--- loncom/auth/lonauth.pm 2020/03/15 23:04:10 1.159 +++ loncom/auth/lonauth.pm 2022/02/27 01:43:13 1.172 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.159 2020/03/15 23:04:10 raeburn Exp $ +# $Id: lonauth.pm,v 1.172 2022/02/27 01:43:13 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -42,11 +42,12 @@ use Apache::lonlocal; use Apache::File(); use HTML::Entities; use Digest::MD5; +use CGI::Cookie(); # ------------------------------------------------------------ Successful login sub success { my ($r, $username, $domain, $authhost, $lowerurl, $extra_env, - $form,$skipcritical,$cid) = @_; + $form,$skipcritical,$cid,$expirepub) = @_; # ------------------------------------------------------------ Get cookie ready my $cookie = @@ -60,8 +61,9 @@ sub success { # -------------------------------------------------------------------- Log this + my $ip = &Apache::lonnet::get_requestor_ip(); &Apache::lonnet::log($domain,$username,$authhost, - "Login $ENV{'REMOTE_ADDR'}"); + "Login $ip"); # ------------------------------------------------- Check for critical messages @@ -177,6 +179,22 @@ sub success { $destination .= 'source=login'; } + if (($env{'request.deeplink.login'} eq $lowerurl) && + (($env{'request.linkprot'}) || ($env{'request.linkkey'} ne ''))) { + my %info; + if ($env{'request.linkprot'}) { + $info{'linkprot'} = $env{'request.linkprot'}; + } elsif ($env{'request.linkkey'} ne '') { + $info{'linkkey'} = $env{'request.linkkey'}; + } + $info{'origurl'} = $lowerurl; + my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); + unless (($token eq 'con_lost') || ($token eq 'refused') || + ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { + $destination .= (($destination =~ /\?/) ? '&' : '?') . 'ttoken='.$token; + } + } + my $windowname = 'loncapaclient'; if ($env{'request.lti.login'}) { $windowname .= 'lti'; @@ -216,6 +234,12 @@ sub success { if ($defaultcookie) { $r->headers_out->add('Set-cookie' => $defaultcookie); } + if ($expirepub) { + my $c = new CGI::Cookie(-name => 'lonPubID', + -value => '', + -expires => '-10y',); + $r->headers_out->add('Set-cookie' => $c); + } $r->send_http_header; my ($start_page,$js,$pagebody,$end_page); @@ -276,7 +300,7 @@ ENDSUCCESS # --------------------------------------------------------------- Failed login! sub failed { - my ($r,$message,$form) = @_; + my ($r,$message,$form,$authhost) = @_; (undef,undef,undef,my $clientmathml,my $clientunicode) = &Apache::loncommon::decode_user_agent(); my $args = {}; @@ -284,66 +308,88 @@ sub failed { $args = {'browser.unicode' => 1}; } + my @actions; my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,$args); my $uname = &Apache::loncommon::cleanup_html($form->{'uname'}); my $udom = &Apache::loncommon::cleanup_html($form->{'udom'}); if (&Apache::lonnet::domain($udom,'description') eq '') { undef($udom); } + my $authtype; + if (($udom ne '') && ($uname ne '') && ($authhost eq 'no_host')) { + $authtype = &Apache::lonnet::queryauthenticate($uname,$udom); + } my $retry = '/adm/login'; - if ($uname eq $form->{'uname'}) { + if (($uname eq $form->{'uname'}) && ($authtype !~ /^lti:/)) { $retry .= '?username='.$uname; } if ($udom) { $retry .= (($retry=~/\?/)?'&':'?').'domain='.$udom; } - if (exists($form->{role})) { - my $role = &Apache::loncommon::cleanup_html($form->{role}); - if ($role ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'role='.$role; - } - } - if (exists($form->{symb})) { - my $symb = &Apache::loncommon::cleanup_html($form->{symb}); - if ($symb ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb; - } - } - if (exists($form->{firsturl})) { - my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); - if ($firsturl ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; - if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) { - unless (exists($form->{linkprot})) { - if (exists($form->{linkkey})) { - $retry .= 'linkkey='.$form->{linkkey}; + my $lonhost = $r->dir_config('lonHostID'); + my $querystr; + my $result = &set_retry_token($form,$lonhost,\$querystr); + if ($result eq 'fail') { + if (exists($form->{role})) { + my $role = &Apache::loncommon::cleanup_html($form->{role}); + if ($role ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'role='.$role; + } + } + if (exists($form->{symb})) { + my $symb = &Apache::loncommon::cleanup_html($form->{symb}); + if ($symb ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb; + } + } + if (exists($form->{firsturl})) { + my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); + if ($firsturl ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; + if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { + unless (exists($form->{linkprot})) { + if (exists($form->{linkkey})) { + $retry .= 'linkkey='.$form->{linkkey}; + } } } } } - } - if (exists($form->{linkprot})) { - my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}}, - $r->dir_config('lonHostID')); - if ($ltoken) { - $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken; + if (exists($form->{linkprot})) { + my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}}, + $r->dir_config('lonHostID'),'retry'); + if ($ltoken) { + $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken; + } } + } elsif ($querystr ne '') { + $retry .= (($retry=~/\?/)?'&':'?').$querystr; } my $end_page = &Apache::loncommon::end_page(); &Apache::loncommon::content_type($r,'text/html'); $r->send_http_header; - my @actions = - (&mt('Please [_1]log in again[_2].','','')); + if ($authtype =~ /^lti:/) { + $message = &mt('Direct login is not supported with the username you entered.'). + '

