File:
[LON-CAPA] /
loncom /
auth /
lonacc.pm
Revision
1.154:
download - view:
text,
annotated -
select for diffs
Mon Mar 10 02:07:01 2014 UTC (10 years, 3 months ago) by
raeburn
Branches:
MAIN
CVS tags:
HEAD
- Change to address bug 6587 in lonacc.pm (rev. 1.139) was causing uploaded
xlsx files to include an extra byte (line feed), which would cause
Excel to prompt user to "repair" file after download.
- Re-enable removal of final line feed for xlsx, docx and pptx files so
uploaded file contains same number of bytes as original file.
1: # The LearningOnline Network
2: # Cookie Based Access Handler
3: #
4: # $Id: lonacc.pm,v 1.154 2014/03/10 02:07:01 raeburn Exp $
5: #
6: # Copyright Michigan State University Board of Trustees
7: #
8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
9: #
10: # LON-CAPA is free software; you can redistribute it and/or modify
11: # it under the terms of the GNU General Public License as published by
12: # the Free Software Foundation; either version 2 of the License, or
13: # (at your option) any later version.
14: #
15: # LON-CAPA is distributed in the hope that it will be useful,
16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18: # GNU General Public License for more details.
19: #
20: # You should have received a copy of the GNU General Public License
21: # along with LON-CAPA; if not, write to the Free Software
22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23: #
24: # /home/httpd/html/adm/gpl.txt
25: #
26: # http://www.lon-capa.org/
27: #
28: ###
29:
30: =head1 NAME
31:
32: Apache::lonacc - Cookie Based Access Handler
33:
34: =head1 SYNOPSIS
35:
36: Invoked (for various locations) by /etc/httpd/conf/srm.conf:
37:
38: PerlAccessHandler Apache::lonacc
39:
40: =head1 INTRODUCTION
41:
42: This module enables cookie based authentication and is used
43: to control access for many different LON-CAPA URIs.
44:
45: Whenever the client sends the cookie back to the server,
46: this cookie is handled by either lonacc.pm or loncacc.pm
47: (see srm.conf for what is invoked when). If
48: the cookie is missing or invalid, the user is re-challenged
49: for login information.
50:
51: This is part of the LearningOnline Network with CAPA project
52: described at http://www.lon-capa.org.
53:
54: =head1 HANDLER SUBROUTINE
55:
56: This routine is called by Apache and mod_perl.
57:
58: =over 4
59:
60: =item *
61:
62: transfer profile into environment
63:
64: =item *
65:
66: load POST parameters
67:
68: =item *
69:
70: check access
71:
72: =item *
73:
74: if allowed, get symb, log, generate course statistics if applicable
75:
76: =item *
77:
78: otherwise return error
79:
80: =item *
81:
82: see if public resource
83:
84: =item *
85:
86: store attempted access
87:
88: =back
89:
90: =head1 NOTABLE SUBROUTINES
91:
92: =cut
93:
94:
95: package Apache::lonacc;
96:
97: use strict;
98: use Apache::Constants qw(:common :http :methods);
99: use Apache::File;
100: use Apache::lonnet;
101: use Apache::loncommon();
102: use Apache::lonlocal;
103: use Apache::restrictedaccess();
104: use Apache::blockedaccess();
105: use Fcntl qw(:flock);
106: use LONCAPA qw(:DEFAULT :match);
107:
108: sub cleanup {
109: my ($r)=@_;
110: if (! $r->is_initial_req()) { return DECLINED; }
111: &Apache::lonnet::save_cache();
112: &Apache::lontexconvert::jsMath_reset();
113: return OK;
114: }
115:
116: sub goodbye {
117: my ($r)=@_;
118: &Apache::lonnet::goodbye();
119: return DONE;
120: }
121:
122: ###############################################
123:
124: sub get_posted_cgi {
125: my ($r,$fields) = @_;
126:
127: my $buffer;
128: if ($r->header_in('Content-length')) {
129: $r->read($buffer,$r->header_in('Content-length'),0);
130: }
131: my $content_type = $r->header_in('Content-type');
132: if ($content_type !~ m{^multipart/form-data}) {
133: my @pairs=split(/&/,$buffer);
134: my $pair;
135: foreach $pair (@pairs) {
136: my ($name,$value) = split(/=/,$pair);
137: $value =~ tr/+/ /;
138: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
139: $name =~ tr/+/ /;
