File:
[LON-CAPA] /
loncom /
auth /
lonacc.pm
Revision
1.103:
download - view:
text,
annotated -
select for diffs
Mon Dec 11 14:06:04 2006 UTC (17 years, 9 months ago) by
raeburn
Branches:
MAIN
CVS tags:
version_2_3_0,
version_2_2_99_1,
version_2_2_99_0,
HEAD
Add response code of 'B' to lonnet::allowed() to indicate access to a file is currently subject to a block, because the file owner is part of a course with active communications blocking, and file viewer does not have 'evb' privilege in the course to nullify the block.
Used to block access to portfolio files. Response of 'B' triggers blockedaccess.pm which displays information about blocking conditions.
1: # The LearningOnline Network
2: # Cookie Based Access Handler
3: #
4: # $Id: lonacc.pm,v 1.103 2006/12/11 14:06:04 raeburn Exp $
5: #
6: # Copyright Michigan State University Board of Trustees
7: #
8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
9: #
10: # LON-CAPA is free software; you can redistribute it and/or modify
11: # it under the terms of the GNU General Public License as published by
12: # the Free Software Foundation; either version 2 of the License, or
13: # (at your option) any later version.
14: #
15: # LON-CAPA is distributed in the hope that it will be useful,
16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18: # GNU General Public License for more details.
19: #
20: # You should have received a copy of the GNU General Public License
21: # along with LON-CAPA; if not, write to the Free Software
22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23: #
24: # /home/httpd/html/adm/gpl.txt
25: #
26: # http://www.lon-capa.org/
27: #
28: ###
29:
30: package Apache::lonacc;
31:
32: use strict;
33: use Apache::Constants qw(:common :http :methods);
34: use Apache::File;
35: use Apache::lonnet;
36: use Apache::loncommon();
37: use Apache::lonlocal;
38: use Apache::restrictedaccess();
39: use Apache::blockedaccess();
40: use CGI::Cookie();
41: use Fcntl qw(:flock);
42: use LONCAPA;
43:
44: sub cleanup {
45: my ($r)=@_;
46: if (! $r->is_initial_req()) { return DECLINED; }
47: &Apache::lonnet::save_cache();
48: &Apache::lontexconvert::jsMath_reset();
49: return OK;
50: }
51:
52: sub goodbye {
53: my ($r)=@_;
54: &Apache::lonnet::goodbye();
55: return DONE;
56: }
57:
58: ###############################################
59:
60: sub get_posted_cgi {
61: my ($r) = @_;
62:
63: my $buffer;
64: if ($r->header_in('Content-length')) {
65: $r->read($buffer,$r->header_in('Content-length'),0);
66: }
67: unless ($buffer=~/^(\-+\w+)\s+Content\-Disposition\:\s*form\-data/si) {
68: my @pairs=split(/&/,$buffer);
69: my $pair;
70: foreach $pair (@pairs) {
71: my ($name,$value) = split(/=/,$pair);
72: $value =~ tr/+/ /;
73: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
74: $name =~ tr/+/ /;
75: $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
76: &Apache::loncommon::add_to_env("form.$name",$value);
77: }
78: } else {
79: my $contentsep=$1;
80: my @lines = split (/\n/,$buffer);
81: my $name='';
82: my $value='';
83: my $fname='';
84: my $fmime='';
85: my $i;
86: for ($i=0;$i<=$#lines;$i++) {
87: if ($lines[$i]=~/^$contentsep/) {
88: if ($name) {
89: chomp($value);
90: if ($fname) {
91: $env{"form.$name.filename"}=$fname;
92: $env{"form.$name.mimetype"}=$fmime;
93: } else {
94: $value=~s/\s+$//s;
95: }
96: &Apache::loncommon::add_to_env("form.$name",$value);
97: }
98: if ($i<$#lines) {
99: $i++;
100: $lines[$i]=~
101: /Content\-Disposition\:\s*form\-data\;\s*name\=\"([^\"]+)\"/i;
102: $name=$1;
103: $value='';
104: if ($lines[$i]=~/filename\=\"([^\"]+)\"/i) {
105: $fname=$1;
106: if
107: ($lines[$i+1]=~/Content\-Type\:\s*([\w\-\/]+)/i) {
108: $fmime=$1;
109: $i++;
110: } else {
111: $fmime='';
112: }
113: } else {
114: $fname='';
115: $fmime='';
116: }
117: $i++;
118: }
119: } else {
120: $value.=$lines[$i]."\n";
121: }
122: }
123: }
124: #
125: # Digested POSTed values
126: #
127: # Remember the way this was originally done (GET or POST)
128: #
129: $env{'request.method'}=$ENV{'REQUEST_METHOD'};
130: #
131: # There may also be stuff in the query string
132: # Tell subsequent handlers that this was GET, not POST, so they can access query string.
