--- loncom/interface/multidownload.pl	2017/11/03 18:08:54	1.40
+++ loncom/interface/multidownload.pl	2017/11/05 18:19:41	1.41
@@ -2,7 +2,7 @@
 # CGI-script to allow download of all essay submissions of 
 # multiple students.
 #
-# $Id: multidownload.pl,v 1.40 2017/11/03 18:08:54 raeburn Exp $
+# $Id: multidownload.pl,v 1.41 2017/11/05 18:19:41 raeburn Exp $
 # Copyright Michigan State University Board of Trustees
 #
 # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
@@ -31,6 +31,7 @@ use LONCAPA::loncgi;
 use File::Path;
 use File::Basename;
 use File::Copy;
+use Archive::Zip qw( :ERROR_CODES );
 use Apache::lonhtmlcommon();
 use Apache::lonnavmaps();
 use Apache::loncommon();
@@ -38,6 +39,7 @@ use Apache::lonlocal;
 use Apache::lonmsg();
 use Apache::lonnet;
 use LONCAPA::Enrollment;
+use LONCAPA;
 use strict;
 
 sub is_flat {
@@ -74,7 +76,7 @@ sub get_part_resp_path {
 $|=1;
 &Apache::lonlocal::get_language_handle();
 &Apache::loncommon::content_type(undef,'text/html');
-my ($nocookie,$identifier,$unique_path,$scope);
+my ($nocookie,$identifier,$unique_path,$scope,$unique_user);
 if (! &LONCAPA::loncgi::check_cookie_and_load_env()) {
     print(&LONCAPA::loncgi::missing_cookie_msg());
     $nocookie = 1;
@@ -89,6 +91,10 @@ unless ($nocookie) {
         $identifier = $ENV{'QUERY_STRING'};
         $unique_path = $identifier.time();
     }
+    if (($env{'user.name'} =~ /^$LONCAPA::match_username$/) &&
+        ($env{'user.domain'} =~ /^$LONCAPA::match_domain$/)) {
+        $unique_user = $env{'user.name'}.':'.$env{'user.domain'};
+    }
     print(&Apache::loncommon::start_page('Multiple Downloads'));
 }
 if ($scope eq '') {
@@ -101,6 +107,14 @@ if ($scope eq '') {
             print(&mt('You are not authorized to download student submissions.'));
         }
     }
+} elsif ($unique_user eq '') {
+    unless ($nocookie) {
+        if (&Apache::lonnet::allowed('vgr',$scope) eq 'F') {
+            print(&mt('Characters in your username and/or domain prevent download of submissions.'));
+        } else {
+            print(&mt('You are not authorized to download student submissions.'));
+        }
+    }
 } elsif (&Apache::lonnet::allowed('vgr',$scope) eq 'F') {
     my $symb = $env{'cgi.'.$identifier.'.symb'};
     my $navmap = Apache::lonnavmaps::navmap->new();
@@ -109,6 +123,7 @@ if ($scope eq '') {
     my ($flat_part, $flat_resp) = &is_flat($partlist, $res);
     my ($zipout) = ($symb =~ /^.*\/(.+)\.problem$/);
     $zipout =~ s/\s/_/g;
+    $zipout =~ s/[^\w.\-]+//g;
     $zipout .= "$identifier.zip";
     my $courseid = $env{'request.course.id'};
     my @stuchecked = split(/\n/,$env{'cgi.'.$identifier.'.students'});
@@ -116,11 +131,10 @@ if ($scope eq '') {
     my %prog_state=&Apache::lonhtmlcommon::Create_PrgWin('',$number_of_students);
     my @parts = split(/\n/,$env{'cgi.'.$identifier.'.parts'});
     my $doc_zip_root = $Apache::lonnet::perlvar{'lonZipDir'};
-    my $uname = $env{'user.name'};
-    my $udom = $env{'user.domain'};
-    my $unique_user = $uname.":".$udom;
     my $manifest;
-    &mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path",0,0700);
+    unless (-d "$doc_zip_root/zipdir/$unique_user/$unique_path") {
+        &File::Path::mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path",0,0700);
+    }
