loncom/auth/lonauth.pm - view

File: [LON-CAPA] / loncom / auth / lonauth.pm
Revision 1.65: download - view: text, annotated - select for diffs
Sat Feb 26 05:37:23 2005 UTC (19 years, 3 months ago) by albertel
Branches: MAIN
CVS tags: HEAD

- ttm can now be forced on, which means Hi XML, what you mean we really have to be xml now?
   - roles screen with no roles doesn't barf in xml mode
   - viewing a homework problem with an inline remote and no selected roles doesn't baf
   - pref screen to change back to something else doesn't barf

- no guarentees about anything else, not that the remote control in particular is non functional

1: # The LearningOnline Network 2: # User Authentication Module 3: # 4: # $Id: lonauth.pm,v 1.65 2005/02/26 05:37:23 albertel Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: # 5/21/99,5/22,5/25,5/26,5/27,5/29,6/2,6/11,6/14,6/15 29: # 16/11,12/16, 30: # 1/14,2/24,2/28,2/29,3/7,5/29,5/30,5/31,6/1,6/5,6/29, 31: # 7/1,7/10,10/2,10/5,10/9,10/26,10/30,11/10, 32: # 05/28,05/29 Gerd Kortemeyer 33: # 07/28,08/03 Gerd Kortemeyer 34: # 8/20 Gerd Kortemeyer 35: 36: package Apache::lonauth; 37: 38: use strict; 39: use Apache::Constants qw(:common); 40: use Apache::File; 41: use CGI qw(:standard); 42: use CGI::Cookie(); 43: use DynaLoader; # for Crypt::DES version 44: use Crypt::DES; 45: use Apache::loncommon(); 46: use Apache::lonnet(); 47: use Apache::lonmenu(); 48: use Fcntl qw(:flock); 49: use Apache::lonlocal; 50: 51: my %FORM; 52: 53: # ------------------------------------------------------------ Successful login 54: 55: sub success { 56: my ($r, $username, $domain, $authhost,$lowerurl) = @_; 57: my $lonids=$r->dir_config('lonIDsDir'); 58: 59: # See if old ID present, if so, remove 60: 61: my $filename; 62: opendir(DIR,$lonids); 63: while ($filename=readdir(DIR)) { 64: if ($filename=~/^$username\_\d+\_$domain\_$authhost\.id$/) { 65: unlink($lonids.'/'.$filename); 66: } 67: } 68: closedir(DIR); 69: 70: # Give them a new cookie 71: 72: my $cookie; 73: my $now=time; 74: $cookie="$username\_$now\_$domain\_$authhost"; 75: 76: # Initialize roles 77: 78: my $userroles=Apache::lonnet::rolesinit($domain,$username,$authhost); 79: 80: # ------------------------------------ Check browser type and MathML capability 81: 82: my ($httpbrowser,$clientbrowser,$clientversion,$clientmathml, 83: $clientunicode,$clientos) = &Apache::loncommon::decode_user_agent($r); 84: 85: # -------------------------------------- Any accessibility options to remember? 86: if (($FORM{'interface'}) && ($FORM{'remember'} eq 'true')) { 87: foreach ('imagesuppress','appletsuppress', 88: 'embedsuppress','fontenhance','blackwhite') { 89: if ($FORM{$_} eq 'true') { 90: &Apache::lonnet::put('environment',{$_ => 'on'}, 91: $domain,$username); 92: } else { 93: &Apache::lonnet::del('environment',[$_],$domain,$username); 94: } 95: } 96: } 97: # ------------------------------------------------------------- Get environment 98: 99: my $userenv; 100: my %userenv=Apache::lonnet::dump('environment',$domain,$username); 101: my ($tmp) = keys(%userenv); 102: if ($tmp !~ /^(con_lost|error|no_such_host)/i) { 103: foreach my $key (keys(%userenv)) { 104: $userenv.="environment.$key=$userenv{$key}\n"; 105: } 106: } 107: if (($userenv{'interface'}) && (!