'. + &mt('You likely need to launch LON-CAPA from within a course in a different Learning Management System.'). + '
'. + &mt('You can also try to log in with a different username.'); + @actions = + (&mt('Try your [_1]log in again[_2].','','')); + } else { + $message = &mt($message); + @actions = + (&mt('Please [_1]log in again[_2].','','')); + } my $loginhelp = &loginhelpdisplay($udom); if ($loginhelp) { push(@actions, ''.&mt('Login problems?').''); } #FIXME: link to helpdesk might be added here - $r->print( $start_page .'

'.&mt('Sorry ...').'

' - .&Apache::lonhtmlcommon::confirm_success(&mt($message),1).'

' + .&Apache::lonhtmlcommon::confirm_success($message,1).'

' .&Apache::lonhtmlcommon::actionbox(\@actions) .$end_page ); @@ -385,24 +431,76 @@ sub handler { &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); &Apache::loncommon::content_type($r,'text/html'); $r->send_http_header; - my $start_page = + my $start_page = &Apache::loncommon::start_page('Already logged in'); my $end_page = &Apache::loncommon::end_page(); my $dest = '/adm/roles'; - if ($env{'form.firsturl'} ne '') { - $dest = $env{'form.firsturl'}; - if ($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - &Apache::lonnet::appenv({'request.deeplink.login' => $env{'form.firsturl'}}); + my %form = &get_form_items($r); + if ($form{'logtoken'}) { + my $tmpinfo = &Apache::lonnet::reply('tmpget:'.$form{'logtoken'}, + $form{'serverid'}); + unless (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost') || + ($tmpinfo eq 'no_such_host')) { + my ($des_key,$firsturl,@rest)=split(/&/,$tmpinfo); + $firsturl = &unescape($firsturl); + my %info; + foreach my $item (@rest) { + my ($key,$value) = split(/=/,$item); + $info{$key} = &unescape($value); + } + if ($firsturl ne '') { + $info{'firsturl'} = $firsturl; + $dest = $firsturl; + my $relogin; + if ($dest =~ m{^/tiny/$match_domain/\w+$}) { + if ($env{'request.course.id'}) { + my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'}; + my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'}; + my $symb = &Apache::loncommon::symb_from_tinyurl($dest,$cnum,$cdom); + if ($symb) { + unless (&set_deeplink_login(%info) eq 'ok') { + $relogin = 1; + } + } + } + if ($relogin) { + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please [_1]log out[_2] first, and then try your access again', + '','') + .'

