';
+ my ($start_page,$js,$pagebody,$end_page);
+ if ($env{'request.lti.login'}) {
+ $args = {'only_body' => 1};
+ if ($env{'request.lti.target'} eq '') {
+ my $ltitarget = (($destination =~ /\?/) ? '&' : '?').
+ 'ltitarget=iframe';
+ $js = <<"ENDJS";
+
+
- my $welcome = &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','','');
+ENDJS
+ $args->{'add_entries'} = {'onload' => "javascript:setLTItarget();"};
+ $pagebody = '';
+ } else {
+ $args->{'redirect'} = [0,$destination,1];
+ }
+ $start_page=&Apache::loncommon::start_page('',$js,$args);
+ } else {
+ $args->{'redirect'} = [0,$destination];
+ $start_page=&Apache::loncommon::start_page('Successful Login',
+ $js,$args);
+
+ my %lt=&Apache::lonlocal::texthash(
+ 'wel' => 'Welcome',
+ 'pro' => 'Login problems?',
+ );
+ $pagebody = "
$lt{'wel'}
\n".
+ &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','','');
+ my $loginhelp = &loginhelpdisplay($domain);
+ if ($loginhelp) {
+ $pagebody .= '
';
+ }
+ }
+ $end_page = &Apache::loncommon::end_page();
$r->print(<$lt{'wel'}
-$welcome
-$loginhelp
-$continuelink
+$pagebody
$end_page
ENDSUCCESS
return;
@@ -194,6 +298,19 @@ sub failed {
$retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb;
}
}
+ if (exists($form->{firsturl})) {
+ my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl});
+ if ($firsturl ne '') {
+ $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl;
+ }
+ }
+ if (exists($form->{linkprot})) {
+ my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}},
+ $r->dir_config('lonHostID'));
+ if ($ltoken) {
+ $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken;
+ }
+ }
my $end_page = &Apache::loncommon::end_page();
&Apache::loncommon::content_type($r,'text/html');
$r->send_http_header;
@@ -230,7 +347,6 @@ sub reroute {
sub handler {
my $r = shift;
my $londocroot = $r->dir_config('lonDocRoot');
- my $form;
# Are we re-routing?
if (-e "$londocroot/lon-status/reroute.txt") {
&reroute($r);
@@ -294,10 +410,11 @@ sub handler {
# split user logging in and "su"-user
- ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
+ ($form{'uname'},$form{'suname'},$form{'sudom'})=split(/\:/,$form{'uname'});
$form{'uname'} = &LONCAPA::clean_username($form{'uname'});
$form{'suname'}= &LONCAPA::clean_username($form{'suname'});
- $form{'udom'} = &LONCAPA::clean_domain( $form{'udom'});
+ $form{'udom'} = &LONCAPA::clean_domain($form{'udom'});
+ $form{'sudom'} = &LONCAPA::clean_domain($form{'sudom'});
my $role = $r->dir_config('lonRole');
my $domain = $r->dir_config('lonDefDomain');
@@ -309,12 +426,6 @@ sub handler {
my $tmpinfo=Apache::lonnet::reply('tmpget:'.$form{'logtoken'},
$form{'serverid'});
- my %sessiondata;
- if ($form{'iptoken'}) {
- %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'});
- my $delete = &Apache::lonnet::tmpdel($form{'iptoken'});
- }
-
if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost') ||
($tmpinfo eq 'no_such_host')) {
&failed($r,'Information needed to verify your login information is missing, inaccessible or expired.',\%form);
@@ -334,22 +445,37 @@ sub handler {
return OK;
}
- my ($key,$firsturl,$rolestr,$symbstr)=split(/&/,$tmpinfo);
+ my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr,$linkprotstr)=split(/&/,$tmpinfo);
if ($rolestr) {
$rolestr = &unescape($rolestr);
}
if ($symbstr) {
$symbstr= &unescape($symbstr);
}
+ if ($iptokenstr) {
+ $iptokenstr = &unescape($iptokenstr);
+ }
+ if ($linkprotstr) {
+ $linkprotstr = &unescape($linkprotstr);
+ }
+ if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) {
+ $form{'firsturl'} = $firsturl;
+ }
if ($rolestr =~ /^role=/) {
(undef,$form{'role'}) = split('=',$rolestr);
}
if ($symbstr =~ /^symb=/) {
(undef,$form{'symb'}) = split('=',$symbstr);
}
+ if ($iptokenstr =~ /^iptoken=/) {
+ (undef,$form{'iptoken'}) = split('=',$iptokenstr);
+ }
+ if ($linkprotstr =~ /^linkprot=/) {
+ (undef,$form{'linkprot'}) = split('=',$linkprotstr);
+ }
- my $upass = $ENV{HTTPS} ? join("", @form{qw(upass0 upass1 upass2)})
- : decrypt($key, @form{qw(upass0 upass1 upass2)});
+ my $upass = $ENV{HTTPS} ? $form{'upass0'}
+ : &Apache::loncommon::des_decrypt($key,$form{'upass0'});
# ---------------------------------------------------------------- Authenticate
@@ -366,7 +492,7 @@ sub handler {
my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
$form{'udom'},$defaultauth,
$clientcancheckhost);
