Return to lonauthcgi.pm CVS log

Up to [LON-CAPA] / loncom / cgi

- Typo.

    1: #
    2: # LON-CAPA authorization for cgi-bin scripts
    3: #
    4: # $Id: lonauthcgi.pm,v 1.2 2008/12/25 05:10:14 raeburn Exp $
    5: #
    6: # Copyright Michigan State University Board of Trustees
    7: #
    8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
    9: #
   10: # LON-CAPA is free software; you can redistribute it and/or modify
   11: # it under the terms of the GNU General Public License as published by
   12: # the Free Software Foundation; either version 2 of the License, or
   13: # (at your option) any later version.
   14: #
   15: # LON-CAPA is distributed in the hope that it will be useful,
   16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
   17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   18: # GNU General Public License for more details.
   19: #
   20: # You should have received a copy of the GNU General Public License
   21: # along with LON-CAPA; if not, write to the Free Software
   22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   23: #
   24: # /home/httpd/html/adm/gpl.txt
   25: #
   26: # http://www.lon-capa.org/
   27: #
   28: #############################################
   29: #############################################
   30: 
   31: =pod
   32: 
   33: =head1 NAME
   34: 
   35: loncgi
   36: 
   37: =head1 SYNOPSIS
   38: 
   39: Provides subroutines for checking if access to cgi pages is allowed
   40: based on IP address, or for logged-in users based on role and/or     
   41: identity. Also provides subroutines to give a user an explanation 
   42: when access is denied, and descriptions of various server status pages
   43: generated by CGI scripts which use these subroutines for authorization. 
   44: 
   45: =head1 Subroutines
   46: 
   47: =over 4
   48: 
   49: =cut
   50: 
   51: #############################################
   52: #############################################
   53: 
   54: package LONCAPA::lonauthcgi;
   55: 
   56: use strict;
   57: use lib '/home/httpd/lib/perl';
   58: use Apache::lonnet;
   59: use Apache::lonlocal;
   60: use LONCAPA;
   61: 
   62: #############################################
   63: #############################################
   64: 
   65: =pod
   66: 
   67: =item check_ipbased_access()
   68: 
   69: Inputs: $page, the identifier of the page to be viewed,
   70:         can be one of the keys in the hash from &serverstatus_titles()
   71: 
   72:         $ip, the IP address of the client requesting the page.
   73: 
   74: Returns: 1 if access is permitted for the requestor's IP.
   75:          Access is allowed if on of the following is true:
   76:          (a) the requestor IP is the loopback address
   77:          (b) Domain configurations for domains hosted on this server include
   78:              the requestor's IP as one of the specified IPs with access
   79:              to this page. (does not apply to 'ping' page type)
   80: 
   81: =cut
   82: 
   83: #############################################
   84: #############################################
   85: sub check_ipbased_access {
   86:     my ($page,$ip) = @_;
   87:     my $allowed;
   88:     if (!defined($ip)) {
   89:         $ip = $ENV{'REMOTE_ADDR'};
   90:     }
   91:     if (($page ne 'lonstatus') && ($page ne 'serverstatus')) {
   92:         if ($ip eq '127.0.0.1') {
   93:             $allowed = 1;
   94:             return $allowed;
   95:         }
   96:     }
   97:     if ($page ne 'ping') {
   98:         my @poss_domains = &Apache::lonnet::current_machine_domains();
   99:         foreach my $dom (@poss_domains) {
  100:             my %domconfig = &Apache::lonnet::get_dom('configuration',['serverstatuses'],$dom);
  101:             if (ref($domconfig{'serverstatuses'}) eq 'HASH') {
  102:                 if (ref($domconfig{'serverstatuses'}{$page}) eq 'HASH') {
  103:                     if ($domconfig{'serverstatuses'}{$page}{'machines'} ne '') {
  104:                         my @okmachines = split(/,/,$domconfig{'serverstatuses'}{$page}{'machines'});
  105:                         if (grep(/^\Q$ip\E$/,@okmachines)) {
  106:                             $allowed = 1;
  107:                             last;
  108:                         }
  109:                     }
  110:                 }
  111:             }
  112:         }
  113:     }
  114:     return $allowed;
  115: }
  116: 
  117: #############################################
  118: #############################################
  119: 
  120: =pod
  121: 
  122: =item can_view()
  123: 
  124: Inputs: $page, the identifier of the page to be viewed,
  125:         can be one of the keys in the hash from &serverstatus_titles()
  126: 
  127: Returns: 1 if access to the page is permitted.
  128:          Access allowed if one of the following is true:
  129:          (a) Requestor has LON-CAPA superuser role
  130:          (b) Requestor's role is Domain Coordinator in one of the domains
  131:              hosted on this server
  132:          (c) Domain configurations for domains hosted on this server include
  133:              the requestor as one of the named users (username:domain) with access
  134:              to the page.
  135: 
  136:          In the case of requests for the 'ping' page, and access is also allowed if
