Skip to content

Suggestions for admin course entry code improvements. #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Alex-Jordan merged 2 commits into from
Aug 16, 2026
Merged

Suggestions for admin course entry code improvements. #38

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c92c97
easy entry to a course from admin course
Alex-Jordan Jul 31, 2026
5459a04
Suggestions for admin course entry code improvements.
drgrice1 Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 20 additions & 26 deletions lib/WeBWorK/Authen.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ use Math::Random::Secure qw(irand);

use WeBWorK::CourseEnvironment;
use WeBWorK::DB;
use WeBWorK::Debug;
use WeBWorK::Debug qw(debug);
use WeBWorK::Utils qw(x runtime_use utf8Crypt cryptPassword);
use WeBWorK::Utils::Logs qw(writeCourseLog);
use WeBWorK::Utils::TOTP;
Expand Down Expand Up @@ -417,39 +417,36 @@ sub try_admin_cross_course_credentials {
return 0 if $@ || !$db_admin || ($ce_admin->{session_management_via} // '') ne 'session_cookie';

# Decode the admin course's session cookie
my $sessions = $c->app->sessions;
my $adminCookieName = 'WeBWorKCourseSession.' . $ce->{admin_course_id};
my $cookieMethod = $sessions->encrypted ? 'encrypted_cookie' : 'signed_cookie';
my $rawValue = $c->$cookieMethod($adminCookieName);
my $sessions = $c->app->sessions;
my $rawValue = $c->signed_cookie('WeBWorKCourseSession.' . $ce->{admin_course_id});
return 0 unless $rawValue;
$rawValue =~ y/-/=/;
my $adminSession = eval { $sessions->deserialize->(b64_decode($rawValue)) };
return 0 unless $adminSession;
return 0 unless my $adminSession = $sessions->deserialize->(b64_decode($rawValue));

my $expiration = $adminSession->{expiration} // $sessions->default_expiration;
my $expires = delete $adminSession->{expires};
return 0 if !$expires && $expiration || defined $expires && $expires <= time;
return 0
if !$adminSession->{expires} && ($adminSession->{expiration} // $sessions->default_expiration)
|| defined $adminSession->{expires} && $adminSession->{expires} <= time;

my ($adminUserID, $adminKey, $adminTimestamp) = @{$adminSession}{qw(user_id key timestamp)};
return 0 unless $adminUserID && $adminKey;

# Confirm the admin session is still valid
my $AdminKey = $db_admin->getKey($adminUserID);
my $adminKeyRecord = $db_admin->getKey($adminUserID);
return 0
unless defined $AdminKey
&& $AdminKey->key eq $adminKey
&& time <= ($adminTimestamp // $AdminKey->timestamp) + $ce_admin->{sessionTimeout};
unless defined $adminKeyRecord
&& $adminKeyRecord->key eq $adminKey
&& time <= ($adminTimestamp // $adminKeyRecord->timestamp) + $ce_admin->{sessionTimeout};

return 0 unless _admin_course_has_create_delete_permission($ce_admin, $db_admin, $adminUserID);

my $AdminPassword = $db_admin->getPassword($adminUserID);
return 0 unless defined $AdminPassword && $AdminPassword->password =~ /\S/;
my $adminPasswordRecord = $db_admin->getPassword($adminUserID);
return 0 unless defined $adminPasswordRecord && $adminPasswordRecord->password =~ /\S/;

$self->{user_id} = $adminUserID;
$self->{admin_cross_course_password} = $AdminPassword->password;
$self->{admin_cross_course_password} = $adminPasswordRecord->password;
$self->{login_type} = 'normal';
$self->{credential_source} = 'admin_cross_course';
debug('credential source: "admin_cross_course", user: "', $self->{user_id}, '"');
debug(qq{credential source: "admin_cross_course", user: "$self->{user_id}"});
return 1;
}

Expand All @@ -463,10 +460,10 @@ sub _admin_course_has_create_delete_permission {
return 0 unless defined $activity_role && exists $ce_admin->{userRoles}{$activity_role};
my $role_permlevel = $ce_admin->{userRoles}{$activity_role};

my $PermissionLevel = $db_admin->getPermissionLevel($user);
return 0 unless defined $PermissionLevel && defined $PermissionLevel->permission;
my $permissionLevel = $db_admin->getPermissionLevel($user);
return 0 unless defined $permissionLevel && defined $permissionLevel->permission;

return $PermissionLevel->permission >= $role_permlevel;
return $permissionLevel->permission >= $role_permlevel;
}

sub check_user {
Expand Down Expand Up @@ -694,21 +691,18 @@ sub verify_admin_cross_course_user {
my $self = shift;
my $c = $self->{c};

my $user_id = $self->{user_id};

my $coursePassword = $c->db->getPassword($user_id);
my $coursePassword = $c->db->getPassword($self->{user_id});
unless (defined $coursePassword
&& $coursePassword->password =~ /\S/
&& $coursePassword->password eq $self->{admin_cross_course_password})
{
$self->{log_error} = 'admin cross-course login: no matching password for this user in this course';
$self->{error} = $c->maketext(GENERIC_ERROR_MESSAGE);
return 0;
}

return 0 unless $self->validate_user;

$self->{session_key} = $self->create_session($user_id);
$self->{session_key} = $self->create_session($self->{user_id});
$self->{initial_login} = 1;
return 1;
}
Expand Down