     if (open(MANIFEST, ">$doc_zip_root/zipdir/$unique_user/$unique_path/manifest.txt")) {
         $manifest = 1;
         print MANIFEST (&mt("Zip file generated on [_1]",&Apache::lonlocal::locallocaltime(time()))."\n");
@@ -148,7 +162,7 @@ if ($scope eq '') {
             my @ids = $res->responseIds($partid);
             foreach my $respid (@ids) {
                 my $part_resp_path = &get_part_resp_path($flat_part,$flat_resp, $partid, $respid);
-                &mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path/$stuname/$part_resp_path",0,0700);
+                &File::Path::mkpath($doc_zip_root."/zipdir/$unique_user/$unique_path/$stuname/$part_resp_path",0,0700);
                 foreach my $origin ('portfiles','uploadedurl') {
                     my @files;
                     if ($record{"resource.$partid.$respid.$origin"} ne '') {
@@ -194,27 +208,41 @@ if ($scope eq '') {
             print MANIFEST ("\t".&mt("No Files Submitted")."\n");
         }
     }
-    
-    &mkpath($doc_zip_root."/zipout/$unique_user",0,0700);
-    my $statement;
-    if (! -e "$doc_zip_root/zipout/$unique_user/$zipout") {
-        $statement = "cd $doc_zip_root/zipdir/$unique_user/$unique_path\n";
-        $statement .= "zip -r $doc_zip_root/zipout/$unique_user/$zipout * > /dev/null";
-        system($statement);
-    } else {
-        # should happen only if user reloads page 
-        &Apache::lonnet::logthis("$zipout is already there");
-    }
-    $statement = "rm -rf $doc_zip_root/zipdir/$unique_user/$unique_path";
-    system($statement);
-    &Apache::lonhtmlcommon::Close_PrgWin('',\%prog_state);
-    print('<p><a href="/zipspool/zipout/'.$unique_user.'/'.$zipout.'">'.
-            &mt("Click to download").'</a></p><br />');
     if ($manifest) {
         close(MANIFEST);
     }
+    my $madezip;
+    unless (-d "$doc_zip_root/zipout/$unique_user") {
+        &File::Path::mkpath($doc_zip_root."/zipout/$unique_user",0,0700);
+    }
+    if ((-d "$doc_zip_root/zipout/$unique_user") &&
+        (-d "$doc_zip_root/zipdir/$unique_user/$unique_path")) {
+        if (!-e "$doc_zip_root/zipout/$unique_user/$zipout") {
+             my $zip = Archive::Zip->new();
+             $zip->addTree("$doc_zip_root/zipdir/$unique_user/$unique_path");
+             if ($zip->writeToFileNamed("$doc_zip_root/zipout/$unique_user/$zipout") == AZ_OK) {
+                 $madezip = 1;
+             }
+        } else {
+            $madezip = 1;
+            # should happen only if user reloads page
+            &Apache::lonnet::logthis("$zipout is already there");
+        }
+        &File::Path::remove_tree("$doc_zip_root/zipdir/$unique_user/$unique_path",{ safe => 1, });
+    }
+    &Apache::lonhtmlcommon::Close_PrgWin('',\%prog_state);
+    if ($madezip) {
+        print('<p><a href="/zipspool/zipout/'.$unique_user.'/'.$zipout.'">'.
+             &mt("Click to download").'</a></p><br />');
+    } else {
+        print('<p class="LC_error">'.
+              &mt('Failed to create zip archive of student submissions').
+              '</p>');
+    }
 } else {
-    print(&mt('You are not authorized to download student submissions.'));
+    print('<p class="LC_error">'.
+          &mt('You are not authorized to download student submissions.').
+          '</p>');
 }
 unless ($nocookie) {
     print(&Apache::loncommon::end_page());