--- loncom/interface/multidownload.pl	2008/12/30 23:18:24	1.38
+++ loncom/interface/multidownload.pl	2017/11/05 18:19:41	1.41
@@ -2,7 +2,7 @@
 # CGI-script to allow download of all essay submissions of 
 # multiple students.
 #
-# $Id: multidownload.pl,v 1.38 2008/12/30 23:18:24 raeburn Exp $
+# $Id: multidownload.pl,v 1.41 2017/11/05 18:19:41 raeburn Exp $
 # Copyright Michigan State University Board of Trustees
 #
 # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
@@ -31,6 +31,7 @@ use LONCAPA::loncgi;
 use File::Path;
 use File::Basename;
 use File::Copy;
+use Archive::Zip qw( :ERROR_CODES );
 use Apache::lonhtmlcommon();
 use Apache::lonnavmaps();
 use Apache::loncommon();
@@ -38,6 +39,7 @@ use Apache::lonlocal;
 use Apache::lonmsg();
 use Apache::lonnet;
 use LONCAPA::Enrollment;
+use LONCAPA;
 use strict;
 
 sub is_flat {
@@ -74,21 +76,46 @@ sub get_part_resp_path {
 $|=1;
 &Apache::lonlocal::get_language_handle();
 &Apache::loncommon::content_type(undef,'text/html');
+my ($nocookie,$identifier,$unique_path,$scope,$unique_user);
 if (! &LONCAPA::loncgi::check_cookie_and_load_env()) {
     print(&LONCAPA::loncgi::missing_cookie_msg());
-    return;
+    $nocookie = 1;
 }
 
-my $identifier = $ENV{'QUERY_STRING'};
-my $unique_path = $identifier.time();
-print(&Apache::loncommon::start_page('Multiple Downloads'));
-    
-
-my $scope = $env{'request.course.id'};
-if ($env{'request.course.sec'}) {
-    $scope .= '/'.$env{'request.course.sec'};
+unless ($nocookie) {
+    $scope = $env{'request.course.id'};
+    if ($env{'request.course.sec'}) {
+        $scope .= '/'.$env{'request.course.sec'};
+    }
+    if ($ENV{'QUERY_STRING'} =~ /^\d+_\d+_\d+$/) {
+        $identifier = $ENV{'QUERY_STRING'};
+        $unique_path = $identifier.time();
+    }
+    if (($env{'user.name'} =~ /^$LONCAPA::match_username$/) &&
+        ($env{'user.domain'} =~ /^$LONCAPA::match_domain$/)) {
+        $unique_user = $env{'user.name'}.':'.$env{'user.domain'};
+    }
+    print(&Apache::loncommon::start_page('Multiple Downloads'));
 }
-if (&Apache::lonnet::allowed('vgr',$scope) eq 'F') {
+if ($scope eq '') {
+    print(&mt('Invalid course context: you need to reselect your course role.'));
+} elsif ($identifier eq '') {
+    unless ($nocookie) {
+        if (&Apache::lonnet::allowed('vgr',$scope) eq 'F') {
+            print(&mt('Invalid query string; unable to download submissions.'));
+        } else {
+            print(&mt('You are not authorized to download student submissions.'));
+        }
+    }
+} elsif ($unique_user eq '') {
+    unless ($nocookie) {
+        if (&Apache::lonnet::allowed('vgr',$scope) eq 'F') {
+            print(&mt('Characters in your username and/or domain prevent download of submissions.'));
+        } else {
+            print(&mt('You are not authorized to download student submissions.'));
+        }
+    }
+} elsif (&Apache::lonnet::allowed('vgr',$scope) eq 'F') {
     my $symb = $env{'cgi.'.$identifier.'.symb'};
     my $navmap = Apache::lonnavmaps::navmap->new();
     my $res = $navmap->getBySymb($symb);
@@ -96,42 +123,46 @@ if (&Apache::lonnet::allowed('vgr',$scop
     my ($flat_part, $flat_resp) = &is_flat($partlist, $res);
     my ($zipout) = ($symb =~ /^.*\/(.+)\.problem$/);
     $zipout =~ s/\s/_/g;
+    $zipout =~ s/[^\w.\-]+//g;
     $zipout .= "$identifier.zip";
     my $courseid = $env{'request.course.id'};
     my @stuchecked = split(/\n/,$env{'cgi.'.$identifier.'.students'});
     my $number_of_students = scalar(@stuchecked);
-    my %prog_state=&Apache::lonhtmlcommon::Create_PrgWin('','Processing Status',
-                                                    'Preparing Zip File',$number_of_students,'inline','80');
+    my %prog_state=&Apache::lonhtmlcommon::Create_PrgWin('',$number_of_students);
     my @parts = split(/\n/,$env{'cgi.'.$identifier.'.parts'});
     my $doc_zip_root = $Apache::lonnet::perlvar{'lonZipDir'};
-    my $uname = $env{'user.name'};
-    my $udom = $env{'user.domain'};
-    my $unique_user = $uname.":".$udom;
-    &mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path",0,0700);
-    if (!open(MANIFEST, ">$doc_zip_root/zipdir/$unique_user/$unique_path/manifest.txt")) {
+    my $manifest;
+    unless (-d "$doc_zip_root/zipdir/$unique_user/$unique_path") {
+        &File::Path::mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path",0,0700);
+    }
+    if (open(MANIFEST, ">$doc_zip_root/zipdir/$unique_user/$unique_path/manifest.txt")) {
+        $manifest = 1;
+        print MANIFEST (&mt("Zip file generated on [_1]",&Apache::lonlocal::locallocaltime(time()))."\n");
+        print MANIFEST (&mt("Course: [_1]",$env{"course.$courseid.description"})."\n");
+        print MANIFEST (&mt("Problem: [_1]",$res->compTitle)."\n");
+        print MANIFEST (&mt("Files contained in this zip:")."\n");
+    } else {
         &Apache::lonnet::logthis("Problem making manifest");
     }
-    print MANIFEST (&mt("Zip file generated on [_1]",&Apache::lonlocal::locallocaltime(time()))."\n");
-    print MANIFEST (&mt("Course: [_1]",$env{"course.$courseid.description"})."\n");
-    print MANIFEST (&mt("Problem: [_1]",$res->compTitle)."\n");
-    print MANIFEST (&mt("Files contained in this zip:")."\n");
     my $file_problem = 0;
     my $current_student = 0;
     foreach my $stu (@stuchecked) {
         $current_student ++;
-        &Apache::lonhtmlcommon::Update_PrgWin('',\%prog_state,"Processing student $current_student of $number_of_students");
+        &Apache::lonhtmlcommon::Update_PrgWin('',\%prog_state,&mt("Processing student [_1] of [_2]",$current_student,$number_of_students));
         my %files_saved;
         my ($stuname,$studom,$fullname) = split(/:/,$stu);
         my %record = &Apache::lonnet::restore($symb,$courseid,$studom,$stuname);
         my $port_url = '/uploaded/'.$studom.'/'.$stuname.'/portfolio';
-        print MANIFEST ($fullname."\n");
+        if ($manifest) {
+            print MANIFEST ($fullname."\n");
+        }
          