133: # Also, unset POSTed content length to cover all tracks.
134: #
135:
136: $r->method_number(M_GET);
137:
138: $r->method('GET');
139: $r->headers_in->unset('Content-length');
140: }
141:
142: # handle the case of the single sign on user, at this point $r->user
143: # will be set and valid now need to find the loncapa user info and possibly
144: # balance them
145: # returns OK if it was a SSO and user was handled
146: # undef if not SSO or no means to hanle the user
147: sub sso_login {
148: my ($r,$lonid,$handle) = @_;
149:
150: my $lonidsdir=$r->dir_config('lonIDsDir');
151: if (!($r->user
152: && (!defined($env{'user.name'}) && !defined($env{'user.domain'}))
153: && (!$lonid || !-e "$lonidsdir/$handle.id" || $handle eq ''))) {
154: # not an SSO case or already logged in
155: return undef;
156: }
157:
158: my ($user) = ($r->user =~ m/([a-zA-Z0-9_\-@.]*)/);
159:
160: my $domain = $r->dir_config('lonDefDomain');
161: my $home=&Apache::lonnet::homeserver($user,$domain);
162: if ($home !~ /(con_lost|no_host|no_such_host)/) {
163: if ($r->dir_config("lonBalancer") eq 'yes') {
164: # login but immeaditly go to switch server to find us a new
165: # machine
166: &Apache::lonauth::success($r,$user,$domain,$home,'noredirect');
167: $r->internal_redirect('/adm/switchserver');
168: $r->set_handlers('PerlHandler'=> undef);
169: } else {
170: # need to login them in, so generate the need data that
171: # migrate expects to do login
172: my %info=('ip' => $r->connection->remote_ip(),
173: 'domain' => $domain,
174: 'username' => $user,
175: 'server' => $r->dir_config('lonHostID'),
176: 'sso.login' => 1
177: );
178: my $token =
179: &Apache::lonnet::tmpput(\%info,
180: $r->dir_config('lonHostID'));
181: $env{'form.token'} = $token;
182: $r->internal_redirect('/adm/migrateuser');
183: $r->set_handlers('PerlHandler'=> undef);
184: }
185: return OK;
186: } elsif (defined($r->dir_config('lonSSOUserUnknownRedirect'))) {
187: $r->internal_redirect($r->dir_config('lonSSOUserUnknownRedirect'));
188: $r->set_handlers('PerlHandler'=> undef);
189: return OK;
190: }
191: return undef;
192: }
193:
194: sub handler {
195: my $r = shift;
196: my $requrl=$r->uri;
197: my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
198: my $lonid=$cookies{'lonID'};
199: my $cookie;
200: my $lonidsdir=$r->dir_config('lonIDsDir');
201:
202: my $handle;
203: if ($lonid) {
204: $handle=&LONCAPA::clean_handle($lonid->value);
205: }
206:
207: my $result = &sso_login($r,$lonid,$handle);
208: if (defined($result)) {
209: return $result
210: }
211:
212:
213: if ($r->dir_config("lonBalancer") eq 'yes') {
214: $r->set_handlers('PerlResponseHandler'=>
215: [\&Apache::switchserver::handler]);
216: }
217:
218: if ($handle eq '') {
219: $r->log_reason("Cookie $handle not valid", $r->filename);
220: } elsif ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {
221:
222: # ------------------------------------------------------ Initialize Environment
223:
224: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
225:
226: # --------------------------------------------------------- Initialize Language
227:
228: &Apache::lonlocal::get_language_handle($r);
229:
230: }
231:
232: # -------------------------------------------------- Should be a valid user now
233: if ($env{'user.name'} ne '' && $env{'user.domain'} ne '') {
