' .'' .'' @@ -747,6 +749,7 @@ if ($env{'form.only_body'}) { $args->{'only_body'} = 1; } + $args->{'hostname'} = $r->hostname(); my $start_page = &Apache::loncommon::start_page("Syllabus", $rss_link.$js,$args); if ($start_page) { Index: loncom/auth/lonroles.pm diff -u loncom/auth/lonroles.pm:1.325 loncom/auth/lonroles.pm:1.326 --- loncom/auth/lonroles.pm:1.325 Sat Jan 28 03:48:52 2017 +++ loncom/auth/lonroles.pm Mon Feb 20 18:29:28 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # User Roles Screen # -# $Id: lonroles.pm,v 1.325 2017/01/28 03:48:52 raeburn Exp $ +# $Id: lonroles.pm,v 1.326 2017/02/20 18:29:28 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -674,6 +674,14 @@ } } } + if ($dest =~ m{^\Q/public/$cdom/$cnum/syllabus\E.*(\?|\&)usehttp=1}) { + if ($ENV{'SERVER_PORT'} == 443) { + my $hostname = $r->hostname(); + if ($hostname ne '') { + $dest = 'http://'.$hostname.$dest; + } + } + } if ($dest =~ m{^/enc/}) { if ($env{'request.role.adv'}) { $dest = &Apache::lonenc::unencrypted($dest); @@ -706,7 +714,7 @@ unless (($dest =~ m{^/enc/}) || ($dest =~ /(\?|\&)symb=.+___\d+___.+/)) { if (($destsymb ne '') && ($destsymb !~ m{^/enc/})) { my $esc_symb = &escape($destsymb); - $dest .= '?symb='.$esc_symb; + $dest .= (($dest =~/\?/)? '&':'?').'symb='.$esc_symb; } } &redirect_user($r, &mt('Entering [_1]', Index: rat/lonpage.pm diff -u rat/lonpage.pm:1.120 rat/lonpage.pm:1.121 --- rat/lonpage.pm:1.120 Sat Oct 29 05:49:28 2016 +++ rat/lonpage.pm Mon Feb 20 18:29:33 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # Page Handler # -# $Id: lonpage.pm,v 1.120 2016/10/29 05:49:28 raeburn Exp $ +# $Id: lonpage.pm,v 1.121 2017/02/20 18:29:33 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -951,9 +951,11 @@ my ($cfile,$home,$switchserver,$forceedit,$forceview) = &Apache::lonnet::can_edit_resource($file,$cnum,$cdom,$hash->{'src_'.$rid},$symb); if ($cfile ne '') { + my $hostname = $r->hostname(); my $jscall = &Apache::lonhtmlcommon::jump_to_editres($cfile,$home,$switchserver, $forceedit,1,$symb,undef, - &escape($env{'form.title'})); + &escape($env{'form.title'}), + $hostname); if ($jscall) { my $icon = 'pcstr.png'; my $label = &mt('Edit'); Index: rat/lonpageflip.pm diff -u rat/lonpageflip.pm:1.92 rat/lonpageflip.pm:1.93 --- rat/lonpageflip.pm:1.92 Sat Feb 18 23:39:24 2017 +++ rat/lonpageflip.pm Mon Feb 20 18:29:33 2017 @@ -2,7 +2,7 @@ # # Page flip handler # -# $Id: lonpageflip.pm,v 1.92 2017/02/18 23:39:24 raeburn Exp $ +# $Id: lonpageflip.pm,v 1.93 2017/02/20 18:29:33 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -245,7 +245,6 @@ my ($newmapid,$newresid)=split(/\./,$newrid); my $symb=&Apache::lonnet::encode_symb($newmap,$newresid,$hash{'src_'.$newrid}); $furl=&add_get_param($hash{'src_'.$newrid},{ 'symb' => $symb }); - &check_for_syllabus(\$furl); if ($hash{'encrypted_'.$newrid}) { $furl=&Apache::lonenc::encrypted($furl); } @@ -283,6 +282,7 @@ sub check_for_syllabus { my ($srcref) = @_; return unless (ref($srcref) eq 'SCALAR'); + my $usehttp; if ($env{'request.course.id'}) { my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'}; my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'}; @@ -290,8 +290,10 @@ ($ENV{'SERVER_PORT'} == 443) && ($env{'course.'.$env{'request.course.id'}.'.externalsyllabus'} =~ m{^http://})) { $$srcref .= (($$srcref =~/\?/)? '&':'?') . 'usehttp=1'; + $usehttp = 1; } } + return $usehttp; } # ================================================================ Main Handler @@ -331,9 +333,14 @@ } } elsif ($direction eq 'firstanswerable') { my $furl = &first_answerable_ressymb(); + my $usehttp = &check_for_syllabus(\$furl); + if ($usehttp) { + $furl='http://'.