140: $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
141: if (ref($fields) eq 'ARRAY') {
142: next if (!grep(/^\Q$name\E$/,@{$fields}));
143: }
144: &Apache::loncommon::add_to_env("form.$name",$value);
145: }
146: } else {
147: my ($contentsep) = ($content_type =~ /boundary=\"?([^\";,]+)\"?/);
148: my @lines = split (/\n/,$buffer);
149: my $name='';
150: my $value='';
151: my $fname='';
152: my $fmime='';
153: my $i;
154: for ($i=0;$i<=$#lines;$i++) {
155: if ($lines[$i]=~/^--\Q$contentsep\E/) {
156: if ($name) {
157: chomp($value);
158: if (($r->uri eq '/adm/portfolio') &&
159: ($name eq 'uploaddoc')) {
160: if (length($value) == 1) {
161: $value=~s/[\r\n]$//;
162: }
163: } elsif ($fname =~ /\.(xls|doc|ppt)x$/i) {
164: $value=~s/[\r\n]$//;
165: }
166: if (ref($fields) eq 'ARRAY') {
167: next if (!grep(/^\Q$name\E$/,@{$fields}));
168: }
169: if ($fname) {
170: if ($env{'form.symb'} ne '') {
171: my $size = (length($value))/(1024.0 * 1024.0);
172: if (&upload_size_allowed($name,$size,$fname) eq 'ok') {
173: $env{"form.$name.filename"}=$fname;
174: $env{"form.$name.mimetype"}=$fmime;
175: &Apache::loncommon::add_to_env("form.$name",$value);
176: }
177: } else {
178: $env{"form.$name.filename"}=$fname;
179: $env{"form.$name.mimetype"}=$fmime;
180: &Apache::loncommon::add_to_env("form.$name",$value);
181: }
182: } else {
183: $value=~s/\s+$//s;
184: &Apache::loncommon::add_to_env("form.$name",$value);
185: }
186: }
187: if ($i<$#lines) {
188: $i++;
189: $lines[$i]=~
190: /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;
191: $name=$1;
192: $value='';
193: if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {
194: $fname=$1;
195: if
196: ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {
197: $fmime=$1;
198: $i++;
199: } else {
200: $fmime='';
201: }
202: } else {
203: $fname='';
204: $fmime='';
205: }
206: $i++;
207: }
208: } else {
209: $value.=$lines[$i]."\n";
210: }
211: }
212: }
213: #
214: # Digested POSTed values
215: #
216: # Remember the way this was originally done (GET or POST)
217: #
218: $env{'request.method'}=$ENV{'REQUEST_METHOD'};
219: #
220: # There may also be stuff in the query string
221: # Tell subsequent handlers that this was GET, not POST, so they can access query string.
222: # Also, unset POSTed content length to cover all tracks.
223: #
224:
225: $r->method_number(M_GET);
226:
227: $r->method('GET');
228: $r->headers_in->unset('Content-length');
229: }
230:
231: =pod
232:
233: =over
234:
235: =item upload_size_allowed()
236:
237: Perform size checks for file uploads to essayresponse items in course context.
238:
239: Add form.HWFILESIZE.$part_$id to %env with file size (MB)
240: If file exceeds maximum allowed size, add form.HWFILETOOBIG.$part_$id to %env.
241:
242: =cut
243:
244: sub upload_size_allowed {
245: my ($name,$size,$fname) = @_;
246: if ($name =~ /^HWFILE(\w+)$/) {
247: my $ident = $1;
248: my $item = 'HWFILESIZE'.$ident;
249: my $savesize = sprintf("%.6f",$size);
250: &Apache::loncommon::add_to_env("form.$item",$savesize);
251: my $maxsize= &Apache::lonnet::EXT("resource.$ident.maxfilesize");
252: if (!$maxsize) {
253: $maxsize = 10.0; # FIXME This should become a domain configuration.
254: }
255: if ($size > $maxsize) {
256: my $warn = 'HWFILETOOBIG'.$ident;
257: &Apache::loncommon::add_to_env("form.$warn",$fname);
258: return;
259: }
260: }
261: return 'ok';
262: }
263:
264: =pod
265:
266: =item sso_login()
267:
268: handle the case of the single sign on user, at this point $r->user
269: will be set and valid; now need to find the loncapa user info, and possibly
270: balance them. If $r->user() is set this means either it was either set by
271: SSO or by checkauthen.pm, if a valid cookie was found. The latter case can
272: be identified by the third arg ($usename), except when lonacc is called in
273: an internal redirect to /adm/switchserver (e.g., load-balancing following
274: successful authentication) -- no cookie set yet. For that particular case
275: simply skip the call to sso_login().
