[LON-CAPA-cvs] cvs: loncom /auth lonauth.pm

[albertel]

albertel		Fri Jun  2 16:22:29 2006 EDT

  Modified files:              
    /loncom/auth	lonauth.pm 
  Log:
  - eliminate use of Apache::File
  - session environment should be escaped
  
  
Index: loncom/auth/lonauth.pm
diff -u loncom/auth/lonauth.pm:1.77 loncom/auth/lonauth.pm:1.78
--- loncom/auth/lonauth.pm:1.77	Wed May 31 11:33:39 2006
+++ loncom/auth/lonauth.pm	Fri Jun  2 16:22:26 2006
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.77 2006/05/31 15:33:39 albertel Exp $
+# $Id: lonauth.pm,v 1.78 2006/06/02 20:22:26 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -29,8 +29,8 @@
 package Apache::lonauth;
 
 use strict;
+use LONCAPA;
 use Apache::Constants qw(:common);
-use Apache::File;
 use CGI qw(:standard);
 use CGI::Cookie();
 use DynaLoader; # for Crypt::DES version
@@ -109,15 +109,13 @@
     }
 # ------------------------------------------------------------- Get environment
 
-    my $userenv;
     my %userenv=Apache::lonnet::dump('environment',$domain,$username);
     my ($tmp) = keys(%userenv);
     if ($tmp !~ /^(con_lost|error|no_such_host)/i) {
 	# default remote control to off
 	if ($userenv{'remote'} ne 'on') { $userenv{'remote'} = 'off'; }
-	foreach my $key (keys(%userenv)) {
-	    $userenv.="environment.$key=$userenv{$key}\n";
-	}
+    } else {
+	undef(%userenv);
     }
     if (($userenv{'interface'}) && (!$FORM{'interface'})) {
 	$FORM{'interface'}=$userenv{'interface'};
@@ -134,50 +132,60 @@
 # --------------------------------------------------------- Write first profile
 
     {
-	my $idf=Apache::File->new(">$lonids/$cookie.id");
-	unless (flock($idf,LOCK_EX)) {
-	    &Apache::lonnet::logthis("<font color=blue>WARNING: ".
-			   'Could not obtain exclusive lock in lonauth: '.$!);
-	    $idf->close();
-	    return 'error: '.$!;
-	}
-	if ($userenv ne '') { print $idf "$userenv\n"; }
-	print $idf "user.name=$username\n";
-	print $idf "user.domain=$domain\n";
-	print $idf "user.home=$authhost\n";
-	print $idf "browser.type=$clientbrowser\n";
-	print $idf "browser.version=$clientversion\n";
-	print $idf "browser.mathml=$clientmathml\n";
-	print $idf "browser.unicode=$clientunicode\n";
-	print $idf "browser.os=$clientos\n";
+	my %initial_env = 
+	    ("user.name"          => $username,
+	     "user.domain"        => $domain,
+	     "user.home"          => $authhost,
+	     "browser.type"       => $clientbrowser,
+	     "browser.version"    => $clientversion,
+	     "browser.mathml"     => $clientmathml,
+	     "browser.unicode"    => $clientunicode,
+	     "browser.os"         => $clientos,
+	     "server.domain"      => $r->dir_config('lonDefDomain'),
+	     "request.course.fn"  => '',
+	     "request.course.uri" => '',
+	     "request.course.sec" => '',
+	     "request.role"       => 'cm',
+	     "request.role.adv"   => $env{'user.adv'},
+	     "request.host"       => $ENV{'REMOTE_ADDR'},);
+
         if ($FORM{'localpath'}) {
-           print $idf "browser.localpath=$FORM{'localpath'}\n";
-           print $idf "browser.localres=$FORM{'localres'}\n";
+	    $initial_env{"browser.localpath"}  = $FORM{'localpath'};
+	    $initial_env{"browser.localres"}   = $FORM{'localres'};
         }
-        print $idf "server.domain=".$r->dir_config('lonDefDomain')."\n";
-	print $idf "request.course.fn=\n";
-	print $idf "request.course.uri=\n";
-	print $idf "request.course.sec=\n";
-	print $idf "request.role=cm\n";
-        print $idf "request.role.adv=$env{'user.adv'}\n";
-	print $idf "request.host=$ENV{'REMOTE_ADDR'}\n";
+	
 	if ($public) {
-	    print $idf "environment.remote=off\n";
+	    $initial_env{"environment.remote"} = "off";
 	}
 	if ($FORM{'interface'}) {
 	    $FORM{'interface'}=~s/\W//gs;
-	    print $idf "browser.interface=$FORM{'interface'}\n";
+	    $initial_env{"browser.interface"} = $FORM{'interface'};
 	    $env{'browser.interface'}=$FORM{'interface'};
-	    foreach ('imagesuppress','appletsuppress',
-		     'embedsuppress','fontenhance','blackwhite') {
-		if (($FORM{$_} eq 'true') ||
-		    ($userenv{$_} eq 'on')) {
-		    print $idf "browser.$_=on\n";
+	    foreach my $option ('imagesuppress','appletsuppress',
+				'embedsuppress','fontenhance','blackwhite') {
+		if (($FORM{$option} eq 'true') ||
+		    ($userenv{$option} eq 'on')) {
+		    $initial_env{"browser.$option"} = "on";
 		}
 	    }
 	}
+
+	open(my $idf,">$lonids/$cookie.id");
+	unless (flock($idf,LOCK_EX)) {
+	    &Apache::lonnet::logthis("<font color=blue>WARNING: ".
+			   'Could not obtain exclusive lock in lonauth: '.$!);
+	    close($idf);
+	    return 'error: '.$!;
+	}
+
+	while (my ($key,$value) = each(%initial_env)) {
+	    print $idf (&escape($key).'='.&escape($value)."\n");
+	}
+	while (my ($key,$value) = each(%userenv)) {
+	    print $idf (&escape($key).'='.&escape($value)."\n");
+	}
 	if ($userroles ne '') { print $idf "$userroles"; }
-	$idf->close();
+	close($idf);
     }
     $env{'request.role'}='cm';
     $env{'request.role.adv'}=$env{'user.adv'};