';
+ my ($start_page,$js,$pagebody,$end_page);
+ if ($env{'request.lti.login'}) {
+ $args = {'only_body' => 1};
+ if ($env{'request.lti.target'} eq '') {
+ my $ltitarget = (($destination =~ /\?/) ? '&' : '?').
+ 'ltitarget=iframe';
+ $js = <<"ENDJS";
+
+
- my $welcome = &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','','');
+ENDJS
+ $args->{'add_entries'} = {'onload' => "javascript:setLTItarget();"};
+ $pagebody = '';
+ } else {
+ $args->{'redirect'} = [0,$destination,1];
+ }
+ $start_page=&Apache::loncommon::start_page('',$js,$args);
+ } else {
+ $args->{'redirect'} = [0,$destination];
+ $start_page=&Apache::loncommon::start_page('Successful Login',
+ $js,$args);
+
+ my %lt=&Apache::lonlocal::texthash(
+ 'wel' => 'Welcome',
+ 'pro' => 'Login problems?',
+ );
+ $pagebody = "
$lt{'wel'}
\n".
+ &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','','');
+ my $loginhelp = &loginhelpdisplay($domain);
+ if ($loginhelp) {
+ $pagebody .= '
';
+ }
+ }
+ $end_page = &Apache::loncommon::end_page();
$r->print(<$lt{'wel'}
-$welcome
-$loginhelp
-$continuelink
+$pagebody
$end_page
ENDSUCCESS
return;
@@ -213,6 +298,19 @@ sub failed {
$retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb;
}
}
+ if (exists($form->{firsturl})) {
+ my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl});
+ if ($firsturl ne '') {
+ $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl;
+ }
+ }
+ if (exists($form->{linkprot})) {
+ my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}},
+ $r->dir_config('lonHostID'));
+ if ($ltoken) {
+ $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken;
+ }
+ }
my $end_page = &Apache::loncommon::end_page();
&Apache::loncommon::content_type($r,'text/html');
$r->send_http_header;
@@ -312,10 +410,11 @@ sub handler {
# split user logging in and "su"-user
- ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
+ ($form{'uname'},$form{'suname'},$form{'sudom'})=split(/\:/,$form{'uname'});
$form{'uname'} = &LONCAPA::clean_username($form{'uname'});
$form{'suname'}= &LONCAPA::clean_username($form{'suname'});
- $form{'udom'} = &LONCAPA::clean_domain( $form{'udom'});
+ $form{'udom'} = &LONCAPA::clean_domain($form{'udom'});
+ $form{'sudom'} = &LONCAPA::clean_domain($form{'sudom'});
my $role = $r->dir_config('lonRole');
my $domain = $r->dir_config('lonDefDomain');
@@ -346,7 +445,7 @@ sub handler {
return OK;
}
- my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr)=split(/&/,$tmpinfo);
+ my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr,$linkprotstr)=split(/&/,$tmpinfo);
if ($rolestr) {
$rolestr = &unescape($rolestr);
}
@@ -356,6 +455,12 @@ sub handler {
if ($iptokenstr) {
$iptokenstr = &unescape($iptokenstr);
}
+ if ($linkprotstr) {
+ $linkprotstr = &unescape($linkprotstr);
+ }
+ if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) {
+ $form{'firsturl'} = $firsturl;
+ }
if ($rolestr =~ /^role=/) {
(undef,$form{'role'}) = split('=',$rolestr);
}
@@ -365,6 +470,9 @@ sub handler {
if ($iptokenstr =~ /^iptoken=/) {
(undef,$form{'iptoken'}) = split('=',$iptokenstr);
}
+ if ($linkprotstr =~ /^linkprot=/) {
+ (undef,$form{'linkprot'}) = split('=',$linkprotstr);
+ }
my $upass = $ENV{HTTPS} ? $form{'upass0'}
: &Apache::loncommon::des_decrypt($key,$form{'upass0'});
@@ -384,7 +492,7 @@ sub handler {
my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
$form{'udom'},$defaultauth,
$clientcancheckhost);
