--- loncom/publisher/loncfile.pm	2010/11/27 23:20:46	1.104
+++ loncom/publisher/loncfile.pm	2011/10/23 01:27:34	1.109
@@ -9,7 +9,7 @@
 #  and displays a page showing the results of the action.
 #
 #
-# $Id: loncfile.pm,v 1.104 2010/11/27 23:20:46 raeburn Exp $
+# $Id: loncfile.pm,v 1.109 2011/10/23 01:27:34 www Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -168,14 +168,16 @@ sub URLToPath {
 
 sub url {
     my $fn=shift;
-    $fn=~s/^\/home\/($match_username)\/public\_html/\/priv\/$1/;
+    $fn=~s/^\/home\/httpd\/html//;
+    $fn=~s/\/\.\//\//g;
     $fn=&HTML::Entities::encode($fn,'<>"&');
     return $fn;
 }
 
 sub display {
     my $fn=shift;
-    $fn=~s-^/home/($match_username)/public_html-/priv/$1-;
+    $fn=~s/^\/home\/httpd\/html//;
+    $fn=~s/\/\.\//\//g;
     return '<span class="LC_filename">'.$fn.'</span>';
 }
 
@@ -270,8 +272,7 @@ sub exists {
     $creating ||= 'file';
 
     my $published=$construct;
-    $published=~
-	s{^/home/$user/public_html/}{/home/httpd/html/res/$domain/$user/};
+    $published=~s{^/home/httpd/html/priv/}{/home/httpd/html/res/};
     my ($type,$result);
     if ( -d $construct ) {
 	return ('error','<p><span class="LC_error">'.&mt('Error: destination for operation is an existing directory.').'</span></p>');
@@ -345,9 +346,10 @@ sub checksuffix {
 }
 
 sub cleanDest {
-    my ($request,$dest,$subdir,$fn,$uname)=@_;
+    my ($request,$dest,$subdir,$fn,$uname,$udom)=@_;
     #remove bad characters
     my $foundbad=0;
+    my $error='';
     if ($subdir && $dest =~/\./) {
 	$foundbad=1;
 	$dest=~s/\.//g;
@@ -359,7 +361,7 @@ sub cleanDest {
     }
     if ($dest=~m|/|) {
 	my ($newpath)=($dest=~m|(.*)/|);
-	$newpath=&relativeDest($fn,$newpath,$uname);
+	($newpath,$error)=&relativeDest($fn,$newpath,$uname,$udom);
 	if (! -d "$newpath") {
 	    $request->print('<p><span class="LC_warning">'
                            .&mt("You have requested to create file in directory [_1] which doesn't exist. The requested directory path has been removed from the requested file name."
@@ -384,14 +386,15 @@ sub cleanDest {
                         .'</span></p>'
         );
     }
-    return $dest;
+    return ($dest,$error);
 }
 
 sub relativeDest {
-    my ($fn,$newfilename,$uname)=@_;
+    my ($fn,$newfilename,$uname,$udom)=@_;
+    my $error = '';
     if ($newfilename=~/^\//) {
 # absolute, simply add path
-	$newfilename='/home/'.$uname.'/public_html/';
+	$newfilename='/home/httpd/html/res/'.$udom.'/'.$uname.'/';
     } else {
 	my $dir=$fn;
 	$dir=~s/\/[^\/]+$//;
@@ -401,7 +404,18 @@ sub relativeDest {
     while ($newfilename=~m:/\.\./:) {
 	$newfilename=~ s:/[^/]+/\.\./:/:g; #remove dir/..
     }
-    return $newfilename;
+    if ($newfilename =~ m{^/home/($match_username)/(?:public\_html|priv)/}) {
+        my $otheruname = $1;
+        unless ($otheruname eq $uname) {
+            my ($authorname,$authordom)=
+                &Apache::loncacc::constructaccess($newfilename,$env{'request.role.domain'});
+            unless (($authorname eq $otheruname) && ($authordom ne '')) {
+                my $otherdir = &display($newfilename);
+                $error = &mt('Access denied to [_1]',$otherdir);
+            }
+        }
+    }
+    return ($newfilename,$error);
 }
 
 =pod
@@ -936,8 +950,23 @@ sub phaseone {
   
     my $doingdir=0;
     if ($env{'form.action'} eq 'newdir') { $doingdir=1; }
-    my $newfilename=&cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname);
-    $newfilename=&relativeDest($fn,$newfilename,$uname);
+    my ($newfilename,$error) = 
+        &cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname,$udom);
+    unless ($error) {
+        ($newfilename,$error)=&relativeDest($fn,$newfilename,$uname,$udom);
+    }
+    if ($error) {
+        my $dirlist;
+        if ($fn=~m{^(.*/)[^/]+$}) {
+            $dirlist=$1;
+        } else {
+            $dirlist=$fn; 
+        }
+        $r->print('<div class="LC_error">'.$error.'</div>'.
+                  '<h3><a href="'.&url($dirlist).'">'.&mt('Return to Directory').
+                  '</a></h3>');
+        return;
+    }
     $r->print('<form action="/adm/cfile" method="post">'.
 	      '<input type="hidden" name="qualifiedfilename" value="'.$fn.'" />'.
 	      '<input type="hidden" name="phase" value="two" />'.
@@ -1471,7 +1500,7 @@ function writeDone() {
     $r->print('<h3>'.&mt('Location').': '.&display($fn).'</h3>');
   
     if (($uname ne $env{'user.name'}) || ($udom ne $env{'user.domain'})) {
-        $r->print('<p class="LC_warning">'
+        $r->print('<p class="LC_info">'
                  .&mt('Co-Author [_1]',$uname.':'.$udom)
                  .'</p>'
         );