[BACK]Return to loncacc.pm CVS log [TXT] [DIR] Up to [LON-CAPA] / loncom / auth

Diff for /loncom/auth/loncacc.pm between versions 1.19 and 1.59

version 1.19, 2002/01/04 14:57:14 version 1.59, 2011/11/12 19:37:40
Line 1 Line 1
 # The LearningOnline Network  # The LearningOnline Network
 # Cookie Based Access Handler for Construction Area  # Cookie Based Access Handler for Construction Area
 # (lonacc: 5/21/99,5/22,5/29,5/31 Gerd Kortemeyer)  # (lonacc: 5/21/99,5/22,5/29,5/31 Gerd Kortemeyer)
 # 6/15,16/11,22/11,  #
 # 01/06,01/11,6/1,9/25,9/28,11/22,12/25,12/26,  # $Id$
 # 01/06/01,05/04,05/05,05/09 Gerd Kortemeyer  #
   # Copyright Michigan State University Board of Trustees
   #
   # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
   #
   # LON-CAPA is free software; you can redistribute it and/or modify
   # it under the terms of the GNU General Public License as published by
   # the Free Software Foundation; either version 2 of the License, or
   # (at your option) any later version.
   #
   # LON-CAPA is distributed in the hope that it will be useful,
   # but WITHOUT ANY WARRANTY; without even the implied warranty of
   # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   # GNU General Public License for more details.
   #
   # You should have received a copy of the GNU General Public License
   # along with LON-CAPA; if not, write to the Free Software
   # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   #
   # /home/httpd/html/adm/gpl.txt
   #
   # http://www.lon-capa.org/
   #
   
   =pod
   
   =head1 NAME
   
   Apache::lonacc - Cookie Based Access Handler for Construction Area
   
   =head1 SYNOPSIS
   
   Invoked (for various locations) by /etc/httpd/conf/loncapa_apache.conf:
   
    PerlAccessHandler       Apache::loncacc
   
   =head1 INTRODUCTION
   
   This module enables cookie based authentication for construction area
   and is used to control access for the following two types of URI 
   (one for files, and one for directories):
   
    <LocationMatch "^/priv.*">
    <LocationMatch "^/priv.*/$">
   
   Whenever the client sends the cookie back to the server, 
   if the cookie is missing or invalid, the user is re-challenged
   for login information.
   
   This is part of the LearningOnline Network with CAPA project
   described at http://www.lon-capa.org.
   
   =head1 HANDLER SUBROUTINE
   
   This routine is called by Apache and mod_perl.
   
   =over 4
   
   =item *
   
   load POST parameters
   
   =item *
   
   store where they wanted to go (first url entered)
   
   =back
   
   =head1 OTHERSUBROUTINES
   
   =over
   
   =item constructaccess($url,$setpriv)
   
   See if the owner domain and name
   in the URL match those in the expected environment.  If so, return 
   three element list ($ownername,$ownerdomain,$ownerhome).  
   
   Otherwise return the null string.
   
   If second argument 'setpriv' is true, it assigns the privileges,
   and returns the same three element list, unless the owner has
   blocked "ad hoc" Domain Coordinator access to the Author Space,
   in which case the null string is returned.
   
   =back
   
   =cut
   
   
 package Apache::loncacc;  package Apache::loncacc;
   
 use strict;  use strict;
 use Apache::Constants qw(:common :http :methods);  use Apache::Constants qw(:common :http :methods REDIRECT);
 use Apache::File;  
 use CGI::Cookie();  
 use Fcntl qw(:flock);  use Fcntl qw(:flock);
   use Apache::lonlocal;
   use Apache::lonnet;
   use Apache::lonacc;
   use LONCAPA qw(:DEFAULT :match);
   
 sub constructaccess {  sub constructaccess {
     my ($url,$ownerdomain)=@_;      my ($url,$setpriv)=@_;
     my ($ownername)=($url=~/\/(?:\~|priv\/|home\/)(\w+)/);  
     unless (($ownername) && ($ownerdomain)) { return ''; }  
   