$FORM{'interface'})) { 108: $FORM{'interface'}=$userenv{'interface'}; 109: } 110: $ENV{'environment.remote'}=$userenv{'remote'}; 111: if ($userenv{'texengine'} eq 'ttm') { $clientmathml=1; } 112: 113: # --------------- Do not trust query string to be put directly into environment 114: foreach ('imagesuppress','appletsuppress', 115: 'embedsuppress','fontenhance','blackwhite', 116: 'interface','localpath','localres') { 117: $FORM{$_}=~s/[\n\r\=]//gs; 118: } 119: # --------------------------------------------------------- Write first profile 120: 121: { 122: my $idf=Apache::File->new(">$lonids/$cookie.id"); 123: unless (flock($idf,LOCK_EX)) { 124: &Apache::lonnet::logthis("<font color=blue>WARNING: ". 125: 'Could not obtain exclusive lock in lonauth: '.$!); 126: $idf->close(); 127: return 'error: '.$!; 128: } 129: if ($userenv ne '') { print $idf "$userenv\n"; } 130: print $idf "user.name=$username\n"; 131: print $idf "user.domain=$domain\n"; 132: print $idf "user.home=$authhost\n"; 133: print $idf "browser.type=$clientbrowser\n"; 134: print $idf "browser.version=$clientversion\n"; 135: print $idf "browser.mathml=$clientmathml\n"; 136: print $idf "browser.unicode=$clientunicode\n"; 137: print $idf "browser.os=$clientos\n"; 138: if ($FORM{'localpath'}) { 139: print $idf "browser.localpath=$FORM{'localpath'}\n"; 140: print $idf "browser.localres=$FORM{'localres'}\n"; 141: } 142: print $idf "request.course.fn=\n"; 143: print $idf "request.course.uri=\n"; 144: print $idf "request.course.sec=\n"; 145: print $idf "request.role=cm\n"; 146: print $idf "request.role.adv=$ENV{'user.adv'}\n"; 147: print $idf "request.host=$ENV{'REMOTE_ADDR'}\n"; 148: if ($FORM{'interface'}) { 149: $FORM{'interface'}=~s/\W//gs; 150: print $idf "browser.interface=$FORM{'interface'}\n"; 151: $ENV{'browser.interface'}=$FORM{'interface'}; 152: foreach ('imagesuppress','appletsuppress', 153: 'embedsuppress','fontenhance','blackwhite') { 154: if (($FORM{$_} eq 'true') || 155: ($userenv{$_} eq 'on')) { 156: print $idf "browser.$_=on\n"; 157: } 158: } 159: } 160: if ($userroles ne '') { print $idf "$userroles"; } 161: $idf->close(); 162: } 163: $ENV{'request.role'}='cm'; 164: $ENV{'request.role.adv'}=$ENV{'user.adv'}; 165: $ENV{'browser.type'}=$clientbrowser; 166: # -------------------------------------------------------------------- Log this 167: 168: &Apache::lonnet::log($domain,$username,$authhost, 169: "Login $ENV{'REMOTE_ADDR'}"); 170: 171: # ------------------------------------------------- Check for critical messages 172: 173: my @what=&Apache::lonnet::dump('critical',$domain,$username); 174: if ($what[0]) { 175: if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) { 176: $lowerurl='/adm/email?critical=display'; 177: } 178: } 179: 180: # ------------------------------------------------------------ Get cookie ready 181: 182: $cookie="lonID=$cookie; path=/"; 183: # -------------------------------------------------------- Menu script and info 184: my $windowinfo=&Apache::lonmenu::open($clientos); 185: my $startupremote=&Apache::lonmenu::startupremote($lowerurl); 186: my $remoteinfo=&Apache::lonmenu::load_remote_msg($lowerurl); 187: my $setflags=&Apache::lonmenu::setflags(); 188: my $maincall=&Apache::lonmenu::maincall(); 189: my $bodytag=&Apache::loncommon::bodytag('Successful Login'); 190: my $add=&addcontent(); 191: my $continuelink; 192: if (($ENV{'browser.interface'} eq 'textual') || 193: ($ENV{'environment.remote'} eq 'off')) { 194: $continuelink="<a href=\"$lowerurl\">".&mt('Continue')."</a>"; 195: } 196: # ------------------------------------------------- Output for successful login 197: 198: $r->send_cgi_header(<<ENDHEADER); 199: Content-type: text/html$add 200: Set-cookie: $cookie 201: 202: ENDHEADER 203: my %lt=&Apache::lonlocal::texthash( 204: 'wel' => 'Welcome', 205: 'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up', 206: 'pro' => 'Problems', 207: 'log' => 'loginproblems.html', 208: ); 209: $r->print(<<ENDSUCCESS); 210: <html> 211: <head> 212: <title>Successful Login to the LearningOnline Network with CAPA</title> 213: $startupremote 214: </head> 215: $bodytag 216: $setflags 217: $windowinfo 218: <h1>$lt{'wel'}</h1> 219: $lt{'mes'}.