         my $submission_count = 0;
         foreach my $partid (@$partlist) {
             my @ids = $res->responseIds($partid);
             foreach my $respid (@ids) {
                 my $part_resp_path = &get_part_resp_path($flat_part,$flat_resp, $partid, $respid);
-                &mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path/$stuname/$part_resp_path",0,0700);
+                &File::Path::mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path/$stuname/$part_resp_path",0,0700);
                 foreach my $origin ('portfiles','uploadedurl') {
                     my @files;
                     if ($record{"resource.$partid.$respid.$origin"} ne '') {
@@ -146,8 +177,10 @@ if (&Apache::lonnet::allowed('vgr',$scop
                             $file = $port_url.$file;
                         }
                         my ($file_name_only) = ($file =~ m{.*/([^/]+)$});
-                        print MANIFEST ("\t$file_name_only (".&mt("Part [_1]",$partid).
-                                        ") (".&mt("Response [_1]",$respid).")"."\n");
+                        if ($manifest) {
+                            print MANIFEST ("\t$file_name_only (".&mt("Part [_1]",$partid).
+                                            ") (".&mt("Response [_1]",$respid).")"."\n");
+                        }
                         $submission_count ++;
                         &Apache::lonnet::repcopy($file);
                         my $source = &Apache::lonnet::filelocation("",$file);
@@ -171,29 +204,48 @@ if (&Apache::lonnet::allowed('vgr',$scop
                 }
             }
         }
-        if (!$submission_count) {
+        if ((!$submission_count) && ($manifest)) {
             print MANIFEST ("\t".&mt("No Files Submitted")."\n");
         }
     }
-    
-    &mkpath($doc_zip_root."/zipout/$unique_user",0,0700);
-    my $statement;
-    if (! -e "$doc_zip_root/zipout/$unique_user/$zipout") {
-        $statement = "cd $doc_zip_root/zipdir/$unique_user/$unique_path\n";
-        $statement .= "zip -r $doc_zip_root/zipout/$unique_user/$zipout * > /dev/null";
-        system($statement);
-    } else {
-        # should happen only if user reloads page 
-        &Apache::lonnet::logthis("$zipout is already there");
+    if ($manifest) {
+        close(MANIFEST);
+    }
+    my $madezip;
+    unless (-d "$doc_zip_root/zipout/$unique_user") {
+        &File::Path::mkpath($doc_zip_root."/zipout/$unique_user",0,0700);
+    }
+    if ((-d "$doc_zip_root/zipout/$unique_user") &&
+        (-d "$doc_zip_root/zipdir/$unique_user/$unique_path")) {
+        if (!-e "$doc_zip_root/zipout/$unique_user/$zipout") {
+             my $zip = Archive::Zip->new();
+             $zip->addTree("$doc_zip_root/zipdir/$unique_user/$unique_path");
+             if ($zip->writeToFileNamed("$doc_zip_root/zipout/$unique_user/$zipout") == AZ_OK) {
+                 $madezip = 1;
+             }
+        } else {
+            $madezip = 1;
+            # should happen only if user reloads page
+            &Apache::lonnet::logthis("$zipout is already there");
+        }
+        &File::Path::remove_tree("$doc_zip_root/zipdir/$unique_user/$unique_path",{ safe => 1, });
     }
-    $statement = "rm -rf $doc_zip_root/zipdir/$unique_user/$unique_path";
-    system($statement);
     &Apache::lonhtmlcommon::Close_PrgWin('',\%prog_state);
-    print('<p><a href="/zipspool/zipout/'.$unique_user.'/'.$zipout.'">'.
-            &mt("Click to download").'</a></p><br />');
-    close(MANIFEST);
+    if ($madezip) {
+        print('<p><a href="/zipspool/zipout/'.$unique_user.'/'.$zipout.'">'.
+             &mt("Click to download").'</a></p><br />');
+    } else {
+        print('<p class="LC_error">'.
+              &mt('Failed to create zip archive of student submissions').
+              '</p>');
+    }
 } else {
-    print(&mt('You are not authorized to download student submissions.'));
+    print('<p class="LC_error">'.
+          &mt('You are not authorized to download student submissions.').
+          '</p>');
+}
+unless ($nocookie) {
+    print(&Apache::loncommon::end_page());
 }
 1;
 __END__;