--- loncom/lond	2017/03/13 19:09:32	1.489.2.26
+++ loncom/lond	2017/06/06 20:04:14	1.489.2.28
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.489.2.26 2017/03/13 19:09:32 raeburn Exp $
+# $Id: lond,v 1.489.2.28 2017/06/06 20:04:14 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -64,7 +64,7 @@ my $DEBUG = 0;		       # Non zero to ena
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.489.2.26 $'; #' stupid emacs
+my $VERSION='$Revision: 1.489.2.28 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -1430,12 +1430,14 @@ sub du2_handler {
 #
 #    1. for a directory, and the path does not begin with one of:
 #        (a) /home/httpd/html/res/<domain>
-#        (b) /home/httpd/html/res/userfiles/
+#        (b) /home/httpd/html/userfiles/
 #        (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles
 #    or is:
 #
-#    2. for a file, and the path (after prepending) does not begin with:
-#    /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#    2. for a file, and the path (after prepending) does not begin with one of:
+#        (a) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#        (b) /home/httpd/html/res/<domain>/<username>/
+#        (c) /home/httpd/html/userfiles/<domain>/<username>/
 #
 #    the response will be "refused".
 #
@@ -1466,8 +1468,8 @@ sub ls_handler {
     }
     if (-e $ulsdir) {
 	if(-d $ulsdir) {
-            unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) ||
-                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) {
+            unless (($ulsdir =~ m{^/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) ||
+                    ($ulsdir =~ m{^/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_name/userfiles})) {
                 &Failure($client,"refused\n",$userinput);
                 return 1;
             }
@@ -1494,7 +1496,8 @@ sub ls_handler {
 		closedir(LSDIR);
 	    }
 	} else {
-            unless ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/}) {
+            unless (($ulsdir =~ m{^/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_name/}) ||
+                    ($ulsdir =~ m{^/home/httpd/html/(?:res|userfiles)/$LONCAPA::match_domain/$LONCAPA::match_name/})) { 
                 &Failure($client,"refused\n",$userinput);
                 return 1;
             }
@@ -1527,12 +1530,14 @@ sub ls_handler {
 #
 #    1. for a directory, and the path does not begin with one of:
 #        (a) /home/httpd/html/res/<domain>
-#        (b) /home/httpd/html/res/userfiles/
+#        (b) /home/httpd/html/userfiles/
 #        (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles
 #    or is:
 #
-#    2. for a file, and the path (after prepending) does not begin with:
-#    /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#    2. for a file, and the path (after prepending) does not begin with one of:
+#        (a) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#        (b) /home/httpd/html/res/<domain>/<username>/
+#        (c) /home/httpd/html/userfiles/<domain>/<username>/
 #
 #    the response will be "refused".
 #
@@ -1562,8 +1567,8 @@ sub ls2_handler {
     }
     if (-e $ulsdir) {
         if(-d $ulsdir) {
-            unless (($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) ||
-                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/})) {
+            unless (($ulsdir =~ m{^/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) ||
+                    ($ulsdir =~ m{^/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_name/userfiles})) {
                 &Failure($client,"refused\n","$userinput");
                 return 1;
             }
@@ -1591,7 +1596,8 @@ sub ls2_handler {
                 closedir(LSDIR);
             }
         } else {
-            unless ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/}) {
+            unless (($ulsdir =~ m{^/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_name/}) ||
+                    ($ulsdir =~ m{^/home/httpd/html/(?:res|userfiles)/$LONCAPA::match_domain/$LONCAPA::match_name/})) {
                 &Failure($client,"refused\n",$userinput);
                 return 1;
             }
@@ -1616,14 +1622,17 @@ sub ls2_handler {
 #
 #    1. for a directory, and the path does not begin with one of:
 #        (a) /home/httpd/html/res/<domain>
-#        (b) /home/httpd/html/res/userfiles/
+#        (b) /home/httpd/html/userfiles/
 #        (c) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/userfiles
-#        (d) /home/httpd/html/priv/<domain>/ and client is the homeserver
+#        (d) /home/httpd/html/priv/<domain> and client is the homeserver
 #
 #    or is:
 #
-#    2. for a file, and the path (after prepending) does not begin with:
-#    /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#    2. for a file, and the path (after prepending) does not begin with one of:
+#        (a) /home/httpd/lonUsers/<domain>/<1>/<2>/<3>/<username>/
+#        (b) /home/httpd/html/res/<domain>/<username>/
+#        (c) /home/httpd/html/userfiles/<domain>/<username>/
+#        (d) /home/httpd/html/priv/<domain>/<username>/ and client is the homeserver
 #
 #    the response will be "refused".
 #
@@ -1700,9 +1709,9 @@ sub ls3_handler {
     if (-e $ulsdir) {
         if(-d $ulsdir) {
             unless (($getpropath) || ($getuserdir) ||
-                    ($ulsdir =~ m{/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) ||
-                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/userfiles/}) ||
-                    (($ulsdir =~ m{/home/httpd/html/priv/$LONCAPA::match_domain/}) && ($islocal))) {
+                    ($ulsdir =~ m{^/home/httpd/html/(res/$LONCAPA::match_domain|userfiles/)}) ||
+                    ($ulsdir =~ m{^/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_name/userfiles}) ||
+                    (($ulsdir =~ m{^/home/httpd/html/priv/$LONCAPA::match_domain}) && ($islocal))) {
                 &Failure($client,"refused\n",$userinput);
                 return 1;
             }
@@ -1731,7 +1740,9 @@ sub ls3_handler {
             }
         } else {
             unless (($getpropath) || ($getuserdir) ||
-                    ($ulsdir =~ m{/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_username/})) {
+                    ($ulsdir =~ m{^/home/httpd/lonUsers/$LONCAPA::match_domain(?:/[\w\-.@]){3}/$LONCAPA::match_name/}) ||
+                    ($ulsdir =~ m{^/home/httpd/html/(?:res|userfiles)/$LONCAPA::match_domain/$LONCAPA::match_name/}) ||
+                    (($ulsdir =~ m{^/home/httpd/html/priv/$LONCAPA::match_domain/$LONCAPA::match_name/}) && ($islocal))) {
                 &Failure($client,"refused\n",$userinput);
                 return 1;
             }
@@ -3790,6 +3801,37 @@ sub send_query_handler {
 