' + .$end_page); + } else { + if (($info{'linkprot'}) || ($info{'linkkey'} ne '')) { + my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); + unless (($token eq 'con_lost') || ($token eq 'refused') || + ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { + $dest .= (($dest =~ /\?/) ? '&' : '?') . 'ttoken='.$token; + } + } + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4] first, and then try your access again', + '','', + '','') + .'

' + .$end_page); + } + return OK; + } + } } } $r->print( - $start_page - .'

'.&mt('You are already logged in!').'

' - .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].' - ,'','','','') - .'

' - .$end_page + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].' + ,'','','','') + .'

' + .$end_page ); return OK; } @@ -410,19 +508,7 @@ sub handler { # ---------------------------------------------------- No valid token, continue - - my $buffer; - if ($r->header_in('Content-length') > 0) { - $r->read($buffer,$r->header_in('Content-length'),0); - } - my %form; - foreach my $pair (split(/&/,$buffer)) { - my ($name,$value) = split(/=/,$pair); - $value =~ tr/+/ /; - $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; - $form{$name}=$value; - } - + my %form = &get_form_items($r); if ((!$form{'uname'}) || (!$form{'upass0'}) || (!$form{'udom'})) { &failed($r,'Username, password and domain need to be specified.', \%form); @@ -466,39 +552,17 @@ sub handler { return OK; } - my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr,$linkstr)=split(/&/,$tmpinfo); - if ($rolestr) { - $rolestr = &unescape($rolestr); - } - if ($symbstr) { - $symbstr= &unescape($symbstr); - } - if ($iptokenstr) { - $iptokenstr = &unescape($iptokenstr); - } - if ($linkstr) { - $linkstr = &unescape($linkstr); + my ($des_key,$firsturl,@rest)=split(/&/,$tmpinfo); + $firsturl = &unescape($firsturl); + foreach my $item (@rest) { + my ($key,$value) = split(/=/,$item); + $form{$key} = &unescape($value); } if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) { $form{'firsturl'} = $firsturl; } - if ($rolestr =~ /^role=/) { - (undef,$form{'role'}) = split('=',$rolestr); - } - if ($symbstr =~ /^symb=/) { - (undef,$form{'symb'}) = split('=',$symbstr); - } - if ($iptokenstr =~ /^iptoken=/) { - (undef,$form{'iptoken'}) = split('=',$iptokenstr); - } - if ($linkstr =~ /^linkprot=/) { - (undef,$form{'linkprot'}) = split('=',$linkstr); - } elsif ($linkstr =~ /^linkkey=/) { - (undef,$form{'linkkey'}) = split('=',$linkstr); - } - my $upass = $ENV{HTTPS} ? $form{'upass0'} - : &Apache::loncommon::des_decrypt($key,$form{'upass0'}); + : &Apache::loncommon::des_decrypt($des_key,$form{'upass0'}); # ---------------------------------------------------------------- Authenticate @@ -519,9 +583,33 @@ sub handler { # --------------------------------------------------------------------- Failed? if ($authhost eq 'no_host') { - &failed($r,'Username and/or password could not be authenticated.', - \%form); - return OK; + my $pwdverify; + if (&Apache::lonnet::homeserver($form{'uname'},$form{'udom'}) eq 'no_host') { + my %possunames = &alternate_unames_check($form{'uname'},$form{'udom'}); + if (keys(%possunames) > 0) { + foreach my $rulematch (keys(%possunames)) { + my $possuname = $possunames{$rulematch}; + if (($possuname ne '') && ($possuname =~ /^$match_username$/)) { + $authhost=Apache::lonnet::authenticate($possuname,$upass, + $form{'udom'},undef, + $clientcancheckhost); + if (($authhost eq 'no_host') || ($authhost eq 'no_account_on_host')) { + next; + } elsif (($authhost ne '') && (&Apache::lonnet::hostname($authhost) ne '')) { + $pwdverify = 