$ENV{'SERVER_NAME'}.$furl; + } else { + $furl=&Apache::lonnet::absolute_url().$furl; + } &Apache::loncommon::content_type($r,'text/html'); - $r->header_out(Location => - &Apache::lonnet::absolute_url().$furl); + $r->header_out(Location => $furl); return REDIRECT; } elsif ($direction eq 'endplacement') { &Apache::loncommon::content_type($r,'text/html'); @@ -379,22 +386,26 @@ } if ($direction eq 'firstres') { my $furl=&first_accessible_resource(); + my $usehttp = &check_for_syllabus(\$furl); + if ($usehttp) { + $furl='http://'.$ENV{'SERVER_NAME'}.$furl; + } else { + $furl=&Apache::lonnet::absolute_url().$furl; + } &Apache::loncommon::content_type($r,'text/html'); - $r->header_out(Location => - &Apache::lonnet::absolute_url().$furl); - + $r->header_out(Location => $furl); return REDIRECT; } if ($direction eq 'return') { # -------------------------------------------------------- Return to last known - my $newloc; + my ($newloc,$usehttp); if (($last) && (tie(%hash,'GDBM_File',$env{'request.course.fn'}.'.db', &GDBM_READER(),0640))) { my ($murl,$id,$fn)=&Apache::lonnet::decode_symb($last); $id=$hash{'map_pc_'.&Apache::lonnet::clutter($murl)}.'.'.$id; $newloc=$hash{'src_'.$id}; if ($newloc) { - &check_for_syllabus(\$newloc); + $usehttp = &check_for_syllabus(\$newloc); if ($hash{'encrypted_'.$id}) { $newloc=&Apache::lonenc::encrypted($newloc); } elsif ($newloc =~ m{^(/adm/wrapper/ext/[^\#]+)\#([^\#]+)$}) { @@ -407,10 +418,13 @@ } else { $newloc='/adm/navmaps'; } + if ($usehttp) { + $newloc='http://'.$ENV{'SERVER_NAME'}.$newloc; + } else { + $newloc=&Apache::lonnet::absolute_url().$newloc + } &Apache::loncommon::content_type($r,'text/html'); - $r->header_out(Location => - &Apache::lonnet::absolute_url().$newloc); - + $r->header_out(Location => $newloc); return REDIRECT; } # @@ -514,8 +528,12 @@ # ------------------------------------- Check for and display critical messages my ($redirect, $url) = &Apache::loncommon::critical_redirect(300); unless ($redirect) { - &check_for_syllabus(\$redirecturl); - $url=&Apache::lonnet::absolute_url().$redirecturl; + my $usehttp = &check_for_syllabus(\$redirecturl); + if ($usehttp) { + $url='http://'.$ENV{'SERVER_NAME'}.$redirecturl; + } else { + $url=&Apache::lonnet::absolute_url().$redirecturl; + } my $addanchor; if (($anchor ne '') && (!$enc || $env{'request.role.adv'})) { $addanchor = 1; @@ -565,7 +583,10 @@ ENDSTART foreach my $id (@possibilities) { my $src = $multichoicehash{'src_'.$id}; - &check_for_syllabus(\$src); + my $usehttp = &check_for_syllabus(\$src); + if ($usehttp) { + $src = 'http://'.$ENV{'SERVER_NAME'}.$src; + } $r->print( 'status(403); + return OK; + } + } my $file = &Apache::lonnet::filelocation('', $uri); &Apache::lonnet::repcopy($file); if (! -e $file) { @@ -96,17 +106,26 @@ if ($uri eq '/') { # root: let users browse /res $res .= "\n"; + $res .= "\n"; $res .= "\n"; } elsif ($uri !~ /^\/(priv|res)\//) { + $request->content_type('text/plain'); + $request->print("Not found: $uri"); $request->status(404); return OK; } elsif ($uri =~ /^\/res\//) { + # NOTE: dirlist does not return an error for /res/idontexist/ (my $listref, $listerror) = &Apache::lonnet::dirlist($uri); if ($listerror) { $request->content_type('text/plain'); $request->print("listing error: $listerror"); $request->status(406); return OK; + } elsif ($uri =~ /^\/res\/[^\/]+\/$/ && scalar(@{$listref}) == 0) { + $request->content_type('text/plain'); + $request->print("Not found: $uri"); + $request->status(404); + return OK; } my $dirname = $uri; $dirname =~ s/^.