--- loncom/auth/lonauth.pm	2006/10/10 21:57:12	1.85
+++ loncom/auth/lonauth.pm	2008/10/01 11:11:08	1.95
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.85 2006/10/10 21:57:12 albertel Exp $
+# $Id: lonauth.pm,v 1.95 2008/10/01 11:11:08 bisitz Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -32,12 +32,12 @@ use strict;
 use LONCAPA;
 use Apache::Constants qw(:common);
 use CGI qw(:standard);
-use CGI::Cookie();
 use DynaLoader; # for Crypt::DES version
 use Crypt::DES;
 use Apache::loncommon();
 use Apache::lonnet;
 use Apache::lonmenu();
+use Apache::createaccount;
 use Fcntl qw(:flock);
 use Apache::lonlocal;
  
@@ -50,7 +50,7 @@ sub success {
     my $cookie =
 	&Apache::loncommon::init_user_environment($r, $username, $domain,
 						  $authhost, $form,
-						  $extra_env);
+						  {'extra_env' => $extra_env,});
 
     my $public=($username eq 'public' && $domain eq 'public');
 
@@ -96,8 +96,8 @@ sub success {
 
     my %lt=&Apache::lonlocal::texthash(
 				       'wel' => 'Welcome',
-				       'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up',
-				       'pro' => 'Problems',
+				       'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up.',
+				       'pro' => 'Login problems?',
 				       'log' => 'loginproblems.html',
 				       );
     $r->print(<<ENDSUCCESS);
@@ -105,8 +105,8 @@ $start_page
 $setflags
 $windowinfo
 <h1>$lt{'wel'}</h1>
-$lt{'mes'}.<p>
-<a href="/adm/$lt{'log'}">$lt{'pro'}?</a></p>
+$lt{'mes'}<p>
+<a href="/adm/$lt{'log'}">$lt{'pro'}</a></p>
 $remoteinfo
 $maincall
 $continuelink
@@ -121,28 +121,20 @@ sub failed {
     my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,
 						    {'no_inline_link' => 1,});
     my $end_page   = &Apache::loncommon::end_page();
-
-    my %lt=('sorry'  => &mt('Sorry ...'),
-	    'please' => 
-	    &mt('Please [_1]log in again[_2].',
-		"<a href=\"/adm/login?username=$form->{'uname'}&domain=$form->{'udom'}\">",
-		'</a>'),
-	    'problemspage' => &mt('loginproblems.html'),
-	    'problems'     => 'Problems',
-	    );
     &Apache::loncommon::content_type($r,'text/html');
+    sleep 1; # brute force counteraction: slow down attackers, which try to hack user authentication with automated scripts
     $r->send_http_header;
-
-    $r->print(<<ENDFAILED);
-$start_page
-<h1>$lt{'sorry'}</h1>
-<p><b>$message</b></p>
-<p>$lt{'please'}</p>
-<p>
-<a href="/adm/$lt{'problemspage'}">$lt{'problems'}</a></p>
-$end_page
-ENDFAILED
-}
+    $r->print(
+       $start_page
+      .'<h1>'.&mt('Sorry ...').'</h1>'
+      .'<p class="LC_warning">'.&mt($message).'</p>'
+      .'<p>'.&mt('Please [_1]log in again[_2].'
+                ,"<a href=\"/adm/login?username=$form->{'uname'}&domain=$form->{'udom'}\">",'</a>')
+      .'</p>'
+      .'<p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'
+      .$end_page
+    );
+ }
 
 # ------------------------------------------------------------------ Rerouting!
 
@@ -150,8 +142,8 @@ sub reroute {
     my ($r) = @_;
     &Apache::loncommon::content_type($r,'text/html');
     $r->send_http_header;
-    my $msg='<h1>Sorry ...</h1>
-             Please <a href="/">log in again</a>.';
+    my $msg='<h1>'.&mt('Sorry ...').'</h1>'
+           .&mt('Please [_1]log in again[_2].');
     &Apache::loncommon::simple_error_page($r,'Rerouting',$msg);
 }
 
@@ -169,32 +161,25 @@ sub handler {
     &Apache::lonlocal::get_language_handle($r);
 
 # -------------------------------- Prevent users from attempting to login twice
-    my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
-    my $lonid=$cookies{'lonID'};
-    my $cookie;
-    if ($lonid) {
-	my $handle=$lonid->value;
-        $handle=~s/\W//g;
-        my $lonidsdir=$r->dir_config('lonIDsDir');
-        if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {
+    my $handle = &Apache::lonnet::check_for_valid_session($r);
+    if ($handle ne '') {
 # Indeed, a valid token is found
-	    &Apache::loncommon::content_type($r,'text/html');
-	    $r->send_http_header;
-	    my $start_page = 
-		&Apache::loncommon::start_page('Already logged in');
-	    my $end_page = 
-		&Apache::loncommon::end_page();
-	    $r->print(<<ENDFAILED);
-$start_page
-<h1>You are already logged in</h1>
-<p>Please either <a href="/adm/roles">continue the current session</a> or
-<a href="/adm/logout">logout</a>.</p>
-<p>
-<a href="/adm/loginproblems.html">Problems?</a></p>
-$end_page
-ENDFAILED
-           return OK;
-	}
+	&Apache::loncommon::content_type($r,'text/html');
+	$r->send_http_header;
+	my $start_page = 
+	    &Apache::loncommon::start_page('Already logged in');
+	my $end_page = 
+	    &Apache::loncommon::end_page();
+        $r->print(
+           $start_page
+          .'<h1>'.&mt('You are already logged in!').'</h1>'
+          .'<p>'.&mt('Please either [_1]continue the current session[_2] or [_3]logout[_4].'
+                    ,'<a href="/adm/roles">','</a>','<a href="/adm/logout">','</a>')
+          .'</p>'
+          .'<p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'
+          .$end_page
+        );
+        return OK;
     }
 
 # ---------------------------------------------------- No valid token, continue
@@ -221,13 +206,14 @@ ENDFAILED
 # split user logging in and "su"-user
 
     ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
-    $form{'uname'} =~ s/\W//g;
-    $form{'suname'} =~ s/\W//g;
-    $form{'udom'}  =~ s/\W//g;
+    $form{'uname'} = &LONCAPA::clean_username($form{'uname'});
+    $form{'suname'}= &LONCAPA::clean_username($form{'suname'});
+    $form{'udom'}  = &LONCAPA::clean_domain(  $form{'udom'});
 
     my $role   = $r->dir_config('lonRole');
     my $domain = $r->dir_config('lonDefDomain');
     my $prodir = $r->dir_config('lonUsersDir');
+    my $contact_name = &mt('LON-CAPA helpdesk');
 
 # ---------------------------------------- Get the information from login token
 
@@ -246,6 +232,10 @@ ENDFAILED
 	    return OK;
 	}
     }
+    if (!&Apache::lonnet::domain($form{'udom'})) {
+        &failed($r,'The domain you provided is not a valid LON-CAPA domain.',\%form);
+        return OK;
+    }
     my ($key,$firsturl)=split(/&/,$tmpinfo);
 
     my $keybin=pack("H16",$key);
@@ -270,9 +260,24 @@ ENDFAILED
     }
 
 # ---------------------------------------------------------------- Authenticate
-    my $authhost=Apache::lonnet::authenticate($form{'uname'},
-                                              $upass,
-                                              $form{'udom'});
+    my @cancreate;
+    my %domconfig = &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'});
+    if (ref($domconfig{'usercreation'}) eq 'HASH') {
+        if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
+            if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
+                @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
+            } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') && 
+                     ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
+                @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
+            }
+        }
+    }
+    my $defaultauth;
+    if (grep(/^login$/,@cancreate)) {
+        $defaultauth = 1;
+    }
+    my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
+                                              $form{'udom'},$defaultauth);
     
 # --------------------------------------------------------------------- Failed?
 
@@ -280,6 +285,34 @@ ENDFAILED
 	&failed($r,'Username and/or password could not be authenticated.',
 		\%form);
         return OK;
+    } elsif ($authhost eq 'no_account_on_host') {
+        my %domconfig = 
+            &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'});
+        if (grep(/^login$/,@cancreate)) {
+            my $start_page = 
+                &Apache::loncommon::start_page('Create a user account in LON-CAPA',
+                                               '',{'no_inline_link'   => 1,});
+            my $domdesc = &Apache::lonnet::domain($form{'udom'},'description');
+            my $lonhost = $r->dir_config('lonHostID');
+            my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'};
+            my $contacts = 
+                &Apache::loncommon::build_recipient_list(undef,'helpdeskmail',
+                                                        $form{'udom'},$origmail);
+            my ($contact_email) = split(',',$contacts); 
+            my $output = &Apache::createaccount::username_check($form{'uname'}, 
+                                                                $form{'udom'},$domdesc,'',
+                                                                $lonhost,$contact_email,$contact_name);
+            &Apache::loncommon::content_type($r,'text/html');
+            $r->send_http_header;
+            &Apache::createaccount::print_header($r,$start_page);
+            $r->print('<h3>'.&mt('Account creation').'</h3>'.
+                      &mt('Although your username and password were authenticated, you do not currently have a LON-CAPA account at this institution.').'<br />'.
+                      $output.&Apache::loncommon::end_page());
+            return OK;
+        } else {
+            &failed($r,'Although your username and password were authenticated, you do not currently have a LON-CAPA account in this domain, and you are not permitted to create one.',\%form);
+            return OK;
+        }
     }
 
     if (($firsturl eq '') ||