1; + &Apache::lonnet::logthis("Authenticated user: $possuname was submitted as: $form{'uname'}"); + $form{'uname'} = $possuname; + last; + } + } + } + } + } + unless ($pwdverify) { + &failed($r,'Username and/or password could not be authenticated.', + \%form,$authhost); + return OK; + } } elsif ($authhost eq 'no_account_on_host') { if ($defaultauth) { my $domdesc = &Apache::lonnet::domain($form{'udom'},'description'); @@ -529,7 +617,8 @@ sub handler { return OK; } my $start_page = - &Apache::loncommon::start_page('Create a user account in LON-CAPA'); + &Apache::loncommon::start_page('Create a user account in LON-CAPA', + '',{'no_inline_link' => 1,}); my $lonhost = $r->dir_config('lonHostID'); my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'}; my $contacts = @@ -559,9 +648,9 @@ sub handler { $firsturl='/adm/roles'; } - my $hosthere; + my ($hosthere,%sessiondata); if ($form{'iptoken'}) { - my %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'}); + %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'}); my $delete = &Apache::lonnet::tmpdel($form{'iptoken'}); if (($sessiondata{'domain'} eq $form{'udom'}) && ($sessiondata{'username'} eq $form{'uname'})) { @@ -605,7 +694,7 @@ sub handler { unless ($suprim eq $uprim) { unless ($suintdom eq $uintdom) { &Apache::lonnet::logthis('Attempted switch user ' - .'to user with different "internet domain".'); + .'to user with different "internet domain".'); $noprivswitch = 1; } } @@ -646,11 +735,16 @@ sub handler { ($is_balancer,$otherserver) = &Apache::lonnet::check_loadbalancing($form{'uname'},$form{'udom'},'login'); if ($is_balancer) { + # Check if browser sent a LON-CAPA load balancer cookie (and this is a balancer) + my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r); + if (($found_server) && ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) { + $otherserver = $found_server; + } if ($otherserver eq '') { my $lowest_load; ($otherserver,undef,undef,undef,$lowest_load) = &Apache::lonnet::choose_server($form{'udom'}); if ($lowest_load > 100) { - $otherserver = &Apache::lonnet::spareserver($lowest_load,$lowest_load,1,$form{'udom'}); + $otherserver = &Apache::lonnet::spareserver($r,$lowest_load,$lowest_load,1,$form{'udom'}); } } if ($otherserver ne '') { @@ -668,7 +762,7 @@ sub handler { \%form); my $switchto = '/adm/switchserver?otherserver='.$otherserver; if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) { - $switchto .= '&origurl='.$firsturl; #should escape + $switchto .= '&origurl='.$firsturl; } if ($form{'role'}) { $switchto .= '&role='.$form{'role'}; @@ -678,14 +772,16 @@ sub handler { } if ($form{'linkprot'}) { $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form{'linkkey'}) { - $env{'request.linkkey'} = $form{'linkkey'}; - } - $env{'request.deeplink.login'} = $form{'firsturl'}; + } elsif ($form{'linkkey'} ne '') { + $env{'request.linkkey'} = $form{'linkkey'}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); } $r->internal_redirect($switchto); } else { + &Apache::loncommon::content_type($r,'text/html'); + $r->send_http_header; $r->print(&noswitch()); } return OK; @@ -697,7 +793,7 @@ sub handler { \%form); my $switchto = '/adm/switchserver?otherserver='.$otherserver; if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) { - $switchto .= '&origurl='.$firsturl; #should escape + $switchto .= '&origurl='.$firsturl; } if ($form{'role'}) { $switchto .= '&role='.