*\/([^\/]*)$/$1/; @@ -114,7 +133,7 @@ if (ref($listref) eq 'ARRAY') { my @lines = @{$listref}; foreach my $line (@lines) { - my ($path, $dom, undef, $testdir, undef, undef, undef, undef, undef, undef, undef, undef, undef, undef, $obs, undef) = split(/\&/, $line, 16); + my ($path, $dom, undef, $testdir, undef, undef, undef, undef, $size, undef, $mtime, undef, undef, undef, $obs, undef) = split(/\&/, $line, 16); my $isdir = ($testdir & 16384) || $dom =~ /^(user|domain)$/; $path =~ s/^\/home\/httpd\/html\/res\///; next if $path eq '.' || $path eq '..'; @@ -137,13 +156,46 @@ if ($isdir) { $res .= "\n"; } else { - $res .= "\n"; + my $dt = DateTime->from_epoch(epoch => $mtime); + my $modified = $dt->iso8601().'Z'; + $res .= "\n"; } } } - } else { + } elsif ($uri eq '/priv/') { + my $udom = $env{'user.domain'}; + if (!defined $udom) { + $request->content_type('text/plain'); + $request->print("Forbidden URI: $uri"); + $request->status(403); + return OK; + } + $res .= "\n"; + $res .= "\n"; + } elsif ($uri =~ /^\/priv\/([^\/]+)\/$/) { + my $domain = $1; + my ($uname, $udom) = ($env{'user.name'}, $env{'user.domain'}); + if (!defined $uname || !defined $udom || $domain ne $udom) { + $request->content_type('text/plain'); + $request->print("Forbidden URI: $uri"); + $request->status(403); + return OK; + } + $res .= "\n"; + $res .= "\n"; + } elsif ($uri =~ /^\/priv\/([^\/]+)\/([^\/]+)\//) { + my ($domain, $user) = ($1, $2); + my ($uname, $udom) = ($env{'user.name'}, $env{'user.domain'}); + if (!defined $uname || !defined $udom || $domain ne $udom || $user ne $uname) { + $request->content_type('text/plain'); + $request->print("Forbidden URI: $uri"); + $request->status(403); + return OK; + } my $dirpath = &Apache::lonnet::filelocation('', $uri); if (! -e $dirpath) { + $request->content_type('text/plain'); + $request->print("Not found: $uri"); $request->status(404); return OK; } @@ -176,6 +228,11 @@ $res .= "/>\n"; } } + } else { + $request->content_type('text/plain'); + $request->print("Not found: $uri"); + $request->status(404); + return OK; } $res .= "\n"; &Apache::loncommon::content_type($request, 'text/xml', 'utf-8'); Index: loncom/loncapa_apache.conf diff -u loncom/loncapa_apache.conf:1.252 loncom/loncapa_apache.conf:1.253 --- loncom/loncapa_apache.conf:1.252 Thu Feb 23 21:32:15 2017 +++ loncom/loncapa_apache.conf Fri Feb 24 17:35:01 2017 @@ -2,7 +2,7 @@ ## loncapa_apache.conf -- Apache HTTP LON-CAPA configuration file ## -# $Id: loncapa_apache.conf,v 1.252 2017/02/23 21:32:15 damieng Exp $ +# $Id: loncapa_apache.conf,v 1.253 2017/02/24 17:35:01 damieng Exp $ # # LON-CAPA Section (extensions to httpd.conf daemon configuration) @@ -469,7 +469,7 @@ PerlHandler Apache::lonxml - + AuthType LONCAPA Require valid-user PerlAuthzHandler Apache::loncacc @@ -479,6 +479,12 @@ ErrorDocument 500 /adm/errorhandler + +AuthType LONCAPA +Require valid-user +PerlAuthzHandler Apache::lonacc + + AuthType LONCAPA Require valid-user @@ -509,12 +515,7 @@ PerlHandler Apache::daxeopen - -SetHandler perl-script -PerlHandler Apache::daxeopen - - - + SetHandler perl-script PerlHandler Apache::daxeopen From raeburn at source.lon-capa.org Sat Feb 25 14:56:09 2017 From: raeburn at source.lon-capa.org (raeburn) Date: Sat, 25 Feb 2017 19:56:09 -0000 Subject: [LON-CAPA-cvs] cvs: loncom /auth lonlogin.pm publiccheck.pm Message-ID: raeburn Sat Feb 25 19:56:09 2017 EDT Modified files: /loncom/auth publiccheck.pm lonlogin.pm Log: - Name of cookie for public user set