-
+
# --------------------------------------------------------------------- Failed?
if ($authhost eq 'no_host') {
@@ -440,20 +548,68 @@ sub handler {
# --------------------------------- Are we attempting to login as somebody else?
if ($form{'suname'}) {
+ my ($suname,$sudom,$sudomref);
+ $suname = $form{'suname'};
+ $sudom = $form{'udom'};
+ if ($form{'sudom'}) {
+ unless ($sudom eq $form{'sudom'}) {
+ if (&Apache::lonnet::domain($form{'sudom'})) {
+ $sudomref = [$form{'sudom'}];
+ $sudom = $form{'sudom'};
+ }
+ }
+ }
# ------------ see if the original user has enough privileges to pull this stunt
- if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'})) {
+ if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'},$sudomref)) {
# ---------------------------------------------------- see if the su-user exists
- unless (&Apache::lonnet::homeserver($form{'suname'},$form{'udom'})
- eq 'no_host') {
- &Apache::lonnet::logthis(&Apache::lonnet::homeserver($form{'suname'},$form{'udom'}));
+ unless (&Apache::lonnet::homeserver($suname,$sudom) eq 'no_host') {
# ------------------------------ see if the su-user is not too highly privileged
- unless (&Apache::lonnet::privileged($form{'suname'},$form{'udom'})) {
+ if (&Apache::lonnet::privileged($suname,$sudom)) {
+ &Apache::lonnet::logthis('Attempted switch user to privileged user');
+ } else {
+ my $noprivswitch;
+#
+# su-user's home server and user's home server must have one of:
+# (a) same domain
+# (b) same primary library server for the two domains
+# (c) same "internet domain" for primary library server(s) for home servers' domains
+#
+ my $suprim = &Apache::lonnet::domain($sudom,'primary');
+ my $suintdom = &Apache::lonnet::internet_dom($suprim);
+ unless ($sudom eq $form{'udom'}) {
+ my $uprim = &Apache::lonnet::domain($form{'udom'},'primary');
+ my $uintdom = &Apache::lonnet::internet_dom($uprim);
+ unless ($suprim eq $uprim) {
+ unless ($suintdom eq $uintdom) {
+ &Apache::lonnet::logthis('Attempted switch user '
+ .'to user with different "internet domain".');
+ $noprivswitch = 1;
+ }
+ }
+ }
+
+ unless ($noprivswitch) {
+#
+# server where log-in occurs must have same "internet domain" as su-user's home
+# server
+#
+ my $lonhost = $r->dir_config('lonHostID');
+ my $hostintdom = &Apache::lonnet::internet_dom($lonhost);
+ if ($hostintdom ne $suintdom) {
+ &Apache::lonnet::logthis('Attempted switch user on a '
+ .'server with a different "internet domain".');
+ } else {
+
# -------------------------------------------------------- actually switch users
- &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.$form{'udom'}.
- ' logging in as '.$form{'suname'});
- $form{'uname'}=$form{'suname'};
- } else {
- &Apache::lonnet::logthis('Attempted switch user to privileged user');
+
+ &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.
+ $form{'udom'}.' logging in as '.$suname.':'.$sudom);
+ $form{'uname'}=$suname;
+ if ($form{'udom'} ne $sudom) {
+ $form{'udom'}=$sudom;
+ }
+ }
+ }
}
}
} else {
@@ -489,7 +645,7 @@ sub handler {
\%form);
my $switchto = '/adm/switchserver?otherserver='.$otherserver;
if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
- $switchto .= '&origurl='.$firsturl;
+ $switchto .= '&origurl='.$firsturl; #should escape
}
if ($form{'role'}) {
$switchto .= '&role='.$form{'role'};
@@ -497,6 +653,9 @@ sub handler {
if ($form{'symb'}) {
$switchto .= '&symb='.$form{'symb'};
}
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ }
$r->internal_redirect($switchto);
} else {
$r->print(&noswitch());
@@ -510,7 +669,7 @@ sub handler {
\%form);
my $switchto = '/adm/switchserver?otherserver='.$otherserver;
if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
- $switchto .= '&origurl='.$firsturl;
+ $switchto .= '&origurl='.$firsturl; #should escape
}
if ($form{'role'}) {
$switchto .= '&role='.$form{'role'};
@@ -518,6 +677,9 @@ sub handler {
if ($form{'symb'}) {
$switchto .= '&symb='.$form{'symb'};
}
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ }
$r->internal_redirect($switchto);
} else {
$r->print(&noswitch());
@@ -547,6 +709,9 @@ sub handler {
if ($unloaded) {
&success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',
undef,\%form);
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ }
$r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl);
return OK;
}
@@ -554,7 +719,15 @@ sub handler {
if (($is_balancer) && ($hosthere)) {
$form{'noloadbalance'} = $hosthere;
}
- &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef,
+ my $extra_env;
+ if ($form{'linkprot'}) {
+ my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2);
+ if ($linkprotector) {
+ $extra_env = {'user.linkprotector' => $linkprotector,
+ 'user.linkproturi' => $uri,};
+ }
+ }
+ &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env,
\%form);
return OK;
}
@@ -601,6 +774,7 @@ sub check_can_host {
my $protocol = $Apache::lonnet::protocol{$login_host};
$protocol = 'http' if ($protocol ne 'https');
my $newurl = $protocol.'://'.$hostname.'/adm/createaccount';
+#FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host
$r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA').
'
'.&mt('Account creation').'
'.
&mt('You do not currently have a LON-CAPA account at this institution.').' '.
@@ -617,6 +791,9 @@ sub check_can_host {
} else {
&success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef,
$form);
+ if ($form->{'linkprot'}) {
+ $env{'request.linkprot'} = $form->{'linkprot'};
+ }
my ($otherserver) = &Apache::lonnet::choose_server($udom);
$r->internal_redirect('/adm/switchserver?otherserver='.$otherserver);
}