--- loncom/auth/lonroles.pm	2021/06/12 23:14:56	1.350
+++ loncom/auth/lonroles.pm	2021/07/19 14:26:40	1.351
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # User Roles Screen
 #
-# $Id: lonroles.pm,v 1.350 2021/06/12 23:14:56 raeburn Exp $
+# $Id: lonroles.pm,v 1.351 2021/07/19 14:26:40 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -902,23 +902,44 @@ ENDCLOSE
 				    }
 				}
                                 # Are we allowed to look at the first resource?
-                                my $access;
-                                if ($furl =~ m{^(/adm/wrapper|)/ext/}) {
-                                    # If it's an external resource,
-                                    # strip off the symb argument and possible query
-                                    my ($exturl,$symb) = ($furl =~ m{^(.+)(?:\?|\&)symb=(.+)$});
-                                    # Unencode $symb
-                                    $symb = &unescape($symb);
-                                    # Then check for permission
-                                    $access = &Apache::lonnet::allowed('bre',$exturl,$symb);
-                                # For other resources just check for permission
+                                #
+                                # $furl returned by lonuserstate::readmap() has format:
+                                # $url?symb=escaped($symb). If the resource has the 
+                                # encrypturl parameter in effect, the entire string
+                                # $url?symb=escaped($symb) is encrypted as a string
+                                # beginning /enc/.
+                                # 
+                                my ($access,$unencfurl,$unencsymb);
+                                if ($furl =~ m{^(.+)(?:\?|\&)symb=([^&]+)(?:$|&)}) {
+                                    my ($poss_url,$poss_symb) = ($1,$2);
+                                    $unencsymb = &unescape($poss_symb);
+                                    $unencfurl = $poss_url;
+                                } elsif ($furl =~ m{^/enc/}) {
+                                    my $unenc = &Apache::lonenc::unencrypted($furl);
+                                    if ($unenc =~ m{^(.+)(?:\?|\&)symb=([^&]+)(?:$|&)}) {
+                                        ($unencfurl,$unencsymb) = ($1,$2);
+                                        $unencsymb = &unescape($unencsymb);
+                                    } else {
+                                        $unencfurl = $unenc;
+                                    }
                                 } else {
-                                    $access = &Apache::lonnet::allowed('bre',$furl);
+                                    $unencfurl = $furl;
                                 }
-                                if ((!$access) || ($access eq 'D')) {
+                                if ($unencsymb) {
+                                    my $symb = &Apache::lonnet::symbclean($unencsymb);
+                                    if (($symb ne '') && (&Apache::lonnet::symbverify($symb,$unencfurl))) {
+                                        $access = &Apache::lonnet::allowed('bre',$unencfurl,$symb);
+                                    } else {
+                                        $access = &Apache::lonnet::allowed('bre',$unencfurl);
+                                    }
+                                } else {
+                                    $access = &Apache::lonnet::allowed('bre',$unencfurl);
+                                }
+                                if ((!$access) || ($access eq 'B') || ($access eq 'D')) {
                                     $furl = &Apache::lonpageflip::first_accessible_resource();
-                                } elsif ($access eq 'B') {
-                                    $furl = '/adm/navmaps?showOnlyHomework=1';
+                                    if ($furl eq '') {
+                                        $furl = '/adm/navmaps?showOnlyHomework=1';
+                                    }
                                 }
                                 if ($env{'request.lti.login'}) {
                                     undef($msg);