loncom/auth/switchserver.pm - view

File: [LON-CAPA] / loncom / auth / switchserver.pm
Revision 1.48: download - view: text, annotated - select for diffs
Sun Jan 27 16:02:43 2019 UTC (5 years, 4 months ago) by raeburn
Branches: MAIN
CVS tags: HEAD

- Bug 6400
  - Enforce access restrictions for content which is deeplink-only (users
    with "advanced priv for current role are exempt).
  - Support "key" link type in deeplink parameter (requested link must either
    be sent with linkkey as element in POSTed data, or with linkkey in query
    string).  Corresponding value must match key set in deeplink parameter.

1: # The LearningOnline Network 2: # Switch Servers Handler 3: # 4: # $Id: switchserver.pm,v 1.48 2019/01/27 16:02:43 raeburn Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: 29: package Apache::switchserver; 30: 31: use strict; 32: use Apache::Constants qw(:common); 33: use Apache::lonnet; 34: use Digest::MD5 qw(md5_hex); 35: use CGI::Cookie(); 36: use Apache::lonlocal; 37: use LONCAPA qw(:DEFAULT :match); 38: 39: sub init_env { 40: my ($r) = @_; 41: 42: if (-e $env{'user.environment'}) { 43: return $env{'user.environment'}; 44: } 45: my $requrl=$r->uri; 46: my $handle= &Apache::lonnet::check_for_valid_session($r); 47: if ($handle ne '') { 48: return undef; 49: } 50: my $lonidsdir=$r->dir_config('lonIDsDir'); 51: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); 52: 53: return $r->dir_config('lonIDsDir')."/$handle.id"; 54: } 55: 56: sub do_redirect { 57: my ($r,$url,$only_body,$extra_text) = @_; 58: $r->send_http_header; 59: my $start_page = 60: &Apache::loncommon::start_page('Switching Server ...',undef, 61: {'redirect' => [0.5,$url], 62: 'only_body' => $only_body,}); 63: my $end_page = &Apache::loncommon::end_page(); 64: $r->print($start_page.$extra_text.$end_page); 65: unless ($env{'user.name'} eq 'public' && ($env{'user.domain'} eq 'public')) { 66: $r->register_cleanup(\&flush_course_logs); 67: } 68: return OK; 69: } 70: 71: sub balancer_cookieid { 72: my ($r,$desthost,$uname,$udom) = @_; 73: my @hosts = &Apache::lonnet::current_machine_ids(); 74: my $newcookieid; 75: unless (grep(/^\Q$desthost\E$/,@hosts)) { 76: my $balancedir=$r->dir_config('lonBalanceDir'); 77: $newcookieid = &md5_hex(&md5_hex(time.{}.rand().$$)); 78: my $cookie = $udom.'_'.$uname.'_'.$newcookieid; 79: my $balcookie = "balanceID=$cookie; path=/; HttpOnly;"; 80: if (open(my $fh,'>',"$balancedir/$cookie.id")) { 81: print $fh $desthost; 82: close($fh); 83: $r->headers_out->add('Set-cookie' => $balcookie); 84: } 85: } 86: return $newcookieid; 87: } 88: 89: sub flush_course_logs { 90: &Apache::lonnet::flushcourselogs(); 91: return OK; 92: } 93: 94: sub handler { 95: my ($r) = @_; 96: 97: my $handle=&init_env($r); 98: if (!defined($handle)) { return FORBIDDEN; } 99: 100: &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'}, 101: ['otherserver','role','origurl','symb']); 102: 103: my $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'}); 104: if (! $env{'form.otherserver'}) { 105: $env{'form.otherserver'} = 106: &Apache::lonnet::find_existing_session($env{'user.domain'}, 107: $env{'user.name'}); 108: if (! $env{'form.otherserver'}) { 109: $env{'form.otherserver'} = 110: &Apache::lonnet::spareserver(30000,undef,1); 111: } 112: $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'}); 113: } 114: 115: if (!defined($switch_to)) { return FORBIDDEN; } 116: 117: my $protocol = 'http'; 118: if ($env{'form.otherserver'}) { 119: if ($Apache::lonnet::protocol{$env{'form.otherserver'}} eq 'https') { 120: $protocol = $Apache::lonnet::protocol{$env{'form.otherserver'}}; 121: } 122: } 123: 124: if ($env{'user.name'} eq 'public' 125: && $env{'user.domain'} eq 'public') { 126: my $url = $protocol.'://'.$switch_to.