--- loncom/auth/switchserver.pm	2010/07/17 20:02:02	1.26
+++ loncom/auth/switchserver.pm	2010/09/06 15:44:05	1.30
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Switch Servers Handler
 #
-# $Id: switchserver.pm,v 1.26 2010/07/17 20:02:02 raeburn Exp $
+# $Id: switchserver.pm,v 1.30 2010/09/06 15:44:05 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -34,6 +34,7 @@ use Apache::lonnet;
 use Apache::lonmenu;
 use CGI::Cookie();
 use Apache::lonlocal;
+use LONCAPA qw(:DEFAULT :match);
 
 sub init_env {
     my ($r) = @_;
@@ -61,8 +62,15 @@ sub do_redirect {
 					'only_body'      => $only_body,});
     my $end_page   = &Apache::loncommon::end_page();
     $r->print($start_page.$extra_text.$end_page);
+    unless ($env{'user.name'} eq 'public' && ($env{'user.domain'} eq 'public')) {
+        $r->register_cleanup(\&flush_course_logs);
+    }
     return OK;
+}
 
+sub flush_course_logs {
+    &Apache::lonnet::flushcourselogs();
+    return OK;
 }
 
 sub handler {
@@ -83,7 +91,6 @@ sub handler {
 	    $env{'form.otherserver'} = 
 		&Apache::lonnet::spareserver(30000,undef,1);
 	}
-        
 	$switch_to=&Apache::lonnet::hostname($env{'form.otherserver'});
     }
 
@@ -95,23 +102,52 @@ sub handler {
 	return &do_redirect($r,$url,1)
     }
 
-    my $canhost = 1;
-    my @machinedoms = &Apache::lonnet::machine_domains($switch_to);
-    unless (grep(/^\Q$env{'user.domain'}\E/,@machinedoms)) {
-        my $machinedom = &Apache::lonnet::host_domain($env{'form.otherserver'});
-        my %defdomdefaults = &Apache::lonnet::get_domain_defaults($machinedom);
-        my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'});
-        my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'});
-        $canhost = &Apache::lonnet::can_host_session($env{'user.domain'},$machinedom,
-                                                     $remoterev,$udomdefaults{'remotesessions'},
-                                                     $defdomdefaults{'hostedsessions'});
+    my $skip_canhost_check = '';
+    if ($env{'form.role'}) {
+        if (!exists($env{'user.role.'.$env{'form.role'}})) {
+            return FORBIDDEN;
+        } else {
+            my $now = time;
+            my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}});
+            if (($start && $start > $now) || ($end && $end < $now)) {
+                return FORBIDDEN;
+            } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') {
+                if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) {
+                    $skip_canhost_check = 1;
+                }
+            } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)/$}) {
+                if (&Apache::lonnet::homeserver($2,$1) eq $env{'form.otherserver'}) {
+                    $skip_canhost_check = 1; 
+                }
+            }
+        }
+    }
+
+    unless ($skip_canhost_check) {
+        my $canhost = 1;
+        my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary');
+        my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id);
+        my @intdoms;
+        my $internet_names = &Apache::lonnet::get_internet_names($env{'form.otherserver'});
+        if (ref($internet_names) eq 'ARRAY') {
+            @intdoms = @{$internet_names};
+        }
+        unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) {
+            my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to);
+            my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID);
+            my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom);
+            my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'});
+            my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'});
+            $canhost = 
+                &Apache::lonnet::can_host_session($env{'user.domain'},
+                                                  $env{'form.otherserver'},
+                                                  $remoterev,
+                                                  $udomdefaults{'remotesessions'},
+                                                  $defdomdefaults{'hostedsessions'});
+        }
+        unless ($canhost) { return FORBIDDEN; }
     }
 
-    unless ($canhost) { return FORBIDDEN; }
-
-    if ($env{'form.role'} && 
-	!exists($env{'user.role.'.$env{'form.role'}})) { return FORBIDDEN; }
-
     #remove session env, and log event
     unlink($handle);
     my %temp=('switchserver' => time.':'.$env{'form.otherserver'},
@@ -160,7 +196,6 @@ sub handler {
 	'&amp;username='.$env{'user.name'}.
 	'&amp;token='.$token;
 # --------------------------------------------------------------- Screen Output
-    &Apache::lonnet::flushcourselogs();
     return &do_redirect($r, $url, 0);
 }