  137:          at least one domain hosted on requestor's server is also hosted on this server.
  138: 
  139: =cut
  140: 
  141: #############################################
  142: #############################################
  143: sub can_view {
  144:     my ($page) = @_;
  145:     my $allowed;
  146:     if ($Apache::lonnet::env{'request.role'} =~ m{^su\./}) {
  147:         $allowed = 1;
  148:     } elsif ($page eq 'ping') {
  149:         my @poss_domains = &Apache::lonnet::current_machine_domains();
  150:         my @hostids= &Apache::lonnet::get_hosts_from_ip($ENV{'REMOTE_ADDR'});
  151:         foreach my $hostid (@hostids) {
  152:             my $hostdom = &Apache::lonnet::host_domain($hostid);
  153:             if (grep(/^\Q$hostdom\E$/,@poss_domains)) {
  154:                 $allowed = 1;
  155:                 last;
  156:             }
  157:         }
  158:     } else {
  159:         my @poss_domains = &Apache::lonnet::current_machine_domains();
  160:         foreach my $dom (@poss_domains) {
  161:             my %domconfig = &Apache::lonnet::get_dom('configuration',['serverstatuses'],$dom);
  162:             if ($Apache::lonnet::env{'request.role'} eq "dc./$dom/") {
  163:                 $allowed = 1;
  164:             } elsif (ref($domconfig{'serverstatuses'}) eq 'HASH') {
  165:                 if (ref($domconfig{'serverstatuses'}{$page}) eq 'HASH') {
  166:                     if ($domconfig{'serverstatuses'}{$page}{'namedusers'} ne '') {
  167:                         my @okusers = split(/,/,$domconfig{'serverstatuses'}{$page}{'namedusers'});
  168:                         if (grep(/^\Q$Apache::lonnet::env{'user.name'}:$Apache::lonnet::env{'user.domain'}\E$/,@okusers)) {
  169:                             $allowed = 1;
  170:                         }
  171:                     }
  172:                 }
  173:             }
  174:             last if $allowed;
  175:         }
  176:     }
  177:     return $allowed;
  178: }
  179: 
  180: #############################################
  181: #############################################
  182: 
  183: =pod
  184: 
  185: =unauthorized_msg()
  186: 
  187: Inputs: $page, the identifier of the page to be viewed,
  188:         can be one of the keys in the hash from &serverstatus_titles()
  189: 
  190: Returns: A string explaining why access was denied for the particular page.
  191: 
  192: =cut
  193: 
  194: #############################################
  195: #############################################
  196: sub unauthorized_msg {
  197:     my ($page) = @_;
  198:     my $titles = &serverstatus_titles();
  199:     if ($page eq 'clusterstatus') {
  200:         return &mt('Your current role does not permit you to view the requested server status page: [_1]',$titles->{$page});
  201:     }
  202:     my @poss_domains = &Apache::lonnet::current_machine_domains();
  203:     if (@poss_domains == 1) {
  204:         my $domdesc = &Apache::lonnet::domain($poss_domains[0]);
  205:         return &mt('The configuration for domain: [_1] does not permit you to view the requested server status page: [_2].',"$domdesc ($poss_domains[0])",$titles->{$page});
  206:     } elsif (@poss_domains > 1) {
  207:         my $output = &mt('Configurations for the domains housed on this server: ').'<ul>';
  208:         foreach my $dom (@poss_domains) {
  209:             my $domdesc = &Apache::lonnet::domain($dom);
  210:             $output .= '<li>'.&Apache::lonnet::domain($dom).'('.$dom.')</li>';
  211:         }
  212:         $output .= '</ul>'.&mt('do not permit you to view the requested server status page: [_1]',$titles->{$page});
  213:         return $output;
  214:     } else {
  215:         return &mt('No domain information exists for this server');
  216:     }
  217: }
  218: 
  219: #############################################
  220: #############################################
  221: 
  222: =pod
  223: 
  224: =item serverstatus_titles()
  225: 
  226: Inputs: none
  227: 
  228: Returns: a reference to a hash of pages, where in the hash
  229:          keys are names of pages which employ loncgi.pm
  230:          or lonstatusacc.pm for access control,
  231:          and corresponding values are descriptions of each page
  232: 
  233: =cut
  234: 
  235: #############################################
  236: #############################################
  237: sub serverstatus_titles {
  238:     my %titles = &Apache::lonlocal::texthash (
  239:                    'userstatus'        => 'User Status Summary',
  240:                    'lonstatus'         => 'Display Detailed Report',
  241:                    'loncron'           => 'Generate Detailed Report',
  242:                    'server-status'     => 'Apache Status Page',
  243:                    'codeversions'      => 'LON-CAPA Module Versions',
  244:                    'clusterstatus'     => 'Domain status',
  245:                    'metadata_keywords' => 'Display Metadata Keywords',
  246:                    'metadata_harvest'  => 'Harvest Metadata Searches',
  247:                    'takeoffline'       => 'Offline - replace Log-in page',
  248:                    'takeonline'        => 'Online - restore Log-in page',
  249:                    'showenv'           => "Show user environment",
  250:                  );
  251:     return \%titles;
  252: }
  253: 
  254: 
  255: 1;
  256: