--- loncom/auth/lonauth.pm	2022/05/21 05:16:43	1.173
+++ loncom/auth/lonauth.pm	2022/06/26 04:03:47	1.175
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.173 2022/05/21 05:16:43 raeburn Exp $
+# $Id: lonauth.pm,v 1.175 2022/06/26 04:03:47 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -179,11 +179,19 @@ sub success {
         $destination .= 'source=login';
     }
 
+    my $brcrum = [{'href' => '',
+                   'text' => 'Successful Login'},];
+    my $args = {'no_inline_link' => 1,
+                'bread_crumbs' => $brcrum,};
     if (($env{'request.deeplink.login'} eq $lowerurl) &&
         (($env{'request.linkprot'}) || ($env{'request.linkkey'} ne ''))) {
         my %info;
         if ($env{'request.linkprot'}) {
             $info{'linkprot'} = $env{'request.linkprot'};
+            if ($form->{'linkprotuser'}) {
+                $info{'linkprotuser'} = $form->{'linkprotuser'};
+            }
+            $args = {'only_body' => 1,};
         } elsif ($env{'request.linkkey'} ne '') {
             $info{'linkkey'} = $env{'request.linkkey'};
         }
@@ -200,9 +208,6 @@ sub success {
         $windowname .= 'lti';
     }
     my $windowinfo = Apache::lonhtmlcommon::scripttag('self.name="'.$windowname.'";');
-    my $brcrum = [{'href' => '',
-                   'text' => 'Successful Login'},];
-    my $args = {'bread_crumbs' => $brcrum,};
     unless ((defined($form->{role})) || (defined($form->{symb}))) {
         my $update=$env{'user.update.time'};
         if (!$update) {
@@ -276,18 +281,19 @@ ENDJS
         $args->{'redirect'} = [0,$destination];
         $start_page=&Apache::loncommon::start_page('Successful Login',
                                                    $js,$args);
-
-        my %lt=&Apache::lonlocal::texthash(
-				           'wel' => 'Welcome',
-				           'pro' => 'Login problems?',
+        unless ($env{'request.linkprot'}) {
+            my %lt=&Apache::lonlocal::texthash(
+		    		               'wel' => 'Welcome',
+				               'pro' => 'Login problems?',
 				          );
-        $pagebody = "<h1>$lt{'wel'}</h1>\n".
-                    &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','<i>','</i>');
-        my $loginhelp = &loginhelpdisplay($domain);
-        if ($loginhelp) {
-            $pagebody .= '<p><a href="'.$loginhelp.'">'.$lt{'pro'}.'</a></p>';
+            $pagebody = "<h1>$lt{'wel'}</h1>\n".
+                        &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','<i>','</i>');
+            my $loginhelp = &loginhelpdisplay($domain);
+            if ($loginhelp) {
+                $pagebody .= '<p><a href="'.$loginhelp.'">'.$lt{'pro'}.'</a></p>';
+            }
         }
-    }
+    } 
     $end_page = &Apache::loncommon::end_page();
     $r->print(<<ENDSUCCESS);
 $start_page
@@ -308,6 +314,11 @@ sub failed {
     if ($clientunicode && !$clientmathml) {
         $args = {'browser.unicode' => 1};
     }
+    if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) {
+        if ($form->{linkprot}) {
+            $args->{only_body} = 1;
+        }
+    }
 
     my @actions;
     my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,$args);
@@ -357,7 +368,13 @@ sub failed {
             }
         }
         if (exists($form->{linkprot})) {
-            my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}},
+            my %info = (
+                         'linkprot' => $form->{'linkprot'},
+                       );
+            if ($form->{linkprotuser} ne '') {
+                $info{'linkprotuser'} = $form->{linkprotuser};
+            }
+            my $ltoken = &Apache::lonnet::tmpput(\%info,
                                                  $r->dir_config('lonHostID'),'retry');
             if ($ltoken) {
                 $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken;
@@ -475,6 +492,19 @@ sub handler {
                                      .$end_page);
                             } else {
                                 if (($info{'linkprot'}) || ($info{'linkkey'} ne '')) {
+                                    if (($info{'linkprot'}) && ($info{'linkprotuser'} ne '')) {
+                                        unless ($info{'linkprotuser'} eq $env{'user.name'}.':'.$env{'user.domain'}) {
+                                            $r->print(
+                                                      $start_page
+                                                      .'<p class="LC_warning">'.&mt('You are already logged in, but as a different user from the one expected for the link you followed from another system').'</p>'
+                                                      .'<p>'.&mt('Please [_1]log out[_2] first, and then try following the link again from the other system',
+                                                                 '<a href="/adm/logout">','</a>')
+
+                                                      .'</p>'
+                                                      .$end_page);
+                                            return OK;
+                                        }
+                                    }
                                     my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link');
                                     unless (($token eq 'con_lost') || ($token eq 'refused') ||
                                             ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) {
@@ -730,6 +760,18 @@ sub handler {
 	}
     }
 
+    if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+        if (($form{'linkprot'}) && ($form{'linkprotuser'} ne '')) {
+            unless($form{'linkprotuser'} eq $form{'uname'}.':'.$form{'udom'}) {
+                delete($form{'udom'});
+                delete($form{'uname'});
+                &failed($r,'Username and/or domain are different to that expected for the link you followed from another system',
+                        \%form,$authhost);
+                return OK;
+            }
+        }
+    }
+
     my ($is_balancer,$otherserver);
 
     unless ($hosthere) {
@@ -773,6 +815,9 @@ sub handler {
             }
             if ($form{'linkprot'}) {
                 $env{'request.linkprot'} = $form{'linkprot'};
+                if ($form{'linkprotuser'}) {
+                    $env{'request.linkprotuser'} = $form{'linkprotuser'};
+                }
             } elsif ($form{'linkkey'} ne '') {
                 $env{'request.linkkey'} = $form{'linkkey'};
             }
@@ -804,6 +849,9 @@ sub handler {
                 }
                 if ($form{'linkprot'}) {
                     $env{'request.linkprot'} = $form{'linkprot'};
+                    if ($form{'linkprotuser'}) {
+                        $env{'request.linkprotuser'} = $form{'linkprotuser'};
+                    }
                 } elsif ($form{'linkkey'} ne '') {
                     $env{'request.linkkey'} = $form{'linkkey'};
                 }
@@ -975,7 +1023,7 @@ sub set_retry_token {
     my ($form,$lonhost,$querystr) = @_;
     if (ref($form) eq 'HASH') {
         my ($firsturl,$token,$extras,@names);
-        @names = ('role','symb','linkprot','linkkey','iptoken');
+        @names = ('role','symb','linkprotuser','linkprot','linkkey','iptoken');
         foreach my $name (@names) {
             if ($form->{$name} ne '') {
                 $extras .= '&'.$name.'='.&escape($form->{$name});