to lonPubID. Index: loncom/auth/publiccheck.pm diff -u loncom/auth/publiccheck.pm:1.25 loncom/auth/publiccheck.pm:1.26 --- loncom/auth/publiccheck.pm:1.25 Fri Feb 17 18:37:57 2017 +++ loncom/auth/publiccheck.pm Sat Feb 25 19:56:09 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network # Cookie Based Access Handler # -# $Id: publiccheck.pm,v 1.25 2017/02/17 18:37:57 raeburn Exp $ +# $Id: publiccheck.pm,v 1.26 2017/02/25 19:56:09 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -92,7 +92,7 @@ my $cookie=&Apache::lonauth::success($r,'public','public','public'); my $lonidsdir=$r->dir_config('lonIDsDir'); &Apache::lonnet::transfer_profile_to_env($lonidsdir,$cookie); - $r->err_header_out('Set-cookie',"lonPublic=$cookie; path=/; HttpOnly"); + $r->err_header_out('Set-cookie',"lonPubID=$cookie; path=/; HttpOnly"); } &Apache::lonacc::get_posted_cgi($r); $env{'request.state'} = "published"; Index: loncom/auth/lonlogin.pm diff -u loncom/auth/lonlogin.pm:1.169 loncom/auth/lonlogin.pm:1.170 --- loncom/auth/lonlogin.pm:1.169 Fri Feb 17 18:37:05 2017 +++ loncom/auth/lonlogin.pm Sat Feb 25 19:56:09 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network # Login Screen # -# $Id: lonlogin.pm,v 1.169 2017/02/17 18:37:05 raeburn Exp $ +# $Id: lonlogin.pm,v 1.170 2017/02/25 19:56:09 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -75,7 +75,7 @@ &Apache::lonlocal::get_language_handle($r); &Apache::loncommon::content_type($r,'text/html'); if ($expire) { - my $c = new CGI::Cookie(-name => 'lonPublic', + my $c = new CGI::Cookie(-name => 'lonPubID', -value => '', -expires => '-10y',); $r->header_out('Set-cookie' => $c); From raeburn at source.lon-capa.org Sat Feb 25 14:48:34 2017 From: raeburn at source.lon-capa.org (raeburn) Date: Sat, 25 Feb 2017 19:48:34 -0000 Subject: [LON-CAPA-cvs] cvs: loncom /interface lonhtmlcommon.pm Message-ID: raeburn Sat Feb 25 19:48:34 2017 EDT Modified files: /loncom/interface lonhtmlcommon.pm Log: - Accommodate case where Syllabus is included in Main Content, so $resurl is extracted from symb. - URL arg in go() item for "Edit" link is an absolute link, where a value has set for $env{'request.use_absolute'}. Index: loncom/interface/lonhtmlcommon.pm diff -u loncom/interface/lonhtmlcommon.pm:1.381 loncom/interface/lonhtmlcommon.pm:1.382 --- loncom/interface/lonhtmlcommon.pm:1.381 Mon Feb 20 18:29:22 2017 +++ loncom/interface/lonhtmlcommon.pm Sat Feb 25 19:48:33 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # a pile of common html routines # -# $Id: lonhtmlcommon.pm,v 1.381 2017/02/20 18:29:22 raeburn Exp $ +# $Id: lonhtmlcommon.pm,v 1.382 2017/02/25 19:48:33 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -1902,7 +1902,7 @@ $env{'course.'.$env{'request.course.id'}.'.description'}; $no_mt_descr = 1; if ($env{'request.noversionuri'} =~ - m{^/public/($match_domain)/($match_courseid)/syllabus$}) { + m{^/?public/($match_domain)/($match_courseid)/syllabus$}) { unless (($env{'course.'.$env{'request.course.id'}.'.domain'} eq $1) && ($env{'course.'.$env{'request.course.id'}.'.num'} eq $2)) { $description = 'Menu'; @@ -3520,7 +3520,7 @@ if ($cfile =~ m{^(/adm/wrapper/ext/[^#]+)#([^#]+)$}) { $cfile = $1; $anchor = $2; - } elsif ($cfile =~ m{^/public/($match_domain)/($match_courseid)/syllabus}) { + } elsif ($cfile =~ m{^/?public/($match_domain)/($match_courseid)/syllabus}) { if ($ENV{'SERVER_PORT'} == 443) { my ($cdom,$cnum) = ($1,$2); if (($env{'request.course.id'}) && @@ -3560,14 +3560,16 @@ } if ($forceedit) { $cfile .= (($cfile=~/\?/)?'&':'?').'forceedit=1'; - if (($usehttps) && ($hostname ne '')) { - $cfile = 'https://'.$hostname.$cfile; + if ($usehttps) { + $cfile = $env{'request.use_absolute'}.(($cfile =~ /^\//)? '':'/').$cfile; } } elsif ($usehttp) { if ($hostname ne '') { - $cfile = 'http://'.$hostname.$cfile; + $cfile = 'http://'.$hostname.(($cfile =~ /^\//)? '':'/').$cfile; } $cfile .= (($cfile=~/\?/)?'&':'?').'usehttp=1'; + } elsif ($usehttps) { + $cfile = $env{'request.use_absolute'}.(($cfile =~ /^\//)? '':'/').$cfile; } if ($forcereg) { $cfile .= (($cfile=~/\?/)?'&':'?').'register=1'; From raeburn at source.lon-capa.org Sat Feb 25 14:50:17 2017 From: raeburn at source.lon-capa.org (raeburn) Date: Sat, 25 Feb 2017 19:50:17 -0000 Subject: [LON-CAPA-cvs] cvs: loncom /interface loncommon.pm Message-ID: raeburn Sat Feb 25 19:50:17 2017 EDT Modified files: /loncom/interface loncommon.pm Log: - Modify comment in init_user_environment - Coding style Index: loncom/interface/loncommon.pm diff -u loncom/interface/loncommon.pm:1.1274 loncom/interface/loncommon.pm:1.1275 --- loncom/interface/loncommon.pm:1.1274 Mon Feb 20 18:29:22 2017 +++ loncom/interface/loncommon.pm Sat Feb 25 19:50:16 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # a pile of common routines # -# $Id: loncommon.pm,v 1.1274 2017/02/20 18:29:22 raeburn Exp $ +# $Id: loncommon.pm,v 1.1275 2017/02/25 19:50:16 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -16015,8 +16015,6 @@ my $public=($username eq 'public' && $domain eq 'public'); -# See if old ID present, if so, remove - my ($filename,$cookie,$userroles,$firstaccenv,$timerintenv); my $now=time; @@ -16038,7 +16036,8 @@ } if (!$cookie) { $cookie="publicuser_$oldest"; } } else { - # if this isn't a robot, kill any existing non-robot sessions + # See if old ID present, if so, remove if this isn't a robot, + # killing any existing non-robot sessions if (!$args->{'robot'}) { opendir(DIR,$lonids); while ($filename=readdir(DIR)) { @@ -16078,8 +16077,7 @@ my %userenv = &Apache::lonnet::dump('environment',$domain,$username); my ($tmp) = keys(%userenv); - if ($tmp !~ /^(con_lost|error|no_such_host)/i) { - } else { + if ($tmp =~ /^(con_lost|error|no_such_host)/i) { undef(%userenv); } if (($userenv{'interface'}) && (!$form->{'interface'})) { From raeburn at source.lon-capa.org Sat Feb 25 14:39:10 2017 From: raeburn at source.lon-capa.org (raeburn) Date: Sat, 25 Feb 2017 19:39:10 -0000 Subject: [LON-CAPA-cvs] cvs: rat / lonwrapper.pm Message-ID: raeburn Sat Feb 25 19:39:10 2017 EDT Modified files: /rat lonwrapper.pm Log: - Remove trailing white space. Index: rat/lonwrapper.pm diff -u rat/lonwrapper.pm:1.56 rat/lonwrapper.pm:1.57 --- rat/lonwrapper.pm:1.56 Tue Feb 7 02:07:28 2017 +++ rat/lonwrapper.pm Sat Feb 25 19:39:10 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # Wrapper for external and binary files as standalone resources # -# $Id: lonwrapper.pm,v 1.56 2017/02/07 02:07:28 raeburn Exp $ +# $Id: lonwrapper.pm,v 1.57 2017/02/25 19:39:10 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -74,7 +74,7 @@ $args->{'bread_crumbs'} = $brcrum; } if ($absolute) { - $args->{'use_absolute'} = $absolute; + $args->{'use_absolute'} = $absolute; } if ($env{'form.only_body'}) { $args->{'only_body'} = $env{'form.only_body'}; From raeburn at source.lon-capa.org Sat Feb 25 15:00:47 2017 From: raeburn at source.lon-capa.org (raeburn) Date: Sat, 25 Feb 2017 20:00:47 -0000 Subject: [LON-CAPA-cvs] cvs: loncom /auth lonauth.pm lonlogout.pm switchserver.pm /interface lonsupportreq.pm /lonnet/perl lonnet.pm Message-ID: raeburn Sat Feb 25 20:00:47 2017 