--- loncom/publisher/loncfile.pm	2010/12/14 16:26:04	1.105
+++ loncom/publisher/loncfile.pm	2011/10/30 19:27:27	1.112
@@ -9,7 +9,7 @@
 #  and displays a page showing the results of the action.
 #
 #
-# $Id: loncfile.pm,v 1.105 2010/12/14 16:26:04 www Exp $
+# $Id: loncfile.pm,v 1.112 2011/10/30 19:27:27 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -161,21 +161,23 @@ sub URLToPath {
     $Url=~ s/\/+/\//g;
     $Url=~ s/^https?\:\/\/[^\/]+//;
     $Url=~ s/^\///;
-    $Url=~ s/(\~|priv\/)($match_username)\//\/home\/$2\/public_html\//;
+    $Url='/home/httpd/html/'.$Url;
     &Debug($r, "Returning $Url \n");
     return $Url;
 }
 
 sub url {
     my $fn=shift;
-    $fn=~s/^\/home\/($match_username)\/public\_html/\/priv\/$1/;
+    $fn=~s/^\/home\/httpd\/html//;
+    $fn=~s/\/\.\//\//g;
     $fn=&HTML::Entities::encode($fn,'<>"&');
     return $fn;
 }
 
 sub display {
     my $fn=shift;
-    $fn=~s-^/home/($match_username)/public_html-/priv/$1-;
+    $fn=~s/^\/home\/httpd\/html//;
+    $fn=~s/\/\.\//\//g;
     return '<span class="LC_filename">'.$fn.'</span>';
 }
 
@@ -186,9 +188,9 @@ sub display {
 
 sub obsolete_unpub {
     my ($user,$domain,$construct)=@_;
+    my $londocroot = $Apache::lonnet::perlvar{'lonDocRoot'};
     my $published=$construct;
-    $published=~
-	s/^\/home\/$user\/public\_html\//\/home\/httpd\/html\/res\/$domain\/$user\//;
+    $published=~s{^\Q$londocroot/priv/\E}{$londocroot/res/};
     if (-e $published) {
 	if (&Apache::lonnet::metadata($published,'obsolete')) {
 	    return 1;
@@ -269,9 +271,9 @@ sub exists {
     my ($user, $domain, $construct, $creating) = @_;
     $creating ||= 'file';
 
+    my $londocroot = $Apache::lonnet::perlvar{'lonDocRoot'};
     my $published=$construct;
-    $published=~
-	s{^/home/$user/public_html/}{/home/httpd/html/res/$domain/$user/};
+    $published=~s{^\Q$londocroot/priv/\E}{$londocroot/res/};
     my ($type,$result);
     if ( -d $construct ) {
 	return ('error','<p><span class="LC_error">'.&mt('Error: destination for operation is an existing directory.').'</span></p>');
@@ -345,9 +347,10 @@ sub checksuffix {
 }
 
 sub cleanDest {
-    my ($request,$dest,$subdir,$fn,$uname)=@_;
+    my ($request,$dest,$subdir,$fn,$uname,$udom)=@_;
     #remove bad characters
     my $foundbad=0;
+    my $error='';
     if ($subdir && $dest =~/\./) {
 	$foundbad=1;
 	$dest=~s/\.//g;
@@ -359,7 +362,7 @@ sub cleanDest {
     }
     if ($dest=~m|/|) {
 	my ($newpath)=($dest=~m|(.*)/|);
-	$newpath=&relativeDest($fn,$newpath,$uname);
+	($newpath,$error)=&relativeDest($fn,$newpath,$uname,$udom);
 	if (! -d "$newpath") {
 	    $request->print('<p><span class="LC_warning">'
                            .&mt("You have requested to create file in directory [_1] which doesn't exist. The requested directory path has been removed from the requested file name."
@@ -384,14 +387,15 @@ sub cleanDest {
                         .'</span></p>'
         );
     }
-    return $dest;
+    return ($dest,$error);
 }
 
 sub relativeDest {
-    my ($fn,$newfilename,$uname)=@_;
+    my ($fn,$newfilename,$uname,$udom)=@_;
+    my $error = '';
     if ($newfilename=~/^\//) {
 # absolute, simply add path
-	$newfilename='/home/'.$uname.'/public_html/';
+	$newfilename='/home/httpd/html/res/'.$udom.'/'.$uname.'/';
     } else {
 	my $dir=$fn;
 	$dir=~s/\/[^\/]+$//;
@@ -401,7 +405,12 @@ sub relativeDest {
     while ($newfilename=~m:/\.\./:) {
 	$newfilename=~ s:/[^/]+/\.\./:/:g; #remove dir/..
     }
-    return $newfilename;
+    my ($authorname,$authordom)=&Apache::loncacc::constructaccess($newfilename);
+    unless (($authorname) && ($authordom)) {
+       my $otherdir = &display($newfilename);
+       $error = &mt('Access denied to [_1]',$otherdir);
+    }
+    return ($newfilename,$error);
 }
 
 =pod
@@ -936,8 +945,23 @@ sub phaseone {
   
     my $doingdir=0;
     if ($env{'form.action'} eq 'newdir') { $doingdir=1; }
-    my $newfilename=&cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname);
-    $newfilename=&relativeDest($fn,$newfilename,$uname);
+    my ($newfilename,$error) = 
+        &cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname,$udom);
+    unless ($error) {
+        ($newfilename,$error)=&relativeDest($fn,$newfilename,$uname,$udom);
+    }
+    if ($error) {
+        my $dirlist;
+        if ($fn=~m{^(.*/)[^/]+$}) {
+            $dirlist=$1;
+        } else {
+            $dirlist=$fn; 
+        }
+        $r->print('<div class="LC_error">'.$error.'</div>'.
+                  '<h3><a href="'.&url($dirlist).'">'.&mt('Return to Directory').
+                  '</a></h3>');
+        return;
+    }
     $r->print('<form action="/adm/cfile" method="post">'.
 	      '<input type="hidden" name="qualifiedfilename" value="'.$fn.'" />'.
 	      '<input type="hidden" name="phase" value="two" />'.
@@ -1416,8 +1440,7 @@ sub handler {
     my $uname;
     my $udom;
 
-    ($uname,$udom)=
-	&Apache::loncacc::constructaccess($fn,$r->dir_config('lonDefDomain'));
+    ($uname,$udom)=&Apache::loncacc::constructaccess($fn);
     &Debug($r, 
 	   "loncfile::handler constructaccess uname = $uname domain = $udom");
     unless (($uname) && ($udom)) {