276:
277: returns OK if it was SSO and user was handled.
278: returns undef if not SSO or no means to handle the user.
279:
280: =cut
281:
282: sub sso_login {
283: my ($r,$handle,$username) = @_;
284:
285: my $lonidsdir=$r->dir_config('lonIDsDir');
286: if (($r->user eq '') || ($username ne '') ||
287: (defined($env{'user.name'}) && (defined($env{'user.domain'}))
288: && ($handle ne ''))) {
289: # not an SSO case or already logged in
290: return undef;
291: }
292:
293: my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/);
294:
295: my $query = $r->args;
296: my %form;
297: if ($query) {
298: my @items = ('role','symb','iptoken');
299: &Apache::loncommon::get_unprocessed_cgi($query,\@items);
300: foreach my $item (@items) {
301: if (defined($env{'form.'.$item})) {
302: $form{$item} = $env{'form.'.$item};
303: }
304: }
305: }
306:
307: my %sessiondata;
308: if ($form{'iptoken'}) {
309: %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'});
310: my $delete = &Apache::lonnet::tmpdel($form{'token'});
311: }
312:
313: my $domain = $r->dir_config('lonSSOUserDomain');
314: if ($domain eq '') {
315: $domain = $r->dir_config('lonDefDomain');
316: }
317: my $home=&Apache::lonnet::homeserver($user,$domain);
318: if ($home !~ /(con_lost|no_host|no_such_host)/) {
319: &Apache::lonnet::logthis(" SSO authorized user $user ");
320: my ($is_balancer,$otherserver,$hosthere);
321: if ($form{'iptoken'}) {
322: if (($sessiondata{'domain'} eq $form{'udom'}) &&
323: ($sessiondata{'username'} eq $form{'uname'})) {
324: $hosthere = 1;
325: }
326: }
327: unless ($hosthere) {
328: ($is_balancer,$otherserver) =
329: &Apache::lonnet::check_loadbalancing($user,$domain);
330: }
331:
332: if ($is_balancer) {
333: # login but immediately go to switch server to find us a new
334: # machine
335: &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
336: $env{'request.sso.login'} = 1;
337: if (defined($r->dir_config("lonSSOReloginServer"))) {
338: $env{'request.sso.reloginserver'} =
339: $r->dir_config('lonSSOReloginServer');
340: }
341: my $redirecturl = '/adm/switchserver';
342: if ($otherserver ne '') {
343: $redirecturl .= '?otherserver='.$otherserver;
344: }
345: $r->internal_redirect($redirecturl);
346: $r->set_handlers('PerlHandler'=> undef);
347: } else {
348: # need to login them in, so generate the need data that
349: # migrate expects to do login
350: my $ip;
351: my $c = $r->connection;
352: eval {
353: $ip = $c->remote_ip();
354: };
355: if ($@) {
356: $ip = $c->client_ip();
357: }
358: my %info=('ip' => $ip,
359: 'domain' => $domain,
360: 'username' => $user,
361: 'server' => $r->dir_config('lonHostID'),
362: 'sso.login' => 1
363: );
364: foreach my $item ('role','symb') {
365: if (exists($form{$item})) {
366: $info{$item} = $form{$item};
367: }
368: }
369: unless ($info{'symb'}) {
370: unless (($r->uri eq '/adm/roles') || ($r->uri eq '/adm/sso')) {
371: $info{'origurl'} = $r->uri;
372: }
373: }
374: if ($r->dir_config("ssodirecturl") == 1) {
375: $info{'origurl'} = $r->uri;
376: }
377: if (defined($r->dir_config("lonSSOReloginServer"))) {
378: $info{'sso.reloginserver'} =
379: $r->dir_config('lonSSOReloginServer');
380: }
381: my $token =
382: &Apache::lonnet::tmpput(\%info,
383: $r->dir_config('lonHostID'));
384: $env{'form.token'} = $token;
385: $r->internal_redirect('/adm/migrateuser');
386: $r->set_handlers('PerlHandler'=> undef);
387: }
388: return OK;
389: } elsif (defined($r->dir_config('lonSSOUserUnknownRedirect'))) {
390: &Apache::lonnet::logthis(" SSO authorized unknown user $user ");
391: $r->subprocess_env->set('SSOUserUnknown' => $user);
392: $r->subprocess_env->set('SSOUserDomain' => $domain);
393: my @cancreate;
394: my %domconfig =
395: &Apache::lonnet::get_dom('configuration',['usercreation'],$domain);
396: if (ref($domconfig{'usercreation'}) eq 'HASH') {
397: if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
398: if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
399: @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
400: } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') &&
401: ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
402: @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
403: }
404: }
405: }
406: if (grep(/^sso$/,@cancreate)) {
407: $r->set_handlers('PerlHandler'=>
408: [\&Apache::createaccount::handler]);
409: $r->handler('perl-script');
410: } else {
411: $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect'));
412: $r->set_handlers('PerlHandler'=> undef);
413: }
414: return OK;
415: }
416: return undef;
417: }
418:
419: sub handler {
420: my $r = shift;
421: my $requrl=$r->uri;
422:
423: if ($requrl =~ m{^/res/adm/pages/[^/]+\.(gif|png)$}) {
424: return OK;
425: }
426:
427: if (&Apache::lonnet::is_domainimage($requrl)) {
428: return OK;
429: }
430:
431: my %user;
432: my $handle = &Apache::lonnet::check_for_valid_session($r,undef,\%user);
433:
434: unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) {
435: my $result = &sso_login($r,$handle,$user{'name'});
436: if (defined($result)) {
437: return $result;
438: }
439: }
440:
441: my ($is_balancer,$otherserver);
442:
443: if ($handle eq '') {
444: unless (($requrl eq '/adm/switchserver') && (!$r->is_initial_req())) {
445: $r->log_reason("Cookie not valid", $r->filename);
446: }
447: } elsif ($handle ne '') {
448:
449: # ------------------------------------------------------ Initialize Environment
450: my $lonidsdir=$r->dir_config('lonIDsDir');
451: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
452:
453: # --------------------------------------------------------- Initialize Language
454:
455: &Apache::lonlocal::get_language_handle($r);
456:
457: }
458:
459: # -------------------------------------------------- Should be a valid user now
460: if ($env{'user.name'} ne '' && $env{'user.domain'} ne '') {
461: # -------------------------------------------------------------- Resource State
462:
463: my ($cdom,$cnum);
464: if ($env{'request.course.id'}) {
465: $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
466: $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
467: }
468: if ($requrl=~/^\/+(res|uploaded)\//) {
469: $env{'request.state'} = "published";
470: } else {
471: $env{'request.state'} = 'unknown';
472: }
473: $env{'request.filename'} = $r->filename;
474: $env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
475: my $suppext;
476: if ($requrl =~ m{^/adm/wrapper/ext/}) {
477: my $query = $r->args;
478: if ($query) {
479: my $preserved;
480: foreach my $pair (split(/&/,$query)) {
481: my ($name, $value) = split(/=/,$pair);
482: unless ($name eq 'symb') {
483: $preserved .= $pair.'&';
484: }
485: if (($env{'request.course.id'}) && ($name eq 'folderpath')) {
486: if ($value =~ /^supplemental/) {
487: $suppext = 1;
488: }
489: }
490: }
491: $preserved =~ s/\&$//;
492: if ($preserved) {
493: $env{'request.external.querystring'} = $preserved;
494: }
495: }
496: } elsif ($env{'request.course.id'} &&
497: (($requrl =~ m{^/adm/$match_domain/$match_username/aboutme$}) ||
498: ($requrl =~ m{^/public/$cdom/$cnum/syllabus$}))) {
499: my $query = $r->args;
500: if ($query) {
501: foreach my $pair (split(/&/,$query)) {
502: my ($name, $value) = split(/=/,$pair);
503: if ($name eq 'folderpath') {
504: if ($value =~ /^supplemental/) {
505: $suppext = 1;
506: }
507: }
508: }
509: }
510: }
511: # -------------------------------------------------------- Load POST parameters
512:
513: &Apache::lonacc::get_posted_cgi($r);
514:
515: # ------------------------------------------------------ Check if load balancer
516:
517: my $checkexempt;
518: if ($env{'user.loadbalexempt'} eq $r->dir_config('lonHostID')) {
519: if ($env{'user.loadbalcheck.time'} + 600 > time) {
520: $checkexempt = 1;
521: }
522: }
523: if ($env{'user.noloadbalance'} eq $r->dir_config('lonHostID')) {
524: $checkexempt = 1;
525: }
526: unless ($checkexempt) {
527: ($is_balancer,$otherserver) =
528: &Apache::lonnet::check_loadbalancing($env{'user.name'},
529: $env{'user.domain'});
530: }
531: if ($is_balancer) {
532: $r->set_handlers('PerlResponseHandler'=>
533: [\&Apache::switchserver::handler]);
534: if ($otherserver ne '') {