EDT Modified files: /loncom/auth lonauth.pm lonlogout.pm switchserver.pm /loncom/lonnet/perl lonnet.pm /loncom/interface lonsupportreq.pm Log: - Use 'secure' attribute for session cookie on servers using Apache/SSL. -------------- next part -------------- Index: loncom/auth/lonauth.pm diff -u loncom/auth/lonauth.pm:1.142 loncom/auth/lonauth.pm:1.143 --- loncom/auth/lonauth.pm:1.142 Fri Feb 17 14:34:21 2017 +++ loncom/auth/lonauth.pm Sat Feb 25 20:00:36 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.142 2017/02/17 14:34:21 raeburn Exp $ +# $Id: lonauth.pm,v 1.143 2017/02/25 20:00:36 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -42,6 +42,7 @@ use Apache::lonlocal; use Apache::File(); use HTML::Entities; +use Digest::MD5; # ------------------------------------------------------------ Successful login sub success { @@ -72,8 +73,26 @@ } } -# ------------------------------------------------------------ Get cookie ready - $cookie="lonID=$cookie; path=/; HttpOnly"; +# ----------------------------------------------------------- Get cookies ready + my ($securecookie,$defaultcookie); + if ($ENV{'SERVER_PORT'} == 443) { + $securecookie="lonID=$cookie; path=/; HttpOnly; secure"; + my $lonidsdir=$r->dir_config('lonIDsDir'); + if (($lonidsdir) && (-e "$lonidsdir/$cookie.id")) { + my $linkname=substr(Digest::MD5::md5_hex(Digest::MD5::md5_hex(time(). {}. rand(). $$)), 0, 32).'_linked'; + if (-e "$lonidsdir/$linkname.id") { + unlink("$lonidsdir/$linkname.id"); + } + my $made_symlink = eval { symlink("$lonidsdir/$cookie.id", + "$lonidsdir/$linkname.id"); 1 }; + if ($made_symlink) { + $defaultcookie = "lonLinkID=$linkname; path=/; HttpOnly;"; + &Apache::lonnet::appenv({'user.linkedenv' => "$lonidsdir/$linkname.id"}); + } + } + } else { + $defaultcookie = "lonID=$cookie; path=/; HttpOnly;"; + } # -------------------------------------------------------- Menu script and info my $destination = $lowerurl; @@ -152,7 +171,12 @@ # ------------------------------------------------- Output for successful login &Apache::loncommon::content_type($r,'text/html'); - $r->header_out('Set-cookie' => $cookie); + if ($securecookie) { + $r->headers_out->add('Set-cookie' => $securecookie); + } + if ($defaultcookie) { + $r->headers_out->add('Set-cookie' => $defaultcookie); + } $r->send_http_header; my %lt=&Apache::lonlocal::texthash( Index: loncom/auth/lonlogout.pm diff -u loncom/auth/lonlogout.pm:1.49 loncom/auth/lonlogout.pm:1.50 --- loncom/auth/lonlogout.pm:1.49 Thu Mar 12 00:50:10 2015 +++ loncom/auth/lonlogout.pm Sat Feb 25 20:00:36 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network # Logout Handler # -# $Id: lonlogout.pm,v 1.49 2015/03/12 00:50:10 raeburn Exp $ +# $Id: lonlogout.pm,v 1.50 2017/02/25 20:00:36 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -70,6 +70,13 @@ my $lonidsdir=$r->dir_config('lonIDsDir'); &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); unlink("$lonidsdir/$handle.id"); + if ($env{'user.linkedenv'} ne '') { + my $lonhost = $r->dir_config('lonHostID'); + if ((-l $env{'user.linkedenv'}) && + (readlink($env{'user.linkedenv'}) eq "$lonidsdir/$handle.id")) { + unlink($env{'user.linkedenv'}); + } + } if (!