4370 lines
134 KiB
PHP
4370 lines
134 KiB
PHP
<?php
|
|
// $Header: /cvsroot/phpldapadmin/phpldapadmin/lib/functions.php,v 1.275.2.16 2005/11/01 10:06:53 wurley Exp $
|
|
|
|
/**
|
|
* A collection of functions used throughout phpLDAPadmin.
|
|
* @author The phpLDAPadmin development team
|
|
* @package phpLDAPadmin
|
|
*/
|
|
|
|
define('HTDOCDIR',sprintf('%s/',realpath(LIBDIR.'../htdocs/')));
|
|
define('LANGDIR',sprintf('%s/',realpath(LIBDIR.'../lang/')));
|
|
define('CONFDIR',sprintf('%s/',realpath(LIBDIR.'../config')));
|
|
define('TMPLDIR',sprintf('%s/',realpath(LIBDIR.'../templates/')));
|
|
define('DOCDIR',sprintf('%s/',realpath(LIBDIR.'../doc/')));
|
|
define('CSSDIR','css/');
|
|
define('JSDIR','js/');
|
|
|
|
/* Supplimental functions
|
|
* This list is a list of supplimental functions that are used throughout PLA. The
|
|
* order here IS important - so that files that refer to functions defined in other files
|
|
* need to be listed after those files.*/
|
|
$pla_function_files = array(
|
|
# Functions for talking to LDAP servers.
|
|
LIBDIR.'server_functions.php',
|
|
# Functions for sending syslog messages
|
|
LIBDIR.'syslog.php',
|
|
# The base English language strings
|
|
LANGDIR.'recoded/en.php',
|
|
# Functions for managing the session (pla_session_start(), etc.)
|
|
LIBDIR.'session_functions.php',
|
|
# Functions for reading the server schema
|
|
LIBDIR.'schema_functions.php',
|
|
# Functions that can be defined by the user (preEntryDelete(), postEntryDelete(), etc.)
|
|
LIBDIR.'custom_functions.php',
|
|
# Functions for template manipulation.
|
|
LIBDIR.'template_functions.php',
|
|
# Functions for hashing passwords with OpenSSL binary (only if mhash not present)
|
|
LIBDIR.'emuhash_functions.php',
|
|
# Functions for running various hooks
|
|
LIBDIR.'hooks.php',
|
|
# Functions for creating Samba passwords
|
|
LIBDIR.'createlm.php',
|
|
# Functions for timeout and automatic logout feature
|
|
LIBDIR.'timeout_functions.php'
|
|
);
|
|
|
|
/**
|
|
* Determines if an attribute's value can contain multiple lines. Attributes that fall
|
|
* in this multi-line category may be configured in config.php. Hence, this function
|
|
* accesses the global variable $config->custom->appearance['multi_line_attributes'];
|
|
*
|
|
* Usage example:
|
|
* <code>
|
|
* if( is_muli_line_attr( "postalAddress" ) )
|
|
* echo "<textarea name=\"postalAddress\"></textarea>";
|
|
* else
|
|
* echo "<input name=\"postalAddress\" type=\"text\">";
|
|
* </code>
|
|
*
|
|
* @param string $attr_name The name of the attribute of interestd (case insensivite)
|
|
* @param string $val (optional) The current value of the attribute (speeds up the
|
|
* process by searching for carriage returns already in the attribute value)
|
|
* @param int $server_id (optional) The ID of the server of interest. If specified,
|
|
* is_multi_line_attr() will read the schema from the server to determine if
|
|
* the attr is multi-line capable. (note that schema reads can be expensive,
|
|
* but that impact is lessened due to PLA's new caching mechanism)
|
|
* @return bool
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function is_multi_line_attr( $attr_name, $val=null, $server_id=null ) {
|
|
global $config, $ldapservers;
|
|
|
|
$multi_line_attributes = $config->GetValue('appearance','multi_line_attributes');
|
|
$multi_line_syntax_oids = $config->GetValue('appearance','multi_line_syntax_oids');
|
|
|
|
# Set default return
|
|
$return = false;
|
|
|
|
// First, check the optional val param for a \n or a \r
|
|
if (! is_null($val) && (false !== strpos($val,"\n") || false !== strpos($val,"\r")))
|
|
$return = true;
|
|
|
|
// Next, compare strictly by name first
|
|
else
|
|
foreach ($multi_line_attributes as $multi_line_attr_name)
|
|
if (strcasecmp($multi_line_attr_name,$attr_name) == 0) {
|
|
$return = true;
|
|
break;
|
|
}
|
|
|
|
// If unfound, compare by syntax OID
|
|
if (! $return && ! is_null($server_id)) {
|
|
$ldapserver = $ldapservers->Instance($server_id);
|
|
|
|
$schema_attr = $ldapserver->getSchemaAttribute($attr_name);
|
|
if ($schema_attr) {
|
|
$syntax_oid = $schema_attr->getSyntaxOID();
|
|
|
|
if ($syntax_oid)
|
|
foreach($multi_line_syntax_oids as $multi_line_syntax_oid)
|
|
if ($multi_line_syntax_oid == $syntax_oid) {
|
|
$return = true;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_multi_line_attr(): Entered with (%s,%s,%s), Returning (%s)',1,$attr_name,$val,$server_id,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Fetches the user setting for $view_deref from config.php. The returned value
|
|
* will be one of the four LDAP_DEREF_* constancts defined by the PHP LDAP API. If
|
|
* the user has failed to configure this setting or configured an inappropriate
|
|
* value, the constant DEFAULT_VIEW_DEREF_SETTING is returned.
