--- loncom/auth/lonroles.pm	2021/04/22 20:14:22	1.348
+++ loncom/auth/lonroles.pm	2021/11/16 05:20:02	1.355
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # User Roles Screen
 #
-# $Id: lonroles.pm,v 1.348 2021/04/22 20:14:22 raeburn Exp $
+# $Id: lonroles.pm,v 1.355 2021/11/16 05:20:02 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -158,12 +158,21 @@ sub start_loading_course {
     my $brcrum = [{'href' => '',
                    'text' => $title},];
     my $start_page = &Apache::loncommon::start_page($title,undef,
-                                                    {'bread_crumbs' => $brcrum,});
+                                                    {'bread_crumbs' => $brcrum,
+                                                     'bread_crumbs_nomenu' => 1,
+                                                     'links_disabled' => 1});
     $r->print(<<ENDREDIR);
 $start_page
 <script type="text/javascript">
 // <![CDATA[
 $swinfo
+
+document.body.addEventListener('click', function (event) {
+  // filter out clicks on any other elements
+  if (event.target.nodeName == 'A' && event.target.getAttribute('aria-disabled') == 'true') {
+    event.preventDefault();
+  }
+});
 // ]]>
 </script>
 ENDREDIR
@@ -172,8 +181,7 @@ ENDREDIR
 
 sub finish_loading_course {
     my ($r,$msg,$url) = @_;
-#FIXME add continue link, and add jquery to enable menu links when page is loaded
-    my $link;
+    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.$url.'">'.&mt('Continue').'</a></div>';
     my $end_page = &Apache::loncommon::end_page();
     my $js_url = &js_escape($url);
     $r->print(<<END);
@@ -181,6 +189,9 @@ $msg
 <script type="text/javascript">
 // <![CDATA[
 \$(document).ready(function() {
+    \$("#LC_course_loaded").css("display","block");
+    \$('.isDisabled > a').removeAttr("aria-disabled");
+    \$('.isDisabled').removeClass("isDisabled");
     var url = "$js_url";
     \$(location).attr('href',url);
 });
@@ -266,6 +277,43 @@ sub handler {
         $update = $then;
     }
 