     if (($ownername eq $ENV{'user.name'}) &&  # We do not allow editing of previous versions of files
         ($ownerdomain eq $ENV{'user.domain'})) {      if ($url=~/\.(\d+)\.(\w+)$/) { return ''; }
  return ($ownername,$ownerdomain);  
     }  
   
     my $capriv='user.priv.ca./'.  # Get username and domain from URL
                $ownerdomain.'/'.$ownername.'./'.      my $londocroot = $Apache::lonnet::perlvar{'lonDocRoot'};
        $ownerdomain.'/'.$ownername;      my ($ownername,$ownerdomain,$ownerhome);
     map {  
         if ($_ eq $capriv) {      ($ownerdomain,$ownername) = 
            return ($ownername,$ownerdomain);          ($url=~ m{^(?:\Q$londocroot\E|)/priv/($match_domain)/($match_username)/});
         }  
     } keys %ENV;  # The URL does not really point to any authorspace, forget it
       unless (($ownername) && ($ownerdomain)) { return ''; }
   
   # Now we need to see if the user has access to the authorspace of
   # $ownername at $ownerdomain
   
       if (($ownername eq $env{'user.name'}) && ($ownerdomain eq $env{'user.domain'})) {
   # Real author for this?
          $ownerhome = $env{'user.home'};
          if (exists($env{'user.priv.au./'.$ownerdomain.'/./'})) {
             return ($ownername,$ownerdomain,$ownerhome);
          }
       } else {
   # Co-author for this?
    if (exists($env{'user.priv.ca./'.$ownerdomain.'/'.$ownername.'./'}) ||
       exists($env{'user.priv.aa./'.$ownerdomain.'/'.$ownername.'./'}) ) {
       $ownerhome = &Apache::lonnet::homeserver($ownername,$ownerdomain);
       return ($ownername,$ownerdomain,$ownerhome);
    }
       }
   # We don't have any access right now. If we are not possibly going to do anything about this,
   # we might as well leave
      unless ($setpriv) { return ''; }
   
   # Backdoor access?
       my $allowed=&Apache::lonnet::allowed('eco',$ownerdomain);
   # Nope
       unless ($allowed) { return ''; }
   # Looks like we may have access, but could be locked by the owner of the construction space
       if ($allowed eq 'U') {
           my %blocked=&Apache::lonnet::get('environment',['domcoord.author'],
                                            $ownerdomain,$ownername);
   # Is blocked by owner
           if ($blocked{'domcoord.author'} eq 'blocked') { return ''; }
       }
       if (($allowed eq 'F') || ($allowed eq 'U')) {
   # Grant temporary access
           my $then=$env{'user.login.time'};
           my $update==$env{'user.update.time'};
           if (!$update) { $update = $then; }
           my $refresh=$env{'user.refresh.time'};
           if (!$refresh) { $refresh = $update; }
           my $now = time;
           &Apache::lonnet::check_adhoc_privs($ownerdomain,$ownername,
                                              $update,$refresh,$now,'ca',
                                              'constructaccess');
           $ownerhome = &Apache::lonnet::homeserver($ownername,$ownerdomain);
           return($ownername,$ownerdomain,$ownerhome);
       }
   # No business here
     return '';      return '';
 }  }
   
 sub handler {  sub handler {
     my $r = shift;      my $r = shift;
     my $requrl=$r->uri;      my $requrl=$r->uri;
     my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));      $env{'request.editurl'}=$requrl;
     my $lonid=$cookies{'lonID'};  
     my $cookie;  
     if ($lonid) {  
  my $handle=$lonid->value;  
         $handle=~s/\W//g;  
         my $lonidsdir=$r->dir_config('lonIDsDir');  
         if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {  
             my @profile;  
     {  
              my $idf=Apache::File->new("$lonidsdir/$handle.id");  
              flock($idf,LOCK_SH);  
              @profile=<$idf>;  
              $idf->close();  
     }  
             my $envi;  
             for ($envi=0;$envi<=$#profile;$envi++) {  
  chomp($profile[$envi]);  
  my ($envname,$envvalue)=split(/=/,$profile[$envi]);  
                 $ENV{$envname} = $envvalue;  
             }  
             $ENV{'user.environment'} = "$lonidsdir/$handle.id";  
             $ENV{'request.state'}    = "construct";  
             $ENV{'request.filename'} = $r->filename;  
   
             unless (&constructaccess($requrl,$r->dir_config('lonDefDomain'))) {  
                 $r->log_reason("Unauthorized $requrl", $r->filename);   
         return HTTP_NOT_ACCEPTABLE;  
             }  
   
