--- loncom/publisher/loncfile.pm	2010/04/13 22:28:42	1.100.2.4
+++ loncom/publisher/loncfile.pm	2011/03/01 01:36:55	1.106
@@ -9,7 +9,7 @@
 #  and displays a page showing the results of the action.
 #
 #
-# $Id: loncfile.pm,v 1.100.2.4 2010/04/13 22:28:42 raeburn Exp $
+# $Id: loncfile.pm,v 1.106 2011/03/01 01:36:55 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -348,6 +348,7 @@ sub cleanDest {
     my ($request,$dest,$subdir,$fn,$uname)=@_;
     #remove bad characters
     my $foundbad=0;
+    my $error='';
     if ($subdir && $dest =~/\./) {
 	$foundbad=1;
 	$dest=~s/\.//g;
@@ -359,7 +360,7 @@ sub cleanDest {
     }
     if ($dest=~m|/|) {
 	my ($newpath)=($dest=~m|(.*)/|);
-	$newpath=&relativeDest($fn,$newpath,$uname);
+	($newpath,$error)=&relativeDest($fn,$newpath,$uname);
 	if (! -d "$newpath") {
 	    $request->print('<p><span class="LC_warning">'
                            .&mt("You have requested to create file in directory [_1] which doesn't exist. The requested directory path has been removed from the requested file name."
@@ -384,11 +385,12 @@ sub cleanDest {
                         .'</span></p>'
         );
     }
-    return $dest;
+    return ($dest,$error);
 }
 
 sub relativeDest {
     my ($fn,$newfilename,$uname)=@_;
+    my $error = '';
     if ($newfilename=~/^\//) {
 # absolute, simply add path
 	$newfilename='/home/'.$uname.'/public_html/';
@@ -401,7 +403,18 @@ sub relativeDest {
     while ($newfilename=~m:/\.\./:) {
 	$newfilename=~ s:/[^/]+/\.\./:/:g; #remove dir/..
     }
-    return $newfilename;
+    if ($newfilename =~ m{^/home/($match_username)/(?:public\_html|priv)/}) {
+        my $otheruname = $1;
+        unless ($otheruname eq $uname) {
+            my ($authorname,$authordom)=
+                &Apache::loncacc::constructaccess($newfilename,$env{'request.role.domain'});
+            unless (($authorname eq $otheruname) && ($authordom ne '')) {
+                my $otherdir = &display($newfilename);
+                $error = &mt('Access denied to [_1]',$otherdir);
+            }
+        }
+    }
+    return ($newfilename,$error);
 }
 
 =pod
@@ -690,15 +703,14 @@ sub Copy1 {
 	    $request->print('<br /><a href="'.&url($fn).'">'.&mt('Cancel').'</a>');
 	    return;
 	}
-
-        $request->print(
-            '<input type="hidden" name="newfilename"'
-           .' value="'.$newfilename.'" />'
-           .'<p>'
-           .&mt('Copy [_1] to [_2]?',
-                &display($fn),
-                &display($newfilename))
-           .'</p>'
+    $request->print(
+        '<input type="hidden" name="newfilename"'
+       .' value="'.$newfilename.'" />'
+       .'<p>'
+       .&mt('Copy [_1] to [_2]?',
+            &display($fn),
+            &display($newfilename))
+       .'</p>'
         );
 	&CloseForm1($request, $fn);
     } else {
@@ -757,10 +769,9 @@ sub NewDir1 {
     if ($type eq 'error') {
 	$request->print('</form>');
     } else {
-	if ($mode eq 'testbank') {
-	    $request->print('<input type="hidden" name="callingmode" value="testbank" />');
-	} elsif ($mode eq 'imsimport') {
-	    $request->print('<input type="hidden" name="callingmode" value="imsimport" />');
+	if (($mode eq 'testbank') || ($mode eq 'imsimport')) {
+	    $request->print('<input type="hidden" name="callingmode" value="'.$mode.'" />'."\n".
+                            '<input type="hidden" name="inhibitmenu" value="yes" />');
 	}
         $request->print('<input type="hidden" name="newfilename" value="'
                        .$newfilename.'" />'
@@ -859,7 +870,6 @@ sub NewFile1 {
         }
 
         my @okexts = qw(xml html xhtml htm xhtm problem page sequence rights sty task library js css txt);
-
         if (($extension eq '') || (!grep(/^\Q$extension\E/,@okexts))) {
             my $validexts = '.'.join(', .',@okexts);
             $request->print('<p class="LC_warning">'.
@@ -939,8 +949,23 @@ sub phaseone {
   
     my $doingdir=0;
     if ($env{'form.action'} eq 'newdir') { $doingdir=1; }
-    my $newfilename=&cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname);
-    $newfilename=&relativeDest($fn,$newfilename,$uname);
+    my ($newfilename,$error) = 
+        &cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname);
+    unless ($error) {
+        ($newfilename,$error)=&relativeDest($fn,$newfilename,$uname);
+    }
+    if ($error) {
+        my $dirlist;
+        if ($fn=~m{^(.*/)[^/]+$}) {
+            $dirlist=$1;
+        } else {
+            $dirlist=$fn; 
+        }
+        $r->print('<div class="LC_error">'.$error.'</div>'.
+                  '<h3><a href="'.&url($dirlist).'">'.&mt('Return to Directory').
+                  '</a></h3>');
+        return;
+    }
     $r->print('<form action="/adm/cfile" method="post">'.
 	      '<input type="hidden" name="qualifiedfilename" value="'.$fn.'" />'.
 	      '<input type="hidden" name="phase" value="two" />'.
@@ -1073,10 +1098,11 @@ sub Rename2 {
 	    unlink $tmp2;
 	}
     } else {
-        $request->print('<p>'
-                       .&mt('No such file: [_1]',
-                            &display($oldfile))
-                       .'</p></form>'
+        $request->print(
+            '<p>'
+           .&mt('No such file: [_1]',
+                &display($oldfile))
+           .'</p></form>'
         );
 	return 0;
     }
@@ -1450,14 +1476,30 @@ function writeDone() {
 	$loaditem{'onload'} = "writeDone()";
     }
     
+    # Breadcrumbs
+    &Apache::lonhtmlcommon::clear_breadcrumbs();
+    &Apache::lonhtmlcommon::add_breadcrumb({
+        'text'  => 'Construction Space',
+        'href'  => &Apache::loncommon::authorspace(),
+    });
+    &Apache::lonhtmlcommon::add_breadcrumb({
+        'text'  => 'File Operation',
+        'title' => 'Construction Space File Operation',
+        'href'  => '',
+    });
+
     $r->print(&Apache::loncommon::start_page('Construction Space File Operation',
 					     $js,
-					     {'add_entries' => \%loaditem,}));
-
+					     {'add_entries' => \%loaditem,})
+             .&Apache::lonhtmlcommon::breadcrumbs()
+             .&Apache::loncommon::head_subbox(
+                  &Apache::loncommon::CSTR_pageheader())
+    );
+  
     $r->print('<h3>'.&mt('Location').': '.&display($fn).'</h3>');
   
     if (($uname ne $env{'user.name'}) || ($udom ne $env{'user.domain'})) {
-        $r->print('<p class="LC_warning">'
+        $r->print('<p class="LC_info">'
                  .&mt('Co-Author [_1]',$uname.':'.$udom)
                  .'</p>'
         );