$r->uri; 127: unlink($handle); 128: #expire the cookie 129: my $c = new CGI::Cookie(-name => 'lonPubID', 130: -value => '', 131: -expires => '-10y',); 132: $r->header_out('Set-cookie' => $c); 133: return &do_redirect($r,$url,1) 134: } 135: 136: my $skip_canhost_check = ''; 137: my $now = time; 138: if ($env{'form.role'}) { 139: if (!exists($env{'user.role.'.$env{'form.role'}})) { 140: delete($env{'form.role'}); 141: } else { 142: my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}}); 143: if (($start && $start > $now) || ($end && $end < $now)) { 144: delete($env{'form.role'}); 145: } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') { 146: if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) { 147: $skip_canhost_check = 1; 148: } 149: } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)$}) { 150: my ($audom,$auname) = ($1,$2); 151: if (&Apache::lonnet::homeserver($auname,$audom) eq $env{'form.otherserver'}) { 152: if ((&Apache::lonnet::will_trust('othcoau',$env{'user.domain'},$audom)) && 153: (&Apache::lonnet::will_trust('coaurem',$audom,$env{'user.domain'}))) { 154: $skip_canhost_check = 1; 155: } 156: } 157: } 158: } 159: } 160: 161: unless ($skip_canhost_check) { 162: my $canhost = 1; 163: my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary'); 164: my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id); 165: my @intdoms; 166: my $internet_names = &Apache::lonnet::get_internet_names($env{'form.otherserver'}); 167: if (ref($internet_names) eq 'ARRAY') { 168: @intdoms = @{$internet_names}; 169: } 170: unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) { 171: my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to); 172: my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID); 173: my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom); 174: my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'}); 175: my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'}); 176: $canhost = 177: &Apache::lonnet::can_host_session($env{'user.domain'}, 178: $env{'form.otherserver'}, 179: $remoterev, 180: $udomdefaults{'remotesessions'}, 181: $defdomdefaults{'hostedsessions'}); 182: } 183: unless ($canhost) { return FORBIDDEN; } 184: } 185: 186: #remove session env, and log event 187: if (unlink($handle)) { 188: if ($env{'user.linkedenv'} ne '') { 189: my $lonidsdir=$r->dir_config('lonIDsDir'); 190: if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) && 191: (-l "$lonidsdir/$env{'user.linkedenv'}.id") && 192: (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq $handle)) { 193: unlink("$lonidsdir/$env{'user.linkedenv'}.id"); 194: } 195: } 196: } 197: my %temp=('switchserver' => $now.':'.$env{'form.otherserver'}, 198: $env{'form.role'}); 199: &Apache::lonnet::put('email_status',\%temp); 200: my $logmsg = "Switch Server to $env{'form.otherserver'}"; 201: if ($env{'form.role'}) { 202: $logmsg .= " with role: $env{'form.role'}"; 203: } elsif (($env{'form.lti.reqcrs'}) && ($env{'form.lti.reqrole'} eq 'cc')) { 204: $logmsg .= " to create new LTI course"; 205: } elsif ($env{'form.lti.selfenrollrole'}) { 206: $logmsg .= " to selfenroll with role: $env{'form.lti.selfenrollrole'}"; 207: } else { 208: $logmsg .= " (no role)"; 209: } 210: $logmsg .= ' '.$ENV{'REMOTE_ADDR'}; 211: &Apache::lonnet::log($env{'user.domain'},$env{'user.name'}, 212: $env{'user.home'},$logmsg); 213: 214: &Apache::loncommon::content_type($r,'text/html'); 215: 216: #expire the cookies 217: my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); 218: foreach my $name (keys(%cookies)) { 219: next unless ($name =~ /^lon(|S|Link|Pub)ID$/); 220: my $c = new CGI::Cookie(-name => $name, 221: -value => '', 222: -expires => '-10y',); 223: $r->headers_out->add('Set-cookie' => $c); 224: } 225: if ($r->header_only) { 226: $r->send_http_header; 227: return OK; 228: } 229: # -------------------------------------------------------- Menu script and info 230: 