--- loncom/auth/lonauth.pm 2018/04/14 02:30:11 1.150
+++ loncom/auth/lonauth.pm 2020/03/15 23:04:10 1.159
@@ -1,7 +1,7 @@
# The LearningOnline Network
# User Authentication Module
#
-# $Id: lonauth.pm,v 1.150 2018/04/14 02:30:11 raeburn Exp $
+# $Id: lonauth.pm,v 1.159 2020/03/15 23:04:10 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
@@ -46,7 +46,7 @@ use Digest::MD5;
# ------------------------------------------------------------ Successful login
sub success {
my ($r, $username, $domain, $authhost, $lowerurl, $extra_env,
- $form,$skipcritical) = @_;
+ $form,$skipcritical,$cid) = @_;
# ------------------------------------------------------------ Get cookie ready
my $cookie =
@@ -76,8 +76,9 @@ sub success {
# ----------------------------------------------------------- Get cookies ready
my ($securecookie,$defaultcookie);
- if ($ENV{'SERVER_PORT'} == 443) {
- $securecookie="lonID=$cookie; path=/; HttpOnly; secure";
+ my $ssl = $r->subprocess_env('https');
+ if ($ssl) {
+ $securecookie="lonSID=$cookie; path=/; HttpOnly; secure";
my $lonidsdir=$r->dir_config('lonIDsDir');
if (($lonidsdir) && (-e "$lonidsdir/$cookie.id")) {
my $linkname=substr(Digest::MD5::md5_hex(Digest::MD5::md5_hex(time(). {}. rand(). $$)), 0, 32).'_linked';
@@ -88,7 +89,7 @@ sub success {
"$lonidsdir/$linkname.id"); 1 };
if ($made_symlink) {
$defaultcookie = "lonLinkID=$linkname; path=/; HttpOnly;";
- &Apache::lonnet::appenv({'user.linkedenv' => "$lonidsdir/$linkname.id"});
+ &Apache::lonnet::appenv({'user.linkedenv' => $linkname});
}
}
} else {
@@ -106,6 +107,12 @@ sub success {
$r->headers_out->add('Set-cookie' => $defaultcookie);
}
$r->send_http_header;
+ if (ref($form) eq 'HASH') {
+ $form->{'lti.login'} = $env{'request.lti.login'};
+ $form->{'lti.reqcrs'} = $env{'request.lti.reqcrs'};
+ $form->{'lti.reqrole'} = $env{'request.lti.reqrole'};
+ $form->{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'};
+ }
&Apache::ltiauth::lti_reqcrs($r,$domain,$form,$username,$domain);
return;
}
@@ -141,16 +148,26 @@ sub success {
}
if (defined($form->{symb})) {
my $destsymb = $form->{symb};
+ my $encrypted;
+ if ($destsymb =~ m{^/enc/}) {
+ $encrypted = 1;
+ if ($cid) {
+ $destsymb = &Apache::lonenc::unencrypted($destsymb,$cid);
+ }
+ }
$destination .= ($destination =~ /\?/) ? '&' : '?';
if ($destsymb =~ /___/) {
- # FIXME Need to deal with encrypted symbs and urls as needed.
my ($map,$resid,$desturl)=split(/___/,$destsymb);
$desturl = &Apache::lonnet::clutter($desturl);
+ if ($encrypted) {
+ $desturl = &Apache::lonenc::encrypted($desturl,1,$cid);
+ $destsymb = $form->{symb};
+ }
$desturl = &HTML::Entities::encode($desturl,'"<>&');
$destsymb = &HTML::Entities::encode($destsymb,'"<>&');
$destination .= 'destinationurl='.$desturl.