-
+
# --------------------------------------------------------------------- Failed?
if ($authhost eq 'no_host') {
@@ -412,6 +538,8 @@ sub handler {
my $hosthere;
if ($form{'iptoken'}) {
+ my %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'});
+ my $delete = &Apache::lonnet::tmpdel($form{'iptoken'});
if (($sessiondata{'domain'} eq $form{'udom'}) &&
($sessiondata{'username'} eq $form{'uname'})) {
$hosthere = 1;
@@ -420,20 +548,68 @@ sub handler {
# --------------------------------- Are we attempting to login as somebody else?
if ($form{'suname'}) {
+ my ($suname,$sudom,$sudomref);
+ $suname = $form{'suname'};
+ $sudom = $form{'udom'};
+ if ($form{'sudom'}) {
+ unless ($sudom eq $form{'sudom'}) {
+ if (&Apache::lonnet::domain($form{'sudom'})) {
+ $sudomref = [$form{'sudom'}];
+ $sudom = $form{'sudom'};
+ }
+ }
+ }
# ------------ see if the original user has enough privileges to pull this stunt
- if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'})) {
+ if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'},$sudomref)) {
# ---------------------------------------------------- see if the su-user exists
- unless (&Apache::lonnet::homeserver($form{'suname'},$form{'udom'})
- eq 'no_host') {
- &Apache::lonnet::logthis(&Apache::lonnet::homeserver($form{'suname'},$form{'udom'}));
+ unless (&Apache::lonnet::homeserver($suname,$sudom) eq 'no_host') {
# ------------------------------ see if the su-user is not too highly privileged
- unless (&Apache::lonnet::privileged($form{'suname'},$form{'udom'})) {
+ if (&Apache::lonnet::privileged($suname,$sudom)) {
+ &Apache::lonnet::logthis('Attempted switch user to privileged user');
+ } else {
+ my $noprivswitch;
+#
+# su-user's home server and user's home server must have one of:
+# (a) same domain
+# (b) same primary library server for the two domains
+# (c) same "internet domain" for primary library server(s) for home servers' domains
+#
+ my $suprim = &Apache::lonnet::domain($sudom,'primary');
+ my $suintdom = &Apache::lonnet::internet_dom($suprim);
+ unless ($sudom eq $form{'udom'}) {
+ my $uprim = &Apache::lonnet::domain($form{'udom'},'primary');
+ my $uintdom = &Apache::lonnet::internet_dom($uprim);
+ unless ($suprim eq $uprim) {
+ unless ($suintdom eq $uintdom) {
+ &Apache::lonnet::logthis('Attempted switch user '
+ .'to user with different "internet domain".');
+ $noprivswitch = 1;
+ }
+ }
+ }
+
+ unless ($noprivswitch) {
+#
+# server where log-in occurs must have same "internet domain" as su-user's home
+# server
+#
+ my $lonhost = $r->dir_config('lonHostID');
+ my $hostintdom = &Apache::lonnet::internet_dom($lonhost);
+ if ($hostintdom ne $suintdom) {
+ &Apache::lonnet::logthis('Attempted switch user on a '
+ .'server with a different "internet domain".');
+ } else {
+
# -------------------------------------------------------- actually switch users
- &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.$form{'udom'}.
- ' logging in as '.$form{'suname'});
- $form{'uname'}=$form{'suname'};
- } else {
- &Apache::lonnet::logthis('Attempted switch user to privileged user');
+
+ &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.