$form{'role'}; @@ -707,15 +803,16 @@ sub handler { } if ($form{'linkprot'}) { $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form{'linkkey'}) { - $env{'request.linkkey'} = $form{'linkkey'}; - } - $env{'request.deeplink.login'} = $form{'firsturl'}; - + } elsif ($form{'linkkey'} ne '') { + $env{'request.linkkey'} = $form{'linkkey'}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); } $r->internal_redirect($switchto); } else { + &Apache::loncommon::content_type($r,'text/html'); + $r->send_http_header; $r->print(&noswitch()); } return OK; @@ -736,7 +833,7 @@ sub handler { # ---------------------------------------------------------- Are we overloaded? if ((($userloadpercent>100.0)||($loadpercent>100.0))) { - my $unloaded=Apache::lonnet::spareserver($loadpercent,$userloadpercent,1,$form{'udom'}); + my $unloaded=Apache::lonnet::spareserver($r,$loadpercent,$userloadpercent,1,$form{'udom'}); if (!$unloaded) { ($unloaded) = &Apache::lonnet::choose_server($form{'udom'}); } @@ -745,11 +842,11 @@ sub handler { undef,\%form); if ($form{'linkprot'}) { $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form{'linkkey'}) { - $env{'request.linkkey'} = $form{'linkkey'}; - } - $env{'request.deeplink.login'} = $form{'firsturl'}; + } elsif ($form{'linkkey'} ne '') { + $env{'request.linkkey'} = $form{'linkkey'}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); } $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl); return OK; @@ -759,19 +856,49 @@ sub handler { $form{'noloadbalance'} = $hosthere; } my $extra_env; + if (($hosthere) && ($sessiondata{'sessionserver'} ne '')) { + if ($sessiondata{'origurl'} ne '') { + $firsturl = $sessiondata{'origurl'}; + $form{'firsturl'} = $sessiondata{'origurl'}; + my @names = ('role','symb','linkprot','linkkey'); + foreach my $item (@names) { + if ($sessiondata{$item} ne '') { + $form{$item} = $sessiondata{$item}; + } + } + } + } if ($form{'linkprot'}) { my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2); if ($linkprotector) { $extra_env = {'user.linkprotector' => $linkprotector, - 'user.linkproturi' => $uri,}; + 'user.linkproturi' => $uri}; } - } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form{'linkkey'}) { - $extra_env = {'user.deeplinkkey' => $form{'linkkey'}, - 'user.keyedlinkuri' => $form{'firsturl'}, - 'request.deeplink.login' => $form{'firsturl'}}; - } else { - $extra_env = {'request.deeplink.login' => $form{'firsturl'}}; + } elsif ($form{'linkkey'} ne '') { + $extra_env = {'user.deeplinkkey' => $form{'linkkey'}, + 'user.keyedlinkuri' => $form{'firsturl'}}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); + if ($form{'linkprot'}) { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.linkprot' => $form{'linkprot'} ); + } else { + $extra_env = {'request.linkprot' => $form{'linkprot'}}; + } + } elsif ($form{'linkkey'} ne '') { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.linkkey' => $form{'linkkey'} ); + } else { + $extra_env = {'request.linkkey' => $form{'linkkey'}}; + } + } + if ($env{'request.deeplink.login'}) { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.deeplink.login' => $form{'firsturl'} ); + } else { + $extra_env = {'request.deeplink.login' => $form{'firsturl'}}; + } } } &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env, @@ -780,6 +907,98 @@ sub handler { } } +sub get_form_items { + my ($r) = @_; + my $buffer; + if ($r->header_in('Content-length') > 0) { + $r->read($buffer,$r->header_in('Content-length'),0); + } + my %form; + foreach my $pair (split(/&/,$buffer)) { + my ($name,$value) = split(/=/,$pair); + $value =~ tr/+/ /; + $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; + $form{$name}=$value; + } + return %form; +} + +sub set_deeplink_login { + my (%form) = @_; + my $disallow; + if ($form{'firsturl'} =~ m{^/tiny/($match_domain)/\w+$}) { + my $cdom = $1; + my ($cnum,$symb) = &Apache::loncommon::symb_from_tinyurl($form{'firsturl'},'',$cdom); + if ($symb) { + if ($env{'request.course.id'} eq $cdom.'