loncom/auth/lonacc.pm - view

File: [LON-CAPA] / loncom / auth / lonacc.pm
Revision 1.46: download - view: text, annotated - select for diffs
Tue May 13 00:52:46 2003 UTC (21 years ago) by www
Branches: MAIN
CVS tags: version_1_0_3, version_1_0_2, version_1_0_1, version_1_0_0, version_0_99_5, version_0_99_4, version_0_99_3, version_0_99_2, version_0_99_1, version_0_99_0, conference_2003, HEAD

Consolidate functions from access control handlers in order to eventually
add them also to lonuploadedacc.pm - preparation for running uploaded
problems.

1: # The LearningOnline Network 2: # Cookie Based Access Handler 3: # 4: # $Id: lonacc.pm,v 1.46 2003/05/13 00:52:46 www Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: # YEAR=1999 29: # 5/21/99,5/22,5/29,5/31,6/15,16/11,22/11, 30: # YEAR=2000 31: # 01/06,01/13,05/31,06/01,09/06,09/25,09/28,10/30,11/6, 32: # 12/25,12/26, 33: # YEAR=2001 34: # 01/06/01,05/28,8/11,9/26,11/29 Gerd Kortemeyer 35: # YEAR=2002 36: # 1/4,2/25 Gerd Kortemeyer 37: # 38: ### 39: 40: package Apache::lonacc; 41: 42: use strict; 43: use Apache::Constants qw(:common :http :methods); 44: use Apache::File; 45: use Apache::lonnet; 46: use Apache::loncommon(); 47: use CGI::Cookie(); 48: use Fcntl qw(:flock); 49: 50: sub handler { 51: my $r = shift; 52: my $requrl=$r->uri; 53: my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); 54: my $lonid=$cookies{'lonID'}; 55: my $cookie; 56: if ($lonid) { 57: my $handle=$lonid->value; 58: $handle=~s/\W//g; 59: my $lonidsdir=$r->dir_config('lonIDsDir'); 60: if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) { 61: 62: # ------------------------------------------------------ Initialize Environment 63: 64: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); 65: 66: # -------------------------------------------------------------- Resource State 67: 68: if ($requrl=~/^\/res\//) { 69: $ENV{'request.state'} = "published"; 70: } else { 71: $ENV{'request.state'} = 'unknown'; 72: } 73: $ENV{'request.filename'} = $r->filename; 74: 75: # -------------------------------------------------------- Load POST parameters 76: 77: &Apache::loncommon::get_posted_cgi($r); 78: 79: # ---------------------------------------------------------------- Check access 80: 81: if ($requrl!~/^\/adm|public|prtspool\//) { 82: my $access=&Apache::lonnet::allowed('bre',$requrl); 83: if ($access eq '1') { 84: $ENV{'user.error.msg'}="$requrl:bre:0:0:Choose Course"; 85: return HTTP_NOT_ACCEPTABLE; 86: } 87: if (($access ne '2') && ($access ne 'F')) { 88: $ENV{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 89: return HTTP_NOT_ACCEPTABLE; 90: } 91: } 92: if ($requrl =~ m|^/prtspool/|) { 93: my $start='/prtspool/'.$ENV{'user.name'}.'_'. 94: $ENV{'user.domain'}; 95: if ($requrl !~ /^\Q$start\E/) { 96: $ENV{'user.error.msg'}="$requrl:bre:1:1:Access Denied"; 97: return HTTP_NOT_ACCEPTABLE; 98: } 99: } 100: # ------------------------------------------------------------- This is allowed 101: if ($ENV{'request.course.id'}) { 102: &Apache::lonnet::countacc($requrl); 103: $requrl=~/\.(\w+)$/; 104: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') || 105: ($requrl=~/^\/adm\/.*\/(aboutme|navmaps|smppg|bulletinboard)(\?|$)/) || 106: ($requrl=~/^\/adm\/wrapper\//) || 107: ($requrl=~/^\/public\/.