|
|
*
|
|
* @return int
|
|
* @deprecated
|
|
*/
|
|
function get_view_deref_setting() {
|
|
global $config;
|
|
return $config->GetValue('deref','view');
|
|
}
|
|
|
|
/**
|
|
* Fetches whether the user has configured phpLDAPadmin to obfuscate passwords
|
|
* with "*********" when displaying them.
|
|
*
|
|
* This is configured in config.php thus:
|
|
* <code>
|
|
* $obfuscate_password_display = true;
|
|
* </code>
|
|
*
|
|
* @param string $enc Password encoding type
|
|
* @return bool
|
|
*/
|
|
function obfuscate_password_display($enc=null) {
|
|
global $config;
|
|
|
|
if ($config->GetValue('appearance','obfuscate_password_display'))
|
|
$return = true;
|
|
|
|
elseif (! $config->GetValue('appearance','show_clear_password') && (is_null($enc) || $enc == 'clear'))
|
|
$return = true;
|
|
|
|
else
|
|
$return = false;
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('obfuscate_password_display(): Entered with (%s), Returning (%s)',1,$enc,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Returns an HTML-beautified version of a DN.
|
|
* Internally, this function makes use of pla_explode_dn() to break the
|
|
* the DN into its components. It then glues them back together with
|
|
* "pretty" HTML. The returned HTML is NOT to be used as a real DN, but
|
|
* simply displayed.
|
|
*
|
|
* @param string $dn The DN to pretty-print.
|
|
* @return string
|
|
*/
|
|
function pretty_print_dn( $dn ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pretty_print_dn(): Entered with (%s)',2,$dn);
|
|
|
|
$dn = pla_explode_dn( $dn );
|
|
foreach( $dn as $i => $element ) {
|
|
$element = htmlspecialchars($element);
|
|
$element = explode('=',$element,2);
|
|
$element = implode('<span style="color: blue; font-family: courier; font-weight: bold">=</span>',$element);
|
|
$dn[$i] = $element;
|
|
}
|
|
$dn = implode('<span style="color:red; font-family:courier; font-weight: bold;">,</span>',$dn);
|
|
|
|
return $dn;
|
|
}
|
|
|
|
/**
|
|
* Returns true if the attribute specified is required to take as input a DN.
|
|
* Some examples include 'distinguishedName', 'member' and 'uniqueMember'.
|
|
* @param int $server_id The ID of the server of interest
|
|
* (required since this operation demands a schema lookup)
|
|
* @param string $attr_name The name of the attribute of interest (case insensitive)
|
|
* @return bool
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function is_dn_attr( $ldapserver, $attr_name ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_dn_attr(): Entered with (%s,%s)',2,$ldapserver->server_id,$attr_name);
|
|
|
|
// Simple test first
|
|
$dn_attrs = array( "aliasedObjectName" );
|
|
foreach( $dn_attrs as $dn_attr )
|
|
if( 0 == strcasecmp( $attr_name, $dn_attr ) )
|
|
return true;
|
|
|
|
// Now look at the schema OID
|
|
$attr_schema = $ldapserver->getSchemaAttribute($attr_name);
|
|
if( ! $attr_schema )
|
|
return false;
|
|
|
|
$syntax_oid = $attr_schema->getSyntaxOID();
|
|
if( '1.3.6.1.4.1.1466.115.121.1.12' == $syntax_oid )
|
|
return true;
|
|
if( '1.3.6.1.4.1.1466.115.121.1.34' == $syntax_oid )
|
|
return true;
|
|
|
|
$syntaxes = $ldapserver->SchemaSyntaxes();
|
|
if (! isset($syntaxes[$syntax_oid]))
|
|
return false;
|
|
|
|
$syntax_desc = $syntaxes[ $syntax_oid ]->getDescription();
|
|
if( false !== strpos( strtolower($syntax_desc), 'distinguished name' ) )
|
|
return true;
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Given a string, this function returns true if the string has the format
|
|
* of a DN (ie, looks like "cn=Foo,dc=example,dc=com"). Returns false otherwise.
|
|
* The purpose of this function is so that developers can examine a string and
|
|
* know if it looks like a DN, and draw a hyperlink as needed.
|
|
*
|
|
* (See unit_test.php for test cases)
|
|
*
|
|
* @param string $attr The attribute to examine for "DNness"
|
|
* @see unit_test.php
|
|
* @return bool
|
|
*/
|
|
function is_dn_string($str) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_dn_string(): Entered with (%s)',2,$str);
|
|
|
|
/* Try to break the string into its component parts if it can be done
|
|
ie, "uid=Manager" "dc=example" and "dc=com" */
|
|
$parts = pla_explode_dn($str);
|
|
if (! is_array($parts) || ! count($parts))
|
|
return false;
|
|
|
|
/* