--- loncom/auth/switchserver.pm	2010/07/20 02:42:33	1.27
+++ loncom/auth/switchserver.pm	2010/07/22 21:44:25	1.28
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Switch Servers Handler
 #
-# $Id: switchserver.pm,v 1.27 2010/07/20 02:42:33 raeburn Exp $
+# $Id: switchserver.pm,v 1.28 2010/07/22 21:44:25 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -34,6 +34,7 @@ use Apache::lonnet;
 use Apache::lonmenu;
 use CGI::Cookie();
 use Apache::lonlocal;
+use LONCAPA qw(:DEFAULT :match);
 
 sub init_env {
     my ($r) = @_;
@@ -83,7 +84,6 @@ sub handler {
 	    $env{'form.otherserver'} = 
 		&Apache::lonnet::spareserver(30000,undef,1);
 	}
-        
 	$switch_to=&Apache::lonnet::hostname($env{'form.otherserver'});
     }
 
@@ -95,28 +95,47 @@ sub handler {
 	return &do_redirect($r,$url,1)
     }
 
-    my $canhost = 1;
-    my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary');
-    my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id);
-    my @intdoms = &Apache::lonnet::get_internet_names($env{'form.otherserver'});
-    unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) {
-        my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to);
-        my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID);
-        my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom);
-        my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'});
-        my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'});
-        $canhost = 
-            &Apache::lonnet::can_host_session($env{'user.domain'},
-                                              $env{'form.otherserver'},
-                                              $remoterev,
-                                              $udomdefaults{'remotesessions'},
-                                              $defdomdefaults{'hostedsessions'});
+    my $skip_canhost_check = '';
+    if ($env{'form.role'}) {
+        if (!exists($env{'user.role.'.$env{'form.role'}})) {
+            return FORBIDDEN;
+        } else {
+            my $now = time;
+            my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}});
+            if (($start && $start > $now) || ($end && $end < $now)) {
+                return FORBIDDEN;
+            } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') {
+                if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) {
+                    $skip_canhost_check = 1;
+                }
+            } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)/$}) {
+                if (&Apache::lonnet::homeserver($2,$1) eq $env{'form.otherserver'}) {
+                    $skip_canhost_check = 1; 
+                }
+            }
+        }
     }
 
-    unless ($canhost) { return FORBIDDEN; }
-
-    if ($env{'form.role'} && 
-	!exists($env{'user.role.'.$env{'form.role'}})) { return FORBIDDEN; }
+    unless ($skip_canhost_check) {
+        my $canhost = 1;
+        my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary');
+        my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id);
+        my @intdoms = &Apache::lonnet::get_internet_names($env{'form.otherserver'});
+        unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) {
+            my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to);
+            my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID);
+            my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom);
+            my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'});
+            my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'});
+            $canhost = 
+                &Apache::lonnet::can_host_session($env{'user.domain'},
+                                                  $env{'form.otherserver'},
+                                                  $remoterev,
+                                                  $udomdefaults{'remotesessions'},
+                                                  $defdomdefaults{'hostedsessions'});
+        }
+        unless ($canhost) { return FORBIDDEN; }
+    }
 
     #remove session env, and log event
     unlink($handle);