+    my $norolelist;
+    if (($env{'request.course.id'}) && ($env{'request.deeplink.login'})) {
+        my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
+        my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
+        my $crstype = $env{'course.'.$env{'request.course.id'}.'.type'};
+        my $deeplink_symb = &Apache::loncommon::deeplink_login_symb($cnum,$cdom);
+        if ($deeplink_symb) {
+            my ($menucoll,$deeplinkmenu,$menuref) = &Apache::loncommon::menucoll_in_effect();
+            if (ref($menuref) eq 'HASH') {
+                unless (($menuref->{'role'}) || ($env{'request.role.adv'})) {
+                    foreach my $envkey (keys(%env)) {
+                        next unless ($envkey =~ /^form\./);
+                        if ($envkey =~ m{\./($match_domain)/($match_courseid)(?:/(\w+)|$)}) {
+                            unless (($1 eq $cdom) && ($2 eq $cnum)) {
+                                delete($env{$envkey});
+                            }
+                        }
+                    }
+                    if ($env{'form.selectrole'}) {
+                        if ($env{'form.switchrole'} =~ m{\./($match_domain)/($match_courseid)(?:/(\w+)|$)}) {
+                            unless (($1 eq $cdom) && ($2 eq $cnum)) {
+                                delete($env{'form.selectrole'});
+                                delete($env{'form.switchrole'});
+                            }
+                        } elsif ($env{'form.newrole'} =~ m{\./($match_domain)/($match_courseid)(?:/(\w+)|$)}) {
+                            unless (($1 eq $cdom) && ($2 eq $cnum)) {
+                                delete($env{'form.selectrole'});
+                                delete($env{'form.newrole'});
+                            }
+                        }
+                    }
+                    $norolelist = 1;
+                }
+            }
+        }
+    }
+
     $registered_cleanup=0;
     @{$rosterupdates}=();
     &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'});
@@ -831,8 +879,9 @@ ENDCLOSE
                                             if (($dest =~ m{^\Q/public/$cdom/$cnum/syllabus\E.*(\?|\&)usehttp=1}) ||
                                                 ($dest =~ m{^\Q/adm/wrapper/ext/\E(?!https:)})) {
                                                 if ($ENV{'SERVER_PORT'} == 443) {
-                                                    unless (&Apache::lonnet::uses_sts()) {
-                                                        my $hostname = $r->hostname();
+                                                    my $hostname = $r->hostname();
+                                                    unless ((&Apache::lonnet::uses_sts()) ||
+                                                            (&Apache::lonnet::waf_allssl($hostname))) {
                                                         if ($hostname ne '') {
                                                             $dest = 'http://'.$hostname.$dest;
                                                         }
@@ -874,6 +923,9 @@ ENDCLOSE
                                                 $dest .= (($dest =~/\?/)? '&':'?').'symb='.$esc_symb;
                                             }
                                         }
+                                        if ($env{'form.ttoken'}) {
+                                            $dest .= (($dest =~/\?/)? '&':'?').'ttoken='.$env{'form.ttoken'};
+                                        }
                                         unless ($env{'request.lti.login'}) {
                                             $msg = '<p>'.&mt('Entering [_1] ...',
                                                              $env{'course.'.$cdom.'_'.$cnum.'.description'}).
@@ -901,23 +953,44 @@ ENDCLOSE
 				    }
 				}
                                 # Are we allowed to look at the first resource?
-                                my $access;
-                                if ($furl =~ m{^(/adm/wrapper|)/ext/}) {
-                                    # If it's an external resource,
-                                    # strip off the symb argument and possible query
-                                    my ($exturl,$symb) = ($furl =~ m{^(.+)(?:\?|\&)symb=(.+)$});
-                                    # Unencode $symb
-                                    $symb = &unescape($symb);
-                                    # Then check for permission
-                                    $access = &Apache::lonnet::allowed('bre',$exturl,$symb);
-                                # For other resources just check for permission
+                                #
+                                # $furl returned by lonuserstate::readmap() has format:
+                                # $url?symb=escaped($symb). If the resource has the 
+                                # encrypturl parameter in effect, the entire string
+                                # $url?symb=escaped($symb) is encrypted as a string
+                                # beginning /enc/.
+                                # 
+                                my ($access,$unencfurl,$unencsymb);
+                                if ($furl =~ m{^(.+)(?:\?|\&)symb=([^&]+)(?:$|&)}) {
+                                    my ($poss_url,$poss_symb) = ($1,$2);
+                                    $unencsymb = &unescape($poss_symb);
+                                    $unencfurl = $poss_url;
+                                } elsif ($furl =~ m{^/enc/}) {
+                                    my $unenc = &Apache::lonenc::unencrypted($furl);
+                                    if ($unenc =~ m{^(.+)(?:\?|\&)symb=([^&]+)(?:$|&)}) {
+                                        ($unencfurl,$unencsymb) = ($1,$2);
+                                        $unencsymb = &unescape($unencsymb);
+                                    } else {
+                                        $unencfurl = $unenc;
+                                    }
                                 } else {
-                                    $access = &Apache::lonnet::allowed('bre',$furl);
+                                    $unencfurl = $furl;
                                 }
-                                if (!$access) {
+                                if ($unencsymb) {
+                                    my $symb = &Apache::lonnet::symbclean($unencsymb);
+                                    if (($symb ne '') && (&Apache::lonnet::symbverify($symb,$unencfurl))) {
+                                        $access = &Apache::lonnet::allowed('bre',$unencfurl,$symb);
+                                    } else {
+                                        $access = &Apache::lonnet::allowed('bre',$unencfurl);
+                                    }
+                                } else {
+                                    $access = &Apache::lonnet::allowed('bre',$unencfurl);
+                                }
+                                if ((!$access) || ($access eq 'B') || ($access eq 'D')) {
                                     $furl = &Apache::lonpageflip::first_accessible_resource();
-                                } elsif ($access eq 'B') {
-                                    $furl = '/adm/navmaps?showOnlyHomework=1';
+                                    if ($furl eq '') {
+                                        $furl = '/adm/navmaps?showOnlyHomework=1';
+                                    }
                                 }
                                 if ($env{'request.lti.login'}) {
                                     undef($msg);
@@ -995,6 +1068,10 @@ ENDCLOSE
         $recent = &mt('Recent Courses');
         $standby = &mt('Course selected. Please stand by.');
     }
+    if (($norolelist) && ((split(/:/,$env{'user.error.msg'}))[2])) {
+        $crumbtext = 'Access Denied';
+        $pagetitle = 'Unauthorized';
+    }
     my $brcrum =[{href=>"/adm/roles",text=>$crumbtext}];
 