$Apache::lonlocal::lh) { &Apache::lonlocal::get_language_handle($r); } @@ -83,11 +90,20 @@ &Apache::loncommon::content_type($r,'text/html'); #expire the cookie - my $c = new CGI::Cookie(-name => 'lonID', + my $name = 'lonID'; + if (($env{'user.name'} eq 'public') && ($env{'user.domain'} eq 'public')) { + $name = 'lonPubID'; + } + my $c = new CGI::Cookie(-name => $name, -value => '', -expires => '-10y',); - $r->header_out('Set-cookie' => $c); - + $r->headers_out->add('Set-cookie' => $c); + if (($name eq 'lonID') && ($env{'user.linkeenv'})) { + my $other = new CGI::Cookie(-name => 'lonLinkID', + -value => '', + -expires => '-10y',); + $r->headers_out->add('Set-cookie' => $other); + } $r->send_http_header; return OK if $r->header_only; # -------------------------------------------------------- Menu script and info Index: loncom/auth/switchserver.pm diff -u loncom/auth/switchserver.pm:1.35 loncom/auth/switchserver.pm:1.36 --- loncom/auth/switchserver.pm:1.35 Fri Dec 16 15:31:11 2016 +++ loncom/auth/switchserver.pm Sat Feb 25 20:00:36 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network # Switch Servers Handler # -# $Id: switchserver.pm,v 1.35 2016/12/16 15:31:11 raeburn Exp $ +# $Id: switchserver.pm,v 1.36 2017/02/25 20:00:36 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -106,6 +106,12 @@ if ($env{'user.name'} eq 'public' && $env{'user.domain'} eq 'public') { my $url = $protocol.'://'.$switch_to.$r->uri; + unlink($handle); + #expire the cookie + my $c = new CGI::Cookie(-name => 'lonPubID', + -value => '', + -expires => '-10y',); + $r->header_out('Set-cookie' => $c); return &do_redirect($r,$url,1) } @@ -157,6 +163,13 @@ #remove session env, and log event unlink($handle); + if ($env{'user.linkedenv'} ne '') { + my $lonidsdir=$r->dir_config('lonIDsDir'); + if ((-l $env{'user.linkedenv'}) && + (readlink($env{'user.linkedenv'}) eq "$lonidsdir/$handle.id")) { + unlink($env{'user.linkedenv'}); + } + } my %temp=('switchserver' => time.':'.$env{'form.otherserver'}, $env{'form.role'}); &Apache::lonnet::put('email_status',\%temp); @@ -176,7 +189,13 @@ my $c = new CGI::Cookie(-name => 'lonID', -value => '', -expires => '-10y',); - $r->header_out('Set-cookie' => $c); + $r->headers_out->add('Set-cookie' => $c); + if ($env{'user.linkedenv'}) { + my $linked = new CGI::Cookie(-name => 'lonLinkID', + -value => '', + -expires => '-10y',); + $r->headers_out->add('Set-cookie' => $linked); + } if ($r->header_only) { $r->send_http_header; Index: loncom/lonnet/perl/lonnet.pm diff -u loncom/lonnet/perl/lonnet.pm:1.1336 loncom/lonnet/perl/lonnet.pm:1.1337 --- loncom/lonnet/perl/lonnet.pm:1.1336 Sat Jan 28 23:26:51 2017 +++ loncom/lonnet/perl/lonnet.pm Sat Feb 25 20:00:41 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network # TCP networking package # -# $Id: lonnet.pm,v 1.1336 2017/01/28 23:26:51 raeburn Exp $ +# $Id: lonnet.pm,v 1.1337 2017/02/25 20:00:41 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -650,10 +650,23 @@ sub check_for_valid_session { my ($r,$name,$userhashref) = @_; my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); + my ($linkname,$pubname); if ($name eq '') { $name = 'lonID'; + $linkname = 'lonLinkID'; + $pubname = 'lonPubID'; } my $lonid=$cookies{$name}; + if (!$lonid) { + if (($name eq 'lonID') && ($ENV{'SERVER_PORT'} != 443) && ($linkname)) { + $lonid=$cookies{$linkname}; + } + if (!$lonid) { + if (($name eq 'lonID') && ($pubname)) { + $lonid=$cookies{$pubname}; + } + } + } return undef if (!