<p> 220: <a href="/adm/$lt{'log'}">$lt{'pro'}?</a></p> 221: $remoteinfo 222: $maincall 223: $continuelink 224: </body> 225: </html> 226: ENDSUCCESS 227: } 228: 229: # --------------------------------------------------------------- Failed login! 230: 231: sub failed { 232: my ($r,$message) = @_; 233: my $bodytag=&Apache::loncommon::bodytag('Unsuccessful Login'); 234: my $add=&addcontent(); 235: $r->send_cgi_header(<<ENDFHEADER); 236: Content-type: text/html$add 237: 238: ENDFHEADER 239: $r->print(<<ENDFAILED); 240: <html> 241: <head> 242: <title>Unsuccessful Login to the LearningOnline Network with CAPA</title> 243: </head> 244: $bodytag 245: <h1>Sorry ...</h1> 246: <p><b>$message</b></p> 247: <p>Please <a href="/adm/login?username=$FORM{'uname'}&domain=$FORM{'udom'}">log in again</a>.</p> 248: <p> 249: <a href="/adm/loginproblems.html">Problems?</a></p> 250: </body> 251: </html> 252: ENDFAILED 253: } 254: 255: # --------------------------------------------------------------------- Charset 256: 257: sub addcontent { 258: my $encoding=&Apache::lonlocal::current_encoding; 259: if ($encoding) { 260: return '; charset='.$encoding; 261: } else { 262: return ''; 263: } 264: } 265: 266: # ------------------------------------------------------------------ Rerouting! 267: 268: sub reroute { 269: my $r=shift; 270: my $bodytag=&Apache::loncommon::bodytag('Rerouting'); 271: $r->send_cgi_header(<<ENDRFHEADER); 272: Content-type: text/html 273: 274: ENDRFHEADER 275: $r->print(<<ENDRFAILED); 276: <html> 277: <head> 278: <title>Rerouting Login to the LearningOnline Network with CAPA</title> 279: </head> 280: $bodytag 281: <h1>Sorry ...</h1> 282: Please <a href="/">log in again</a>. 283: </body> 284: </html> 285: ENDRFAILED 286: } 287: 288: # ---------------------------------------------------------------- Main handler 289: 290: sub handler { 291: my $r = shift; 292: 293: # Are we re-routing? 294: if (-e '/home/httpd/html/lon-status/reroute.txt') { 295: &reroute($r); 296: return OK; 297: } 298: 299: &Apache::lonlocal::get_language_handle($r); 300: 301: # -------------------------------- Prevent users from attempting to login twice 302: my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); 303: my $lonid=$cookies{'lonID'}; 304: my $cookie; 305: if ($lonid) { 306: my $handle=$lonid->value; 307: $handle=~s/\W//g; 308: my $lonidsdir=$r->dir_config('lonIDsDir'); 309: if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) { 310: # Indeed, a valid token is found 311: $r->send_cgi_header(<<ENDFHEADER); 312: Content-type: text/html 313: 314: ENDFHEADER 315: my $bodytag=&Apache::loncommon::bodytag('Already logged in'); 316: $r->print(<<ENDFAILED); 317: <html> 318: <head> 319: <title>Already logged in</title> 320: </head> 321: $bodytag 322: <h1>You are already logged in</h1> 323: <p>Please either <a href="/adm/roles">continue the current session</a> or 324: <a href="/adm/logout">logout</a>.</p> 325: <p> 326: <a href="/adm/loginproblems.html">Problems?</a></p> 327: </body> 328: </html> 329: ENDFAILED 330: return OK; 331: } 332: } 333: 334: # ---------------------------------------------------- No valid token, continue 335: 336: 337: my $buffer; 338: $r->read($buffer,$r->header_in('Content-length'),0); 339: my @pairs=split(/&/,$buffer); 340: my $pair; my $name; my $value; 341: undef %FORM; 342: %FORM=(); 343: foreach $pair (@pairs) { 344: ($name,$value) = split(/=/,$pair); 345: $value =~ tr/+/ /; 346: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; 347: $FORM{$name}=$value; 348: } 349: 350: if ((!