     my %roles_in_env;
@@ -1031,11 +1108,13 @@ ENDCLOSE
         $start_page=&Apache::loncommon::start_page($pagetitle,undef,
                                                   {bread_crumbs=>$brcrum,crstype=>'Placement'});
     } else {
-        $funcs = &get_roles_functions($showcount,$cattype);
-        my $crumbsright;
-        if ($env{'browser.mobile'}) {
-            $crumbsright = $funcs;
-            undef($funcs);
+        my $crumbsright);
+        unless (($norolelist) && ((split(/:/,$env{'user.error.msg'}))[2])) {
+            $funcs = &get_roles_functions($showcount,$cattype);
+            if ($env{'browser.mobile'}) {
+                $crumbsright = $funcs;
+                undef($funcs);
+            }
         }
         $start_page=&Apache::loncommon::start_page($pagetitle,undef,{bread_crumbs=>$brcrum,
                                                                      bread_crumbs_component=>$crumbsright});
@@ -1143,8 +1222,16 @@ ENDHEADER
     }
     if ($nochoose) {
 	$r->print("<h2>".&mt('Sorry ...')."</h2>\n<span class='LC_error'>".
-		  &mt('This action is currently not authorized.').'</span>'.
-		  &Apache::loncommon::end_page());
+		  &mt('This action is currently not authorized.').'</span>');
+        if ($error && $norolelist) {
+            $r->print('<br /><br /><h4><span class="LC_error">'.
+                      &mt('As your session was launched from a web page external to LON-CAPA some course content may be unavailable, including the resource you were trying to access.').
+                     '</span></h4>'.
+                     '<h4><span class="LC_error">'.
+                     &mt('You may need to login to LON-CAPA directly, or re-launch from a different external system.').
+                     '</span></h4>');
+        }
+        $r->print(&Apache::loncommon::end_page());
 	return OK;
     } else {
         if ($updateresult || $reqauthor || $hotlist) {
@@ -1218,6 +1305,26 @@ ENDHEADER
         }
     }
 
+    if ($norolelist) {
+        if ($env{'request.role'}) {
+            my ($roletext,$role_text_end) = &display_curr_role($env{'request.role'});
+            if ($roletext) {
+                $r->print(&Apache::loncommon::start_data_table('LC_textsize_mobile').
+                          &Apache::loncommon::start_data_table_row().
+                          $roletext.
+                          &Apache::loncommon::end_data_table_row());
+                if ($role_text_end) {
+                    $r->print(&Apache::loncommon::continue_data_table_row().
+                              $role_text_end.
+                              &Apache::loncommon::end_data_table_row());
+                }
+                $r->print(&Apache::loncommon::end_data_table());
+            }
+        }
+        $r->print(&Apache::loncommon::end_page());
+        return OK;
+    }
+
 # No active roles
     if ($countactive==0) {
         my $elapsed = 0;
@@ -2251,6 +2358,38 @@ sub display_cc_role {
         }
     }
     return ($roletext,$roletext_end);
+}
+
+sub display_curr_role {
+    my ($currentrole) = @_;
+    my ($roletext,$roletext_end);
+    my $advanced = $env{'user.adv'};
+    my $tryagain = $env{'form.tryagain'};
+    my ($role,$rest) = split(m{\./},$currentrole,2);
+    unless (!defined($role) || $role eq '') {
+        if ($rest =~ m{^($match_domain)/($match_courseid)(?:/(\w+)|$)}) {
+            my $cdom = $1;
+            my $cnum = $2;
+            my $csec = $3;
+            my $cid = $cdom.'_'.$cnum;
+            my $ttype = $env{'course.'.$cid.'.type'};
+            my $skipcal = 1;
+            my $tbg='LC_roles_is';
+            my $twhere = $env{'course.'.$cid.'.description'}. 
+                        ' <span class="LC_fontsize_small">'.
+                        &Apache::loncommon::syllabuswrapper(&mt('Syllabus'),$cnum,$cdom).
+                        '</span>';
+            my $trole = &Apache::lonnet::plaintext($role,$ttype,$cid);
+            if ($csec) {
+                $twhere.= '&nbsp; '.&mt('Section').':&nbsp;'.$csec;
+            }
+            if ($role ne 'st') {
+                $twhere.= '&nbsp; '.&mt('Domain').':&nbsp;'.$cdom;
+            }
+            ($roletext,$roletext_end) = &build_roletext($currentrole,$cdom,$cnum,'is',$tryagain,$advanced,'',$tbg,$trole,$twhere,'','','',1,'','','',$skipcal);
+        }
+    }
+    return ($roletext,$roletext_end);
 }
 
 sub adhoc_roles_row {