: $env{'user.error.msg'}=
746: "$requrl:bre:1:1:Invalid Access";
747: return HTTP_NOT_ACCEPTABLE;
748: }
749: if ($symb) {
750: my ($map,$mid,$murl)=
751: &Apache::lonnet::decode_symb($symb);
752: &Apache::lonnet::symblist($map,$murl =>[$murl,$mid],
753: 'last_known' =>[$murl,$mid]);
754: }
755: }
756: }
757: $env{'request.symb'}=$symb;
758: &Apache::lonnet::courseacclog($symb);
759: } else {
760: # ------------------------------------------------------- This is other content
761: &Apache::lonnet::courseacclog($requrl);
762: }
763: if ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/(docs|supplemental)/.+\.html?$}) {
764: if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) {
765: if ($query) {
766: &Apache::loncommon::get_unprocessed_cgi($query,['forceedit']);
767: if ($env{'form.forceedit'}) {
768: $env{'request.state'} = 'edit';
769: }
770: }
771: }
772: } elsif ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/portfolio/syllabus/.+\.html?$}) {
773: if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) {
774: if ($query) {
775: &Apache::loncommon::get_unprocessed_cgi($query,['forceedit','editmode']);
776: if (($env{'form.forceedit'}) || ($env{'form.editmode'})) {
777: $env{'request.state'} = 'edit';
778: }
779: }
780: }
781: }
782: }
783: return OK;
784: } else {
785: my $defdom=$r->dir_config('lonDefDomain');
786: ($is_balancer,$otherserver) =
787: &Apache::lonnet::check_loadbalancing(undef,$defdom);
788: if ($is_balancer) {
789: $r->set_handlers('PerlResponseHandler'=>
790: [\&Apache::switchserver::handler]);
791: if ($otherserver ne '') {
792: $env{'form.otherserver'} = $otherserver;
793: }
794: }
795: }
796: # -------------------------------------------- See if this is a public resource
797: if ($requrl=~m|^/+adm/+help/+|) {
798: return OK;
799: }
800: # ------------------------------------ See if this is a viewable portfolio file
801: if (&Apache::lonnet::is_portfolio_url($requrl)) {
802: my $clientip = $r->get_remote_host();
803: my $access=&Apache::lonnet::allowed('bre',$requrl,undef,undef,$clientip);
804: if ($access eq 'A') {
805: &Apache::restrictedaccess::setup_handler($r);
806: return OK;
807: }
808: if (($access ne '2') && ($access ne 'F')) {
809: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
810: return HTTP_NOT_ACCEPTABLE;
811: }
812: }
813:
814: # -------------------------------------------------------------- Not authorized
815: $requrl=~/\.(\w+)$/;
816: # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
817: # ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) ||
818: # ($requrl=~m|^/prtspool/|)) {
819: # -------------------------- Store where they wanted to go and get login screen
820: $env{'request.querystring'}=$r->args;
821: $env{'request.firsturl'}=$requrl;
822: return FORBIDDEN;
823: # } else {
824: # --------------------------------------------------------------------- Goodbye
825: # return HTTP_BAD_REQUEST;
826: # }
827: }
828:
829: 1;
830: __END__
831:
832: =pod
833:
834: =back
835:
836: =cut
837:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to lonacc.pm CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [LON-CAPA] / loncom / auth