_'.$cnum) { + my $deeplink; + if ($symb =~ /\.(page|sequence)$/) { + my $mapname = &Apache::lonnet::deversion((&Apache::lonnet::decode_symb($symb))[2]); + my $navmap = Apache::lonnavmaps::navmap->new(); + if (ref($navmap)) { + $deeplink = $navmap->get_mapparam(undef,$mapname,'0.deeplink'); + } + } else { + $deeplink = &Apache::lonnet::EXT('resource.0.deeplink',$symb); + } + if ($deeplink ne '') { + my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink); + if (($protect ne 'none') && ($protect ne '')) { + my ($acctype,$item) = split(/:/,$protect); + if ($acctype =~ /lti(c|d)$/) { + unless ($form{'linkprot'} eq $item.$1.':'.$env{'request.deeplink.login'}) { + $disallow = 1; + } + } elsif ($acctype eq 'key') { + unless ($form{'linkkey'} eq $item) { + $disallow = 1; + } + } + } + } + unless ($disallow) { + $env{'request.deeplink.login'} = $form{'firsturl'}; + } + } else { + $env{'request.deeplink.login'} = $form{'firsturl'}; + } + } + } + if ($disallow) { + return; + } + return 'ok'; +} + +sub set_retry_token { + my ($form,$lonhost,$querystr) = @_; + if (ref($form) eq 'HASH') { + my ($firsturl,$token,$extras,@names); + @names = ('role','symb','linkprot','linkkey','iptoken'); + foreach my $name (@names) { + if ($form->{$name} ne '') { + $extras .= '&'.$name.'='.&escape($form->{$name}); + last if ($name eq 'linkprot'); + } + } + my $firsturl = $form->{'firsturl'}; + if (($firsturl ne '') || ($extras ne '')) { + $extras .= ':retry'; + $token = &Apache::lonnet::reply('tmpput:'.&escape($firsturl). + $extras,$lonhost); + if (($token eq 'con_lost') || ($token eq 'no_such_host')) { + return 'fail'; + } else { + if (ref($querystr)) { + $$querystr = 'retry='.$token; + } + return 'ok'; + } + } + } + return; +} + sub check_can_host { my ($r,$form,$authhost,$domdesc) = @_; return unless (ref($form) eq 'HASH'); @@ -820,6 +1039,8 @@ sub check_can_host { if ($login_host ne '') { my $protocol = $Apache::lonnet::protocol{$login_host}; $protocol = 'http' if ($protocol ne 'https'); + my $alias = &Apache::lonnet::use_proxy_alias($r,$login_host); + $hostname = $alias if ($alias ne ''); my $newurl = $protocol.'://'.$hostname.'/adm/createaccount'; #FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host $r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA'). @@ -838,13 +1059,13 @@ sub check_can_host { } else { &success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef, $form); + if ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + $env{'request.deeplink.login'} = $form->{'firsturl'}; + } if ($form->{'linkprot'}) { $env{'request.linkprot'} = $form->{'linkprot'}; - } elsif ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form->{'linkkey'}) { - $env{'request.linkkey'} = $form->{'linkkey'}; - } - $env{'request.deeplink.login'} = $form->{'firsturl'}; + } elsif ($form->{'linkkey'} ne '') { + $env{'request.linkkey'} = $form->{'linkkey'}; } my ($otherserver) = &Apache::lonnet::choose_server($udom); $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver); @@ -889,6 +1110,20 @@ sub loginhelpdisplay { return; } +sub alternate_unames_check { + my ($uname,$udom) = @_; + my %possunames; + my %domdefs = &Apache::lonnet::get_domain_defaults($udom); + if (ref($domdefs{'unamemap_rule'}) eq 'ARRAY') { + if (@{$domdefs{'unamemap_rule'}} > 0) { + %possunames = + &Apache::lonnet::inst_rulecheck($udom,$uname,undef, + 'unamemap',$domdefs{'unamemap_rule'}); + } + } + return %possunames; +} + 1; __END__