234: # -------------------------------------------------------------- Resource State
235:
236: if ($requrl=~/^\/+(res|uploaded)\//) {
237: $env{'request.state'} = "published";
238: } else {
239: $env{'request.state'} = 'unknown';
240: }
241: $env{'request.filename'} = $r->filename;
242: $env{'request.noversionuri'} = &Apache::lonnet::deversion($requrl);
243: # -------------------------------------------------------- Load POST parameters
244:
245: &Apache::lonacc::get_posted_cgi($r);
246:
247: # ---------------------------------------------------------------- Check access
248: my $now = time;
249: if ($requrl !~ m{^/(?:adm|public|prtspool)/}
250: || $requrl =~ /^\/adm\/.*\/(smppg|bulletinboard)(\?|$ )/x) {
251: my $access=&Apache::lonnet::allowed('bre',$requrl);
252: if ($access eq '1') {
253: $env{'user.error.msg'}="$requrl:bre:0:0:Choose Course";
254: return HTTP_NOT_ACCEPTABLE;
255: }
256: if ($access eq 'A') {
257: &Apache::restrictedaccess::setup_handler($r);
258: return OK;
259: }
260: if ($access eq 'B') {
261: &Apache::blockedaccess::setup_handler($r);
262: return OK;
263: }
264: if (($access ne '2') && ($access ne 'F')) {
265: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
266: return HTTP_NOT_ACCEPTABLE;
267: }
268: }
269: if ($requrl =~ m|^/prtspool/|) {
270: my $start='/prtspool/'.$env{'user.name'}.'_'.
271: $env{'user.domain'};
272: if ($requrl !~ /^\Q$start\E/) {
273: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
274: return HTTP_NOT_ACCEPTABLE;
275: }
276: }
277: if ($env{'user.name'} eq 'public' &&
278: $env{'user.domain'} eq 'public' &&
279: $requrl !~ m{^/+(res|public|uploaded)/} &&
280: $requrl !~ m{^/adm/[^/]+/[^/]+/aboutme/portfolio$ }x &&
281: $requrl !~ m{^/+adm/(help|logout|restrictedaccess|randomlabel\.png)}) {
282: $env{'request.querystring'}=$r->args;
283: $env{'request.firsturl'}=$requrl;
284: return FORBIDDEN;
285: }
286: # ------------------------------------------------------------- This is allowed
287: if ($env{'request.course.id'}) {
288: &Apache::lonnet::countacc($requrl);
289: $requrl=~/\.(\w+)$/;
290: if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
291: ($requrl=~/^\/adm\/.*\/(aboutme|navmaps|smppg|bulletinboard)(\?|$ )/x) ||
292: ($requrl=~/^\/adm\/wrapper\//) ||
293: ($requrl=~m|^/adm/coursedocs/showdoc/|) ||
294: ($requrl=~m|\.problem/smpedit$|) ||
295: ($requrl=~/^\/public\/.*\/syllabus$/)) {
296: # ------------------------------------- This is serious stuff, get symb and log
297: my $query=$r->args;
298: my $symb;
299: if ($query) {
300: &Apache::loncommon::get_unprocessed_cgi($query,['symb']);
301: }
302: if ($env{'form.symb'}) {
303: $symb=&Apache::lonnet::symbclean($env{'form.symb'});
304: if ($requrl =~ m|^/adm/wrapper/|
305: || $requrl =~ m|^/adm/coursedocs/showdoc/|) {
306: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
307: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
308: 'last_known' =>[$murl,$mid]);
309: } elsif ((&Apache::lonnet::symbverify($symb,$requrl)) ||
310: (($requrl=~m|(.*)/smpedit$|) &&
311: &Apache::lonnet::symbverify($symb,$1))) {
312: my ($map,$mid,$murl)=&Apache::lonnet::decode_symb($symb);
313: &Apache::lonnet::symblist($map,$murl => [$murl,$mid],
314: 'last_known' =>[$murl,$mid]);
315: } else {
316: $r->log_reason('Invalid symb for '.$requrl.': '.