535: $env{'form.otherserver'} = $otherserver;
536: }
537: unless (($env{'form.origurl'}) || ($r->uri eq '/adm/roles') ||
538: ($r->uri eq '/adm/switchserver') || ($r->uri eq '/adm/sso')) {
539: $env{'form.origurl'} = $r->uri;
540: }
541: }
542:
543: # ---------------------------------------------------------------- Check access
544: my $now = time;
545: if ($requrl !~ m{^/(?:adm|public|prtspool)/}
546: || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
547: my $access=&Apache::lonnet::allowed('bre',$requrl);
548: if ($access eq '1') {
549: $env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
550: return HTTP_NOT_ACCEPTABLE;
551: }
552: if ($access eq 'A') {
553: &Apache::restrictedaccess::setup_handler($r);
554: return OK;
555: }
556: if ($access eq 'B') {
557: &Apache::blockedaccess::setup_handler($r);
558: return OK;
559: }
560: if (($access ne '2') && ($access ne 'F')) {
561: if ($requrl =~ m{^/res/}) {
562: $access = &Apache::lonnet::allowed('bro',$requrl);
563: if ($access ne 'F') {
564: if ($requrl eq '/res/lib/templates/simpleproblem.problem/smpedit') {
565: $access = &Apache::lonnet::allowed('bre','/res/lib/templates/simpleproblem.problem');
566: if ($access ne 'F') {
567: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
568: return HTTP_NOT_ACCEPTABLE;
569: }
570: } else {
571: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
572: return HTTP_NOT_ACCEPTABLE;
573: }
574: }
575: } else {
576: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
577: return HTTP_NOT_ACCEPTABLE;
578: }
579: }
580: }
581: if ($requrl =~ m|^/prtspool/|) {
582: my $start='/prtspool/'.$env{'user.name'}.'_'.
583: $env{'user.domain'};
584: if ($requrl !~ /^\Q$start\E/) {
585: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
586: return HTTP_NOT_ACCEPTABLE;
587: }
588: }
589: if ($requrl =~ m|^/zipspool/|) {
590: my $start='/zipspool/zipout/'.$env{'user.name'}.":".
591: $env{'user.domain'};
592: if ($requrl !~ /^\Q$start\E/) {
593: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
594: return HTTP_NOT_ACCEPTABLE;
595: }
596: }
597: if ($env{'user.name'} eq 'public' &&
598: $env{'user.domain'} eq 'public' &&
599: $requrl !~ m{^/+(res|public|uploaded)/} &&
600: $requrl !~ m{^/adm/[^/]+/[^/]+/aboutme/portfolio$ }x &&
601: $requrl !~ m{^/adm/blockingstatus/.*$} &&
602: $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) {
603: $env{'request.querystring'}=$r->args;
604: $env{'request.firsturl'}=$requrl;
605: return FORBIDDEN;
606: }
607: # ------------------------------------------------------------- This is allowed
608: if ($env{'request.course.id'}) {
609: &Apache::lonnet::countacc($requrl);
610: $requrl=~/\.(\w+)$/;
611: my $query=$r->args;
612: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
613: ($requrl=~/^\/adm\/.*\/(aboutme|smppg|bulletinboard)(\?|$ )/x) ||
614: ($requrl=~/^\/adm\/wrapper\//) ||
615: ($requrl=~m|^/adm/coursedocs/showdoc/|) ||
616: ($requrl=~m|\.problem/smpedit$|) ||
617: ($requrl=~/^\/public\/.*\/syllabus$/) ||
618: ($requrl=~/^\/adm\/(viewclasslist|navmaps)$/) ||
619: ($requrl=~/^\/adm\/.*\/aboutme\/portfolio(\?|$)/)) {
620: # ------------------------------------- This is serious stuff, get symb and log
621: my $symb;
622: if ($query) {
623: &Apache::loncommon::get_unprocessed_cgi($query,['symb','folderpath']);
624: }
625: if ($env{'form.symb'}) {
626: $symb=&Apache::lonnet::symbclean($env{'form.symb'});
627: if ($requrl =~ m|^/adm/wrapper/|
628: || $requrl =~ m|^/adm/coursedocs/showdoc/|) {
629: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
630: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
631: 'last_known' =>[$murl,$mid]);
632: } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) ||
633: (($requrl=~m|(.*)/smpedit$|) &&
634: &Apache::lonnet::symbverify($symb,$1)) ||
635: (($requrl=~m|(.*/aboutme)/portfolio$|) &&
636: &Apache::lonnet::symbverify($symb,$1))) {
637: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
638: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
639: 'last_known' =>[$murl,$mid]);
640: } else {
641: $r->log_reason('Invalid symb for '.$requrl.': '.