'&destsymb='.$destsymb;
- } else {
+ } elsif (!$encrypted) {
$destsymb = &HTML::Entities::encode($destsymb,'"<>&');
$destination .= 'destinationurl='.$destsymb;
}
@@ -165,7 +182,6 @@ sub success {
$windowname .= 'lti';
}
my $windowinfo = Apache::lonhtmlcommon::scripttag('self.name="'.$windowname.'";');
- my $header = ' ';
my $brcrum = [{'href' => '',
'text' => 'Successful Login'},];
my $args = {'bread_crumbs' => $brcrum,};
@@ -202,29 +218,56 @@ sub success {
}
$r->send_http_header;
- my $start_page=&Apache::loncommon::start_page('Successful Login',
- $header,$args);
- my $end_page =&Apache::loncommon::end_page();
-
- my $continuelink=''.&mt('Continue').' ';
-
- my %lt=&Apache::lonlocal::texthash(
- 'wel' => 'Welcome',
- 'pro' => 'Login problems?',
- );
- my $loginhelp = &loginhelpdisplay($domain);
- if ($loginhelp) {
- $loginhelp = '
'.$lt{'pro'}.'
';
+ my ($start_page,$js,$pagebody,$end_page);
+ if ($env{'request.lti.login'}) {
+ $args = {'only_body' => 1};
+ if ($env{'request.lti.target'} eq '') {
+ my $ltitarget = (($destination =~ /\?/) ? '&' : '?').
+ 'ltitarget=iframe';
+ $js = <<"ENDJS";
+
+
- my $welcome = &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','',' ');
+ENDJS
+ $args->{'add_entries'} = {'onload' => "javascript:setLTItarget();"};
+ $pagebody = ''
+ .&mt('Use of LON-CAPA requires Javascript to be enabled in your web browser.')
+ .' ';
+ } else {
+ $args->{'redirect'} = [0,$destination,1];
+ }
+ $start_page=&Apache::loncommon::start_page('',$js,$args);
+ } else {
+ $args->{'redirect'} = [0,$destination];
+ $start_page=&Apache::loncommon::start_page('Successful Login',
+ $js,$args);
+
+ my %lt=&Apache::lonlocal::texthash(
+ 'wel' => 'Welcome',
+ 'pro' => 'Login problems?',
+ );
+ $pagebody = "$lt{'wel'} \n".
+ &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','',' ');
+ my $loginhelp = &loginhelpdisplay($domain);
+ if ($loginhelp) {
+ $pagebody .= ''.$lt{'pro'}.'
';
+ }
+ }
+ $end_page = &Apache::loncommon::end_page();
$r->print(<$lt{'wel'}
-$welcome
-$loginhelp
-$continuelink
+$pagebody
$end_page
ENDSUCCESS
return;
@@ -266,6 +309,26 @@ sub failed {
$retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb;
}
}
+ if (exists($form->{firsturl})) {
+ my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl});
+ if ($firsturl ne '') {
+ $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl;
+ if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) {
+ unless (exists($form->{linkprot})) {
+ if (exists($form->{linkkey})) {
+ $retry .= 'linkkey='.$form->{linkkey};
+ }
+ }
+ }
+ }
+ }
+ if (exists($form->{linkprot})) {
+ my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}},
+ $r->dir_config('lonHostID'));
+ if ($ltoken) {
+ $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken;
+ }
+ }
my $end_page = &Apache::loncommon::end_page();
&Apache::loncommon::content_type($r,'text/html');
$r->send_http_header;
@@ -329,6 +392,9 @@ sub handler {
my $dest = '/adm/roles';
if ($env{'form.firsturl'} ne '') {
$dest = $env{'form.firsturl'};
+ if ($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+ &Apache::lonnet::appenv({'request.deeplink.login' => $env{'form.firsturl'}});
+ }
}
$r->print(
$start_page
@@ -400,7 +466,7 @@ sub handler {
return OK;
}
- my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr)=split(/&/,$tmpinfo);
+ my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr,$linkstr)=split(/&/,$tmpinfo);
if ($rolestr) {
$rolestr = &unescape($rolestr);
}
@@ -410,6 +476,12 @@ sub handler {
if ($iptokenstr) {
$iptokenstr = &unescape($iptokenstr);
}
+ if ($linkstr) {
+ $linkstr = &unescape($linkstr);
+ }
+ if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) {
+ $form{'firsturl'} = $firsturl;
+ }
if ($rolestr =~ /^role=/) {
(undef,$form{'role'}) = split('=',$rolestr);
}
@@ -419,6 +491,11 @@ sub handler {
if ($iptokenstr =~ /^iptoken=/) {
(undef,$form{'iptoken'}) = split('=',$iptokenstr);
}
+ if ($linkstr =~ /^linkprot=/) {
+ (undef,$form{'linkprot'}) = split('=',$linkstr);
+ } elsif ($linkstr =~ /^linkkey=/) {
+ (undef,$form{'linkkey'}) = split('=',$linkstr);
+ }
my $upass = $ENV{HTTPS} ? $form{'upass0'}
: &Apache::loncommon::des_decrypt($key,$form{'upass0'});
@@ -591,7 +668,7 @@ sub handler {
\%form);
my $switchto = '/adm/switchserver?otherserver='.$otherserver;
if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
- $switchto .= '&origurl='.$firsturl;
+ $switchto .= '&origurl='.$firsturl; #should escape
}
if ($form{'role'}) {
$switchto .= '&role='.$form{'role'};
@@ -599,6 +676,14 @@ sub handler {
if ($form{'symb'}) {
$switchto .= '&symb='.$form{'symb'};
}
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+ if ($form{'linkkey'}) {
+ $env{'request.linkkey'} = $form{'linkkey'};
+ }
+ $env{'request.deeplink.login'} = $form{'firsturl'};
+ }
$r->internal_redirect($switchto);
} else {
$r->print(&noswitch());
@@ -612,7 +697,7 @@ sub handler {
\%form);
my $switchto = '/adm/switchserver?otherserver='.$otherserver;
if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
- $switchto .= '&origurl='.$firsturl;
+ $switchto .= '&origurl='.$firsturl; #should escape
}
if ($form{'role'}) {
$switchto .= '&role='.$form{'role'};
@@ -620,6 +705,15 @@ sub handler {
if ($form{'symb'}) {
$switchto .= '&symb='.$form{'symb'};
}
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+ if ($form{'linkkey'}) {
+ $env{'request.linkkey'} = $form{'linkkey'};
+ }
+ $env{'request.deeplink.login'} = $form{'firsturl'};
+
+ }
$r->internal_redirect($switchto);
} else {
$r->print(&noswitch());
@@ -649,6 +743,14 @@ sub handler {
if ($unloaded) {
&success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',
undef,\%form);
+ if ($form{'linkprot'}) {
+ $env{'request.linkprot'} = $form{'linkprot'};
+ } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+ if ($form{'linkkey'}) {
+ $env{'request.linkkey'} = $form{'linkkey'};
+ }
+ $env{'request.deeplink.login'} = $form{'firsturl'};
+ }
$r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl);
return OK;
}
@@ -656,7 +758,23 @@ sub handler {
if (($is_balancer) && ($hosthere)) {
$form{'noloadbalance'} = $hosthere;
}
- &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef,
+ my $extra_env;
+ if ($form{'linkprot'}) {
+ my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2);
+ if ($linkprotector) {
+ $extra_env = {'user.linkprotector' => $linkprotector,
+ 'user.linkproturi' => $uri,};
+ }
+ } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+ if ($form{'linkkey'}) {
+ $extra_env = {'user.deeplinkkey' => $form{'linkkey'},
+ 'user.keyedlinkuri' => $form{'firsturl'},
+ 'request.deeplink.login' => $form{'firsturl'}};
+ } else {
+ $extra_env = {'request.deeplink.login' => $form{'firsturl'}};
+ }
+ }
+ &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env,
\%form);
return OK;
}
@@ -703,6 +821,7 @@ sub check_can_host {
my $protocol = $Apache::lonnet::protocol{$login_host};
$protocol = 'http' if ($protocol ne 'https');
my $newurl = $protocol.'://'.$hostname.'/adm/createaccount';
+#FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host
$r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA').
''.&mt('Account creation').' '.
&mt('You do not currently have a LON-CAPA account at this institution.').' '.
@@ -719,6 +838,14 @@ sub check_can_host {
} else {
&success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef,
$form);
+ if ($form->{'linkprot'}) {
+ $env{'request.linkprot'} = $form->{'linkprot'};
+ } elsif ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+ if ($form->{'linkkey'}) {
+ $env{'request.linkkey'} = $form->{'linkkey'};
+ }
+ $env{'request.deeplink.login'} = $form->{'firsturl'};
+ }
my ($otherserver) = &Apache::lonnet::choose_server($udom);
$r->internal_redirect('/adm/switchserver?otherserver='.$otherserver);
}