317: $symb);
318: $env{'user.error.msg'}=
319: "$requrl:bre:1:1:Invalid Access";
320: return HTTP_NOT_ACCEPTABLE;
321: }
322: } else {
323: $symb=&Apache::lonnet::symbread($requrl);
324: if (&Apache::lonnet::is_on_map($requrl) && $symb &&
325: !&Apache::lonnet::symbverify($symb,$requrl)) {
326: $r->log_reason('Invalid symb for '.$requrl.': '.$symb);
327: $env{'user.error.msg'}=
328: "$requrl:bre:1:1:Invalid Access";
329: return HTTP_NOT_ACCEPTABLE;
330: }
331: if ($symb) {
332: my ($map,$mid,$murl)=
333: &Apache::lonnet::decode_symb($symb);
334: &Apache::lonnet::symblist($map,$murl =>[$murl,$mid],
335: 'last_known' =>[$murl,$mid]);
336: }
337: }
338: $env{'request.symb'}=$symb;
339: &Apache::lonnet::courseacclog($symb);
340: } else {
341: # ------------------------------------------------------- This is other content
342: &Apache::lonnet::courseacclog($requrl);
343: }
344: }
345: return OK;
346: }
347: # -------------------------------------------- See if this is a public resource
348: if ($requrl=~m|^/+adm/+help/+|) {
349: return OK;
350: }
351: # ------------------------------------ See if this is a viewable portfolio file
352: if (&Apache::lonnet::is_portfolio_url($requrl)) {
353: my $access=&Apache::lonnet::allowed('bre',$requrl);
354: if ($access eq 'A') {
355: &Apache::restrictedaccess::setup_handler($r);
356: return OK;
357: }
358: if (($access ne '2') && ($access ne 'F')) {
359: $env{'user.error.msg'}="$requrl:bre:1:1:Access Denied";
360: return HTTP_NOT_ACCEPTABLE;
361: }
362: }
363:
364: # -------------------------------------------------------------- Not authorized
365: $requrl=~/\.(\w+)$/;
366: # if ((&Apache::loncommon::fileembstyle($1) eq 'ssi') ||
367: # ($requrl=~/^\/adm\/(roles|logout|email|menu|remote)/) ||
368: # ($requrl=~m|^/prtspool/|)) {
369: # -------------------------- Store where they wanted to go and get login screen
370: $env{'request.querystring'}=$r->args;
371: $env{'request.firsturl'}=$requrl;
372: return FORBIDDEN;
373: # } else {
374: # --------------------------------------------------------------------- Goodbye
375: # return HTTP_BAD_REQUEST;
376: # }
377: }
378:
379: 1;
380: __END__
381:
382: =head1 NAME
383:
384: Apache::lonacc - Cookie Based Access Handler
385:
386: =head1 SYNOPSIS
387:
388: Invoked (for various locations) by /etc/httpd/conf/srm.conf:
389:
390: PerlAccessHandler Apache::lonacc
391:
392: =head1 INTRODUCTION
393:
394: This module enables cookie based authentication and is used
395: to control access for many different LON-CAPA URIs.
396:
397: Whenever the client sends the cookie back to the server,
398: this cookie is handled by either lonacc.pm or loncacc.pm
399: (see srm.conf for what is invoked when). If
400: the cookie is missing or invalid, the user is re-challenged
401: for login information.
402:
403: This is part of the LearningOnline Network with CAPA project
404: described at http://www.lon-capa.org.
405:
406: =head1 HANDLER SUBROUTINE
407:
408: This routine is called by Apache and mod_perl.
409:
410: =over 4
411:
412: =item *
413:
414: transfer profile into environment
415:
416: =item *
417:
418: load POST parameters
419:
420: =item *
421:
422: check access
423:
424: =item *
425:
426: if allowed, get symb, log, generate course statistics if applicable
427:
428: =item *
429:
430: otherwise return error
431:
432: =item *
433:
434: see if public resource
435:
436: =item *
437:
438: store attempted access
439:
440: =back
441:
442: =cut
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>