--- loncom/auth/lonauth.pm	2021/05/04 18:47:37	1.163
+++ loncom/auth/lonauth.pm	2021/08/07 20:49:10	1.164
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.163 2021/05/04 18:47:37 raeburn Exp $
+# $Id: lonauth.pm,v 1.164 2021/08/07 20:49:10 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -393,8 +393,34 @@ sub handler {
             my $dest = '/adm/roles';
             if ($env{'form.firsturl'} ne '') {
                 $dest = $env{'form.firsturl'};
-                if ($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                    &Apache::lonnet::appenv({'request.deeplink.login' => $env{'form.firsturl'}}); 
+                if (($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) &&
+                    ($env{'request.course.id'})) {
+                    my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
+                    my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
+                    my $symb = &Apache::loncommon::symb_from_tinyurl($env{'form.firsturl'},$cnum,$cdom);
+                    if ($symb) {
+                        my $buffer;
+                        if ($r->header_in('Content-length') > 0) {
+                            $r->read($buffer,$r->header_in('Content-length'),0);
+                        }
+                        my %form;
+                        foreach my $pair (split(/&/,$buffer)) {
+                            my ($name,$value) = split(/=/,$pair);
+                            $value =~ tr/+/ /;
+                            $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
+                            $form{$name}=$value;
+                        }
+                        &set_deeplink_login(%form);
+                    } else {
+                        $r->print(
+                                  $start_page
+                                 .'<p class="LC_warning">'.&mt('You are already logged in!').'</p>'
+                                 .'<p>'.&mt('Please [_1]log out[_2] first, and then try your access again',
+                                            '<a href="/adm/logout">','</a>')
+                                 .'</p>'
+                                 .$end_page);
+                        return OK;
+                    }
                 }
             }
             $r->print(
@@ -684,11 +710,11 @@ sub handler {
             }
             if ($form{'linkprot'}) {
                 $env{'request.linkprot'} = $form{'linkprot'};
-            } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                if ($form{'linkkey'}) {
-                    $env{'request.linkkey'} = $form{'linkkey'};
-                }
-                $env{'request.deeplink.login'} = $form{'firsturl'};
+            } elsif ($form{'linkkey'}) {
+                $env{'request.linkkey'} = $form{'linkkey'};
+            }
+            if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                &set_deeplink_login(%form);
             }
             $r->internal_redirect($switchto);
         } else {
@@ -715,12 +741,11 @@ sub handler {
                 }
                 if ($form{'linkprot'}) {
                     $env{'request.linkprot'} = $form{'linkprot'};
-                } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                    if ($form{'linkkey'}) {
-                        $env{'request.linkkey'} = $form{'linkkey'};
-                    }
-                    $env{'request.deeplink.login'} = $form{'firsturl'};
-
+                } elsif ($form{'linkkey'}) {
+                    $env{'request.linkkey'} = $form{'linkkey'};
+                }
+                if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    &set_deeplink_login(%form);
                 }
                 $r->internal_redirect($switchto);
             } else {
@@ -755,11 +780,11 @@ sub handler {
                          undef,\%form);
                 if ($form{'linkprot'}) {
                     $env{'request.linkprot'} = $form{'linkprot'};
-                } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                    if ($form{'linkkey'}) {
-                        $env{'request.linkkey'} = $form{'linkkey'};
-                    }
-                    $env{'request.deeplink.login'} = $form{'firsturl'};
+                } elsif ($form{'linkkey'}) {
+                    $env{'request.linkkey'} = $form{'linkkey'};
+                }
+                if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    &set_deeplink_login(%form);
                 }
                 $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl);
                 return OK;
@@ -773,15 +798,20 @@ sub handler {
             my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2);
             if ($linkprotector) {
                 $extra_env = {'user.linkprotector' => $linkprotector,
-                              'user.linkproturi'   => $uri,};
+                              'user.linkproturi'   => $uri};
             }
-        } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-            if ($form{'linkkey'}) {
-                $extra_env = {'user.deeplinkkey' => $form{'linkkey'},
-                              'user.keyedlinkuri' => $form{'firsturl'},
-                              'request.deeplink.login' => $form{'firsturl'}};
-            } else {
-                $extra_env = {'request.deeplink.login' => $form{'firsturl'}};
+        } elsif ($form{'linkkey'}) {
+            $extra_env = {'user.deeplinkkey' => $form{'linkkey'},
+                          'user.keyedlinkuri' => $form{'firsturl'}};
+        }
+        if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+            &set_deeplink_login(%form);
+            if ($env{'request.deeplink.login'}) {
+                if (ref($extra_env) eq 'HASH') {
+                    %{$extra_env} = ( %{$extra_env}, 'request.deeplink.login' => $form{'firsturl'} );
+                } else {
+                    $extra_env = {'request.deeplink.login' => $form{'firsturl'}};
+                }
             }
         }
         &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env,
@@ -790,6 +820,37 @@ sub handler {
     }
 }
 
+sub set_deeplink_login {
+    my (%form) = @_;
+    if ($form{'firsturl'} =~ m{^/tiny/($match_domain)/\w+$}) {
+        my $cdom = $1;
+        my ($cnum,$symb) = &Apache::loncommon::symb_from_tinyurl($form{'firsturl'},'',$cdom);
+        if ($symb) {
+            my $disallow;
+            my $deeplink = &Apache::lonnet::EXT("resource.0.deeplink",$symb);
+            if ($deeplink ne '') {
+                my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink);
+                if (($protect ne 'none') && ($protect ne '')) {
+                    my ($acctype,$item) = split(/:/,$protect);
+                    if (($acctype eq 'ltic') || ($acctype eq 'ltid')) {
+                         unless ($form{'linkprot'} eq $protect) {
+                             $disallow = 1;
+                         }
+                    } elsif ($acctype eq 'key') {
+                        unless (form{'linkkey'} eq $item) {
+                            $disallow = 1;
+                        }
+                    }
+                }
+            }
+            unless ($disallow) {
+                $env{'request.deeplink.login'} = $form{'firsturl'};
+            }
+        }
+    }
+    return;
+}
+
 sub check_can_host {
     my ($r,$form,$authhost,$domdesc) = @_;
     return unless (ref($form) eq 'HASH');