642: $symb);
643: $env{'user.error.msg'}=
644: "$requrl:bre:1:1:Invalid Access";
645: return HTTP_NOT_ACCEPTABLE;
646: }
647: } else {
648: if ($requrl=~m{^(/adm/.*/aboutme)/portfolio$}) {
649: $requrl = $1;
650: }
651: unless ($suppext) {
652: $symb=&Apache::lonnet::symbread($requrl);
653: if (&Apache::lonnet::is_on_map($requrl) && $symb &&
654: !&Apache::lonnet::symbverify($symb,$requrl)) {
655: $r->log_reason('Invalid symb for '.$requrl.': '.$symb);
656: $env{'user.error.msg'}=
657: "$requrl:bre:1:1:Invalid Access";
658: return HTTP_NOT_ACCEPTABLE;
659: }
660: if ($symb) {
661: my ($map,$mid,$murl)=
662: &Apache::lonnet::decode_symb($symb);
663: &Apache::lonnet::symblist($map,$murl =>[$murl,$mid],
664: 'last_known' =>[$murl,$mid]);
665: }
666: }
667: }
668: $env{'request.symb'}=$symb;
669: &Apache::lonnet::courseacclog($symb);
670: } else {
671: # ------------------------------------------------------- This is other content
672: &Apache::lonnet::courseacclog($requrl);
673: }
674: if ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/(docs|supplemental)/.+\.html?$}) {
675: if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) {
676: if ($query) {
677: &Apache::loncommon::get_unprocessed_cgi($query,['forceedit']);
678: if ($env{'form.forceedit'}) {
679: $env{'request.state'} = 'edit';
680: }
681: }
682: }
683: } elsif ($requrl =~ m{^/+uploaded/\Q$cdom\E/\Q$cnum\E/portfolio/syllabus/.+\.html?$}) {
684: if (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) {
685: if ($query) {
686: &Apache::loncommon::get_unprocessed_cgi($query,['forceedit','editmode']);
687: if (($env{'form.forceedit'}) || ($env{'form.editmode'})) {
688: $env{'request.state'} = 'edit';
689: }
690: }
691: }
692: }
693: }
694: return OK;
695: } else {
696: my $defdom=$r->dir_config('lonDefDomain');
697: ($is_balancer,$otherserver) =
698: &Apache::lonnet::check_loadbalancing(undef,$defdom);
699: if ($is_balancer) {
700: $r->set_handlers('PerlResponseHandler'=>
701: [\&Apache::switchserver::handler]);
702: if ($otherserver ne '') {
703: $env{'form.otherserver'} = $otherserver;
704: }
705: }
706: }
707: # -------------------------------------------- See if this is a public resource
708: if ($requrl=~m|^/+adm/+help/+|) {
709: return OK;
710: }
711: # ------------------------------------ See if this is a viewable portfolio file
712: if (&Apache::lonnet::is_portfolio_url($requrl)) {
713: my $access=&Apache::lonnet::allowed('bre',$requrl);
714: if ($access eq 'A') {
715: &Apache::restrictedaccess::setup_handler($r);
716: return OK;
717: }
718: if (($access ne '2') && ($access ne 'F')) {
719: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
720: return HTTP_NOT_ACCEPTABLE;
721: }
722: }
723:
724: # -------------------------------------------------------------- Not authorized
725: $requrl=~/\.(\w+)$/;
726: # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
727: # ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) ||
728: # ($requrl=~m|^/prtspool/|)) {
729: # -------------------------- Store where they wanted to go and get login screen
730: $env{'request.querystring'}=$r->args;
731: $env{'request.firsturl'}=$requrl;
732: return FORBIDDEN;
733: # } else {
734: # --------------------------------------------------------------------- Goodbye
735: # return HTTP_BAD_REQUEST;
736: # }
737: }
738:
739: 1;
740: __END__
741:
742: =pod
743:
744: =back
745:
746: =cut
747:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>