     my ($query,$arg1,$arg2,$arg3)=split(/\:/,$tail);
     $query=~s/\n*$//g;
+    if (($query eq 'usersearch') || ($query eq 'instdirsearch')) {
+        my $usersearchconf = &get_usersearch_config($currentdomainid,'directorysrch');
+        my $earlyout;
+        if (ref($usersearchconf) eq 'HASH') {
+            if ($currentdomainid eq $clienthomedom) {
+                if ($query eq 'usersearch') {
+                    if ($usersearchconf->{'lcavailable'} eq '0') {
+                        $earlyout = 1;
+                    }
+                } else {
+                    if ($usersearchconf->{'available'} eq '0') {
+                        $earlyout = 1;
+                    }
+                }
+            } else {
+                if ($query eq 'usersearch') {
+                    if ($usersearchconf->{'lclocalonly'}) {
+                        $earlyout = 1;
+                    }
+                } else {
+                    if ($usersearchconf->{'localonly'}) {
+                        $earlyout = 1;
+                    }
+                }
+            }
+        }
+        if ($earlyout) {
+            &Reply($client, "query_not_authorized\n");
+            return 1;
+        }
+    }
     &Reply($client, "". &sql_reply("$clientname\&$query".
 				"\&$arg1"."\&$arg2"."\&$arg3")."\n",
 	  $userinput);
@@ -7756,6 +7798,18 @@ sub get_usersession_config {
     return;
 }
 
+sub get_usersearch_config {
+    my ($dom,$name) = @_;
+    my ($usersearchconf,$cached)=&Apache::lonnet::is_cached_new($name,$dom);
+    if (defined($cached)) {
+        return $usersearchconf;
+    } else {
+        my %domconfig = &Apache::lonnet::get_dom('configuration',['directorysrch'],$dom);
+        &Apache::lonnet::do_cache_new($name,$dom,$domconfig{'directorysrch'},3600);
+        return $domconfig{'directorysrch'};
+    }
+    return;
+}
 
 sub distro_and_arch {
     return $dist.':'.$arch;