$lonid); my $handle=&LONCAPA::clean_handle($lonid->value); Index: loncom/interface/lonsupportreq.pm diff -u loncom/interface/lonsupportreq.pm:1.90 loncom/interface/lonsupportreq.pm:1.91 --- loncom/interface/lonsupportreq.pm:1.90 Mon Jan 23 19:51:52 2017 +++ loncom/interface/lonsupportreq.pm Sat Feb 25 20:00:47 2017 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # Helpdesk request form # -# $Id: lonsupportreq.pm,v 1.90 2017/01/23 19:51:52 raeburn Exp $ +# $Id: lonsupportreq.pm,v 1.91 2017/02/25 20:00:47 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -657,7 +657,12 @@ my @ENVvars = ('HTTP_HOST','HTTP_USER_AGENT','REMOTE_ADDR','SERVER_ADDR','SERVER_NAME'); my @envvars = ('browser.os','browser.type','browser.version','user.home','request.role'); my @loncvars = ('user.name','user.domain','request.course.sec','request.course.id'); - my @cookievars = ('lonID'); + my @cookievars; + if ($ENV{'SERVER_PORT'} == 443) { + @cookievars = ('lonLinkID'); + } else { + @cookievars = ('lonID'); + } my $admin = $Apache::lonnet::perlvar{'lonAdminMail'}; my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'}; @@ -991,7 +996,9 @@ if ($$cookie{'lonID'} =~ /lonID=($LONCAPA::handle_re);/) { $cookies{'lonID'} = $1; } - + if ($$cookie{'lonLinkID'} =~ /lonLinkID=([a-f0-9]+_linked);/) { + $cookies{'lonLinkID'} = $1; + } if ($attachmentpath =~ m-/([^/]+)$-) { $fname = $1; $displaymsg .= '
' From raeburn at source.lon-capa.org Sat Feb 25 14:40:29 2017 From: raeburn at source.lon-capa.org (raeburn) Date: Sat, 25 Feb 2017 19:40:29 -0000 Subject: [LON-CAPA-cvs] cvs: rat / lonpageflip.pm Message-ID: raeburn Sat Feb 25 19:40:29 2017 EDT Modified files: /rat lonpageflip.pm Log: - Use $r->hostname() instead of $ENV{'SERVER_NAME'} Index: rat/lonpageflip.pm diff -u rat/lonpageflip.pm:1.93 rat/lonpageflip.pm:1.94 --- rat/lonpageflip.pm:1.93 Mon Feb 20 18:29:33 2017 +++ rat/lonpageflip.pm Sat Feb 25 19:40:29 2017 @@ -2,7 +2,7 @@ # # Page flip handler # -# $Id: lonpageflip.pm,v 1.93 2017/02/20 18:29:33 raeburn Exp $ +# $Id: lonpageflip.pm,v 1.94 2017/02/25 19:40:29 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -314,6 +314,7 @@ my %multichoicehash=(); my ($redirecturl,$redirectsymb,$enc,$anchor); my $next=''; + my $hostname = $r->hostname(); my @possibilities=(); &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},['postdata']); if (($env{'form.postdata'})&&($env{'request.course.fn'})) { @@ -334,8 +335,8 @@ } elsif ($direction eq 'firstanswerable') { my $furl = &first_answerable_ressymb(); my $usehttp = &check_for_syllabus(\$furl); - if ($usehttp) { - $furl='http://'.$ENV{'SERVER_NAME'}.$furl; + if (($usehttp) && ($hostname ne '')) { + $furl='http://'.$hostname.$furl; } else { $furl=&Apache::lonnet::absolute_url().$furl; } @@ -387,8 +388,8 @@ if ($direction eq 'firstres') { my $furl=&first_accessible_resource(); my $usehttp = &check_for_syllabus(\$furl); - if ($usehttp) { - $furl='http://'.$ENV{'SERVER_NAME'}.$furl; + if (($usehttp) && ($hostname ne '')) { + $furl='http://'.$hostname.$furl; } else { $furl=&Apache::lonnet::absolute_url().$furl; } @@ -418,8 +419,8 @@ } else { $newloc='/adm/navmaps'; } - if ($usehttp) { - $newloc='http://'.$ENV{'SERVER_NAME'}.$newloc; + if (($usehttp) && ($hostname ne '')) { + $newloc='http://'.$hostname.$newloc; } else { $newloc=&Apache::lonnet::absolute_url().$newloc } @@ -529,8 +530,8 @@ my ($redirect, $url) = &Apache::loncommon::critical_redirect(300); unless ($redirect) { my $usehttp = &check_for_syllabus(\$redirecturl); - if ($usehttp) { - $url='http://'.$ENV{'SERVER_NAME'}.$redirecturl; + if (($usehttp) && ($hostname ne '')) { + $url='http://'.$hostname.$redirecturl; } else { $url=&Apache::lonnet::absolute_url().$redirecturl; } @@ -584,8 +585,8 @@ foreach my $id (@possibilities) { my $src = $multichoicehash{'src_'.$id}; my $usehttp = &check_for_syllabus(\$src); - if ($usehttp) { - $src = 'http://'.$ENV{'SERVER_NAME'}.$src; + if (($usehttp) && ($hostname ne '')) { + $src = 'http://'.$hostname.$src; } $r->print( '