+ $form{'udom'}.' logging in as '.$suname.':'.$sudom);
+ $form{'uname'}=$suname;
+ if ($form{'udom'} ne $sudom) {
+ $form{'udom'}=$sudom;
+ }
+ }
+ }
}
}
} else {
@@ -445,19 +621,31 @@ sub handler {
unless ($hosthere) {
($is_balancer,$otherserver) =
- &Apache::lonnet::check_loadbalancing($form{'uname'},$form{'udom'});
+ &Apache::lonnet::check_loadbalancing($form{'uname'},$form{'udom'},'login');
+ if ($is_balancer) {
+ if ($otherserver eq '') {
+ my $lowest_load;
+ ($otherserver,undef,undef,undef,$lowest_load) = &Apache::lonnet::choose_server($form{'udom'});
+ if ($lowest_load > 100) {
+ $otherserver = &Apache::lonnet::spareserver($lowest_load,$lowest_load,1,$form{'udom'});
+ }
+ }
+ if ($otherserver ne '') {
+ my @hosts = &Apache::lonnet::current_machine_ids();
+ if (grep(/^\Q$otherserver\E$/,@hosts)) {
+ $hosthere = $otherserver;
+ }
+ }
+ }
}
- if ($is_balancer) {
- if (!$otherserver) {
- ($otherserver) = &Apache::lonnet::choose_server($form{'udom'});
- }
+ if (($is_balancer) && (!$hosthere)) {
if ($otherserver) {
&success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',undef,
\%form);
my $switchto = '/adm/switchserver?otherserver='.$otherserver;
if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
- $switchto .= '&origurl='.$firsturl;
+ $switchto .= '&origurl='.$firsturl; #should escape
}
if ($form{'role'}) {
$switchto .= '&role='.$form{'role'};
@@ -465,6 +653,9 @@ sub handler {
if ($form{'symb'}) {
$switchto .= '&symb='.$form{'symb'};
}
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ }
$r->internal_redirect($switchto);
} else {
$r->print(&noswitch());
@@ -478,7 +669,7 @@ sub handler {
\%form);
my $switchto = '/adm/switchserver?otherserver='.$otherserver;
if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
- $switchto .= '&origurl='.$firsturl;
+ $switchto .= '&origurl='.$firsturl; #should escape
}
if ($form{'role'}) {
$switchto .= '&role='.$form{'role'};
@@ -486,6 +677,9 @@ sub handler {
if ($form{'symb'}) {
$switchto .= '&symb='.$form{'symb'};
}
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ }
$r->internal_redirect($switchto);
} else {
$r->print(&noswitch());
@@ -515,44 +709,30 @@ sub handler {
if ($unloaded) {
&success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',
undef,\%form);
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ }
$r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl);
return OK;
}
}
- &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef,
+ if (($is_balancer) && ($hosthere)) {
+ $form{'noloadbalance'} = $hosthere;
+ }
+ my $extra_env;
+ if ($form{'linkprot'}) {
+ my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2);
+ if ($linkprotector) {
+ $extra_env = {'user.linkprotector' => $linkprotector,
+ 'user.linkproturi' => $uri,};
+ }
+ }
+ &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env,
\%form);
return OK;
}
}
-sub decrypt {
- my ($key, @chunks) = @_;
-
- my $keybin = pack("H16",$key);
-
- my $cipher;
- if ($Crypt::DES::VERSION >= 2.03) {
- $cipher = new Crypt::DES $keybin;
- } else {
- $cipher = new DES $keybin;
- }
-
- my $upass='';
- for (my $i=0;$i<=2;$i++) {
- my $chunk =
- $cipher->decrypt(
- unpack("a8",pack("H16",substr($chunks[$i],0,16))));
-
- $chunk .=
- $cipher->decrypt(
- unpack("a8",pack("H16",substr($chunks[$i],16,16))));
-
- $chunk = substr($chunk,1,ord(substr($chunk,0,1)));
- $upass .= $chunk;
- }
- return $upass;
-}
-
sub check_can_host {
my ($r,$form,$authhost,$domdesc) = @_;
return unless (ref($form) eq 'HASH');
@@ -594,6 +774,7 @@ sub check_can_host {
my $protocol = $Apache::lonnet::protocol{$login_host};
$protocol = 'http' if ($protocol ne 'https');
my $newurl = $protocol.'://'.$hostname.'/adm/createaccount';
+#FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host
$r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA').
'
'.&mt('Account creation').'
'.
&mt('You do not currently have a LON-CAPA account at this institution.').' '.
@@ -610,6 +791,9 @@ sub check_can_host {
} else {
&success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef,
$form);
+ if ($form->{'linkprot'}) {
+ $env{'request.linkprot'} = $form->{'linkprot'};
+ }
my ($otherserver) = &Apache::lonnet::choose_server($udom);
$r->internal_redirect('/adm/switchserver?otherserver='.$otherserver);
}