*\/syllabus$/)) { 108: # ------------------------------------- This is serious stuff, get symb and log 109: my $query=$r->args; 110: my $symb; 111: if ($query) { 112: &Apache::loncommon::get_unprocessed_cgi($query,['symb']); 113: } 114: if ($ENV{'form.symb'}) { 115: $symb=&Apache::lonnet::symbclean($ENV{'form.symb'}); 116: if (&Apache::lonnet::symbverify($symb,$requrl)) { 117: my ($map,$mid,$murl)=split(/\_\_\_/,$symb); 118: &Apache::lonnet::symblist($map,$murl => $mid, 119: 'last_known' => $murl); 120: } else { 121: $r->log_reason('Invalid symb for '.$requrl.': '. 122: $symb); 123: $ENV{'user.error.msg'}= 124: "$requrl:bre:1:1:Invalid Access"; 125: return HTTP_NOT_ACCEPTABLE; 126: } 127: } else { 128: $symb=&Apache::lonnet::symbread($requrl); 129: my ($map,$mid,$murl)=split(/\_\_\_/,$symb); 130: &Apache::lonnet::symblist($map,$murl => $mid, 131: 'last_known' => $murl); 132: } 133: $ENV{'request.symb'}=$symb; 134: &Apache::lonnet::courseacclog($symb); 135: } else { 136: # ------------------------------------------------------- This is other content 137: &Apache::lonnet::courseacclog($requrl); 138: } 139: } 140: return OK; 141: } else { 142: $r->log_reason("Cookie $handle not valid", $r->filename) 143: }; 144: } 145: 146: # -------------------------------------------- See if this is a public resource 147: if ($requrl=~m|^/public/| 148: || (&Apache::lonnet::metadata($requrl,'copyright') eq 'public')) { 149: &Apache::lonnet::logthis('Granting public access: '.$requrl); 150: my $buffer; 151: $r->read($buffer,$r->header_in('Content-length'),0); 152: &Apache::loncommon::get_unprocessed_cgi($buffer); 153: $ENV{'user.name'}='public'; 154: $ENV{'user.domain'}='public'; 155: $ENV{'request.state'} = "published"; 156: $ENV{'request.publicaccess'} = 1; 157: $ENV{'request.filename'} = $r->filename; 158: return OK; 159: } 160: # -------------------------------------------------------------- Not authorized 161: $requrl=~/\.(\w+)$/; 162: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') || 163: ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) || 164: ($requrl=~m|^/prtspool/|)) { 165: # -------------------------- Store where they wanted to go and get login screen 166: $ENV{'request.querystring'}=$r->args; 167: $ENV{'request.firsturl'}=$requrl; 168: return FORBIDDEN; 169: } else { 170: # --------------------------------------------------------------------- Goodbye 171: return HTTP_BAD_REQUEST; 172: } 173: } 174: 175: 1; 176: __END__ 177: 178: =head1 NAME 179: 180: Apache::lonacc - Cookie Based Access Handler 181: 182: =head1 SYNOPSIS 183: 184: Invoked (for various locations) by /etc/httpd/conf/srm.conf: 185: 186: PerlAccessHandler Apache::lonacc 187: 188: =head1 INTRODUCTION 189: 190: This module enables cookie based authentication and is used 191: to control access for many different LON-CAPA URIs. 192: 193: Whenever the client sends the cookie back to the server, 194: this cookie is handled by either lonacc.pm or loncacc.pm 195: (see srm.conf for what is invoked when). If 196: the cookie is missing or invalid, the user is re-challenged 197: for login information. 198: 199: This is part of the LearningOnline Network with CAPA project 200: described at http://www.lon-capa.org. 201: 202: =head1 HANDLER SUBROUTINE 203: 204: This routine is called by Apache and mod_perl. 205: 206: =over 4 207: 208: =item * 209: 210: transfer profile into environment 211: 212: =item * 213: 214: load POST parameters 215: 216: =item * 217: 218: check access 219: 220: =item * 221: 222: if allowed, get symb, log, generate course statistics if applicable 223: 224: =item * 225: 226: otherwise return error 227: 228: =item * 229: 230: see if public resource 231: 232: =item * 233: 234: store attempted access 235: 236: =back 237: 238: =cut