$FORM{'uname'}) || (!$FORM{'upass'}) || (!$FORM{'udom'})) { 351: failed($r,'Username, password and domain need to be specified.'); 352: return OK; 353: } 354: 355: # split user logging in and "su"-user 356: 357: ($FORM{'uname'},$FORM{'suname'})=split(/\:/,$FORM{'uname'}); 358: $FORM{'uname'} =~ s/\W//g; 359: $FORM{'suname'} =~ s/\W//g; 360: $FORM{'udom'} =~ s/\W//g; 361: 362: my $role = $r->dir_config('lonRole'); 363: my $domain = $r->dir_config('lonDefDomain'); 364: my $prodir = $r->dir_config('lonUsersDir'); 365: 366: # ---------------------------------------- Get the information from login token 367: 368: my $tmpinfo=Apache::lonnet::reply('tmpget:'.$FORM{'logtoken'}, 369: $FORM{'serverid'}); 370: 371: if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) { 372: failed($r,'Information needed to verify your login information is missing, inaccessible or expired.'); 373: return OK; 374: } else { 375: unless (&Apache::lonnet::reply('tmpdel:'.$FORM{'logtoken'}, 376: $FORM{'serverid'}) eq 'ok') { 377: &failed($r,'Session could not be opened.'); 378: } 379: } 380: my ($key,$firsturl)=split(/&/,$tmpinfo); 381: 382: my $keybin=pack("H16",$key); 383: 384: my $cipher; 385: if ($Crypt::DES::VERSION>=2.03) { 386: $cipher=new Crypt::DES $keybin; 387: } 388: else { 389: $cipher=new DES $keybin; 390: } 391: 392: my $upass=$cipher->decrypt( 393: unpack("a8",pack("H16",substr($FORM{'upass'},0,16)))); 394: 395: $upass.=$cipher->decrypt( 396: unpack("a8",pack("H16",substr($FORM{'upass'},16,16)))); 397: 398: $upass=substr($upass,1,ord(substr($upass,0,1))); 399: 400: # ---------------------------------------------------------------- Authenticate 401: my $authhost=Apache::lonnet::authenticate($FORM{'uname'}, 402: $upass, 403: $FORM{'udom'}); 404: 405: # --------------------------------------------------------------------- Failed? 406: 407: if ($authhost eq 'no_host') { 408: failed($r,'Username and/or password could not be authenticated.'); 409: return OK; 410: } 411: 412: if (($firsturl eq '') || 413: ($firsturl=~/^\/adm\/(logout|remote)/)) { 414: $firsturl='/adm/roles'; 415: } 416: # --------------------------------- Are we attempting to login as somebody else? 417: if ($FORM{'suname'}) { 418: # ------------ see if the original user has enough privileges to pull this stunt 419: if (&Apache::lonnet::privileged($FORM{'uname'},$FORM{'udom'})) { 420: # ---------------------------------------------------- see if the su-user exists 421: unless (&Apache::lonnet::homeserver($FORM{'suname'},$FORM{'udom'}) 422: eq 'no_host') { 423: &Apache::lonnet::logthis(&Apache::lonnet::homeserver($FORM{'suname'},$FORM{'udom'})); 424: # ------------------------------ see if the su-user is not too highly privileged 425: unless (&Apache::lonnet::privileged($FORM{'suname'},$FORM{'udom'})) { 426: # -------------------------------------------------------- actually switch users 427: &Apache::lonnet::logperm('User '.$FORM{'uname'}.' at '.$FORM{'udom'}. 428: ' logging in as '.$FORM{'suname'}); 429: $FORM{'uname'}=$FORM{'suname'}; 430: } else { 431: &Apache::lonnet::logthis('Attempted switch user to privileged user'); 432: } 433: } 434: } else { 435: &Apache::lonnet::logthis('Non-privileged user attempting switch user'); 436: } 437: } 438: &success($r,$FORM{'uname'},$FORM{'udom'},$authhost,$firsturl); 439: return OK; 440: } 441: 442: 1; 443: __END__ 444: 445: