--- loncom/auth/lonauth.pm	2021/05/04 18:47:37	1.163
+++ loncom/auth/lonauth.pm	2021/08/10 15:28:13	1.166
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.163 2021/05/04 18:47:37 raeburn Exp $
+# $Id: lonauth.pm,v 1.166 2021/08/10 15:28:13 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -386,15 +386,40 @@ sub handler {
             &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
 	    &Apache::loncommon::content_type($r,'text/html');
 	    $r->send_http_header;
-	    my $start_page = 
+	    my $start_page =
 	        &Apache::loncommon::start_page('Already logged in');
 	    my $end_page = 
 	        &Apache::loncommon::end_page();
             my $dest = '/adm/roles';
             if ($env{'form.firsturl'} ne '') {
                 $dest = $env{'form.firsturl'};
-                if ($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                    &Apache::lonnet::appenv({'request.deeplink.login' => $env{'form.firsturl'}}); 
+                if (($dest =~ m{^/tiny/$match_domain/\w+$}) && ($env{'request.course.id'})) {
+                    my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
+                    my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
+                    my $symb = &Apache::loncommon::symb_from_tinyurl($dest,$cnum,$cdom);
+                    if ($symb) {
+                        my $buffer;
+                        if ($r->header_in('Content-length') > 0) {
+                            $r->read($buffer,$r->header_in('Content-length'),0);
+                        }
+                        my %form;
+                        foreach my $pair (split(/&/,$buffer)) {
+                            my ($name,$value) = split(/=/,$pair);
+                            $value =~ tr/+/ /;
+                            $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
+                            $form{$name}=$value;
+                        }
+                        &set_deeplink_login(%form);
+                    } else {
+                        $r->print(
+                                  $start_page
+                                 .'<p class="LC_warning">'.&mt('You are already logged in!').'</p>'
+                                 .'<p>'.&mt('Please [_1]log out[_2] first, and then try your access again',
+                                            '<a href="/adm/logout">','</a>')
+                                 .'</p>'
+                                 .$end_page);
+                        return OK;
+                    }
                 }
             }
             $r->print(
@@ -684,11 +709,11 @@ sub handler {
             }
             if ($form{'linkprot'}) {
                 $env{'request.linkprot'} = $form{'linkprot'};
-            } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                if ($form{'linkkey'}) {
-                    $env{'request.linkkey'} = $form{'linkkey'};
-                }
-                $env{'request.deeplink.login'} = $form{'firsturl'};
+            } elsif ($form{'linkkey'}) {
+                $env{'request.linkkey'} = $form{'linkkey'};
+            }
+            if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                &set_deeplink_login(%form);
             }
             $r->internal_redirect($switchto);
         } else {
@@ -715,12 +740,11 @@ sub handler {
                 }
                 if ($form{'linkprot'}) {
                     $env{'request.linkprot'} = $form{'linkprot'};
-                } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                    if ($form{'linkkey'}) {
-                        $env{'request.linkkey'} = $form{'linkkey'};
-                    }
-                    $env{'request.deeplink.login'} = $form{'firsturl'};
-
+                } elsif ($form{'linkkey'}) {
+                    $env{'request.linkkey'} = $form{'linkkey'};
+                }
+                if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    &set_deeplink_login(%form);
                 }
                 $r->internal_redirect($switchto);
             } else {
@@ -755,11 +779,11 @@ sub handler {
                          undef,\%form);
                 if ($form{'linkprot'}) {
                     $env{'request.linkprot'} = $form{'linkprot'};
-                } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-                    if ($form{'linkkey'}) {
-                        $env{'request.linkkey'} = $form{'linkkey'};
-                    }
-                    $env{'request.deeplink.login'} = $form{'firsturl'};
+                } elsif ($form{'linkkey'}) {
+                    $env{'request.linkkey'} = $form{'linkkey'};
+                }
+                if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    &set_deeplink_login(%form);
                 }
                 $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl);
                 return OK;
@@ -773,15 +797,33 @@ sub handler {
             my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2);
             if ($linkprotector) {
                 $extra_env = {'user.linkprotector' => $linkprotector,
-                              'user.linkproturi'   => $uri,};
+                              'user.linkproturi'   => $uri};
             }
-        } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
-            if ($form{'linkkey'}) {
-                $extra_env = {'user.deeplinkkey' => $form{'linkkey'},
-                              'user.keyedlinkuri' => $form{'firsturl'},
-                              'request.deeplink.login' => $form{'firsturl'}};
-            } else {
-                $extra_env = {'request.deeplink.login' => $form{'firsturl'}};
+        } elsif ($form{'linkkey'}) {
+            $extra_env = {'user.deeplinkkey'  => $form{'linkkey'},
+                          'user.keyedlinkuri' => $form{'firsturl'}};
+        }
+        if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+            &set_deeplink_login(%form);
+            if ($form{'linkprot'}) {
+                if (ref($extra_env) eq 'HASH') {
+                    %{$extra_env} = ( %{$extra_env}, 'request.linkprot' => $form{'linkprot'} );
+                } else {
+                    $extra_env = {'request.linkprot' => $form{'linkprot'}};
+                }
+            } elsif ($form{'linkkey'}) {
+                if (ref($extra_env) eq 'HASH') {
+                    %{$extra_env} = ( %{$extra_env}, 'request.linkkey' => $form{'linkkey'} );
+                } else {
+                    $extra_env = {'request.linkkey' => $form{'linkkey'}};
+                }
+            }
+            if ($env{'request.deeplink.login'}) {
+                if (ref($extra_env) eq 'HASH') {
+                    %{$extra_env} = ( %{$extra_env}, 'request.deeplink.login' => $form{'firsturl'} );
+                } else {
+                    $extra_env = {'request.deeplink.login' => $form{'firsturl'}};
+                }
             }
         }
         &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env,
@@ -790,6 +832,49 @@ sub handler {
     }
 }
 
+sub set_deeplink_login {
+    my (%form) = @_;
+    if ($form{'firsturl'} =~ m{^/tiny/($match_domain)/\w+$}) {
+        my $cdom = $1;
+        my ($cnum,$symb) = &Apache::loncommon::symb_from_tinyurl($form{'firsturl'},'',$cdom);
+        if ($symb) {
+            if ($env{'request.course.id'} eq $cdom.'_'.$cnum) {
+                my ($disallow,$deeplink);
+                if ($symb =~ /\.(page|sequence)$/) {
+                    my $mapname = &Apache::lonnet::deversion((&Apache::lonnet::decode_symb($symb))[2]);
+                    my $navmap = Apache::lonnavmaps::navmap->new();
+                    if (ref($navmap)) {
+                        $deeplink = $navmap->get_mapparam(undef,$mapname,'0.deeplink');
+                    }
+                } else {
+                    $deeplink = &Apache::lonnet::EXT('resource.0.deeplink',$symb);
+                }
+                if ($deeplink ne '') {
+                    my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink);
+                    if (($protect ne 'none') && ($protect ne '')) {
+                        my ($acctype,$item) = split(/:/,$protect);
+                        if ($acctype =~ /lti(c|d)$/) {
+                            unless ($form{'linkprot'} eq $item.$1.':'.$env{'request.deeplink.login'}) {
+                                $disallow = 1;
+                            }
+                        } elsif ($acctype eq 'key') {
+                            unless ($form{'linkkey'} eq $item) {
+                                $disallow = 1;
+                            }
+                        }
+                    }
+                }
+                unless ($disallow) {
+                    $env{'request.deeplink.login'} = $form{'firsturl'};
+                }
+            } else {
+                $env{'request.deeplink.login'} = $form{'firsturl'};
+            }
+        }
+    }
+    return;
+}
+
 sub check_can_host {
     my ($r,$form,$authhost,$domdesc) = @_;
     return unless (ref($form) eq 'HASH');