 # -------------------------------------------------------- Load POST parameters  
   
   
         my $buffer;      my $handle =  &Apache::lonnet::check_for_valid_session($r);
       if ($handle ne '') {
   
         $r->read($buffer,$r->header_in('Content-length'));  # ------------------------------------------------------ Initialize Environment
           my $lonidsdir=$r->dir_config('lonIDsDir');
    &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
   
  unless ($buffer=~/^(\-+\w+)\s+Content\-Disposition\:\s*form\-data/si) {  # --------------------------------------------------------- Initialize Language
             my @pairs=split(/&/,$buffer);   
             my $pair;   &Apache::lonlocal::get_language_handle($r);
             foreach $pair (@pairs) {  
                my ($name,$value) = split(/=/,$pair);  # -------------------------------------------------------------- Resource State
                $value =~ tr/+/ /;  
                $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;   $env{'request.state'}    = "construct";
                $name  =~ tr/+/ /;   $env{'request.filename'} = $r->filename;
                $name  =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;  
                $ENV{"form.$name"}=$value;   my $allowed;
             }    my ($ownername,$ownerdom,$ownerhome) = &constructaccess($requrl,'setpriv');
         } else {          if (($ownername ne '') && ($ownerdom ne '') && ($ownerhome ne '')) {
     my $contentsep=$1;              unless ($ownerhome eq 'no_host') {
             my @lines = split (/\n/,$buffer);                  my @hosts = &Apache::lonnet::current_machine_ids();
             my $name='';                  if (grep(/^\Q$ownerhome\E$/,@hosts)) {
             my $value='';                      $allowed = 1;
             my $fname='';  
             my $fmime='';  
             my $i;  
             for ($i=0;$i<=$#lines;$i++) {  
  if ($lines[$i]=~/^$contentsep/) {  
     if ($name) {  
                         chomp($value);  
  if ($fname) {  
     $ENV{"form.$name.filename"}=$fname;  
                             $ENV{"form.$name.mimetype"}=$fmime;  
                         } else {  
                             $value=~s/\s+$//s;  
                         }  
                         $ENV{"form.$name"}=$value;  
                     }  
                     if ($i<$#lines) {  
  $i++;  
                         $lines[$i]=~  
  /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;  
                         $name=$1;  
                         $value='';  
                         if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {  
    $fname=$1;  
                            if   
                             ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {  
       $fmime=$1;  
                               $i++;  
    } else {  
                               $fmime='';  
                            }  
                         } else {  
     $fname='';  
                             $fmime='';  
                         }  
                         $i++;  
                     }  
                 } else {  
     $value.=$lines[$i]."\n";  
                 }                  }
             }              }
           }
   
           unless ($allowed) {
       $r->log_reason("Unauthorized $requrl", $r->filename); 
       return HTTP_NOT_ACCEPTABLE;
  }   }
     $ENV{'request.method'}=$ENV{'REQUEST_METHOD'};  
             $r->method_number(M_GET);  # -------------------------------------------------------- Load POST parameters
     $r->method('GET');  
             $r->headers_in->unset('Content-length');   &Apache::lonacc::get_posted_cgi($r);
   
             return OK;    return OK; 
         } else {       } else {
             $r->log_reason("Cookie $handle not valid", $r->filename)    $r->log_reason("Cookie $handle not valid", $r->filename) 
         };  
     }      }
   
 # ----------------------------------------------- Store where they wanted to go  # ----------------------------------------------- Store where they wanted to go
   
     $ENV{'request.firsturl'}=$requrl;      $env{'request.firsturl'}=$requrl;
     return FORBIDDEN;      return FORBIDDEN;
 }  }
   
 1;  1;
 __END__  __END__
   
   
   
   
   
   
   
   
Removed from v.1.19  
changed lines
  Added in v.1.59

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>