231: # ---------------------------------------------------------------- Get handover 232: 233: my $newcookieid; 234: my ($is_balancer,$posshost,$setcookie,$offloadto,$dom_balancers) = 235: &Apache::lonnet::check_loadbalancing($env{'user.name'},$env{'user.domain'}); 236: if ($is_balancer && $setcookie && $env{'form.otherserver'}) { 237: 238: # Set a balancer cookie unless browser already sent LON-CAPA load balancer 239: # cookie which points at the target server 240: my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r,1); 241: 242: unless (($found_server eq $env{'form.otherserver'}) && 243: ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) { 244: $newcookieid = &balancer_cookieid($r,$env{'form.otherserver'}, 245: $env{'user.name'},$env{'user.domain'}); 246: } 247: } 248: 249: my %info=('ip' => $ENV{'REMOTE_ADDR'}, 250: 'domain' => $env{'user.domain'}, 251: 'username' => $env{'user.name'}, 252: 'home' => $env{'user.home'}, 253: 'role' => $env{'form.role'}, 254: 'server' => $r->dir_config('lonHostID'), 255: 'balancer' => $is_balancer, 256: 'dom_balancers' => $dom_balancers, 257: 'offloadto' => ''); 258: if (ref($offloadto) eq 'HASH') { 259: foreach my $key (keys(%{$offloadto})) { 260: if (ref($offloadto->{$key}) eq 'ARRAY') { 261: $info{'offloadto'} .= $key.'='.join(',',@{$offloadto->{$key}}).'&'; 262: } 263: } 264: $info{'offloadto'} =~ s/\&$//; 265: } elsif (ref($offloadto) eq 'ARRAY') { 266: $info{'offloadto'} = join(',',@{$offloadto}); 267: } 268: if ($newcookieid) { 269: $info{'balcookie'} = $newcookieid; 270: } 271: if ($env{'form.origurl'}) { 272: $info{'origurl'} = $env{'form.origurl'}; 273: } 274: if ($env{'form.symb'}) { 275: $info{'symb'} = $env{'form.symb'}; 276: } 277: if ($env{'request.sso.login'}) { 278: $info{'sso.login'} = $env{'request.sso.login'}; 279: } 280: if ($env{'request.sso.reloginserver'}) { 281: $info{'sso.reloginserver'} = $env{'request.sso.reloginserver'}; 282: } 283: if ($env{'request.linkprot'}) { 284: $info{'linkprot'} = $env{'request.linkprot'}; 285: } 286: if ($env{'request.deeplink.login'}) { 287: $info{'deeplink.login'} = $env{'request.deeplink.login'}; 288: if ($env{'request.linkkey'}) { 289: $info{'linkkey'} = $env{'request.linkkey'}; 290: } 291: } 292: if ($env{'request.lti.login'}) { 293: $info{'lti.login'} = $env{'request.lti.login'}; 294: } 295: if ($env{'request.lti.uri'}) { 296: $info{'lti.uri'} = $env{'request.lti.uri'}; 297: } 298: if ($env{'request.lti.reqcrs'}) { 299: $info{'lti.reqcrs'} = $env{'request.lti.reqcrs'}; 300: } 301: if ($env{'request.lti.reqrole'}) { 302: $info{'lti.reqrole'} = $env{'request.lti.reqrole'}; 303: } 304: if ($env{'request.lti.selfenrollrole'}) { 305: $info{'lti.selfenrollrole'} = $env{'request.lti.selfenrollrole'}; 306: } 307: if ($env{'request.lti.sourcecrs'}) { 308: $info{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'}; 309: } 310: if ($env{'request.lti.passbackid'}) { 311: $info{'lti.passbackid'} = $env{'request.lti.passbackid'}; 312: } 313: if ($env{'request.lti.passbackurl'}) { 314: $info{'lti.passbackurl'} = $env{'request.lti.passbackurl'}; 315: } 316: if ($env{'request.lti.rosterid'}) { 317: $info{'lti.rosterid'} = $env{'request.lti.rosterid'}; 318: } 319: if ($env{'request.lti.rosterurl'}) { 320: $info{'lti.rosterurl'} = $env{'request.lti.rosterurl'}; 321: } 322: if ($env{'request.lti.target'}) { 323: $info{'lti.target'} = $env{'request.lti.target'}; 324: } 325: my $token = &Apache::lonnet::tmpput(\%info,$env{'form.otherserver'}); 326: my $url =$protocol.'://'.$switch_to.'/adm/login?'. 327: 'domain='.$env{'user.domain'}. 328: '&username='.$env{'user.name'}. 329: '&token='.$token; 330: # --------------------------------------------------------------- Screen Output 331: return &do_redirect($r, $url, 0); 332: } 333: 334: 1; 335: __END__ 336: 337: 338: 339: 340: 341: 342: 343: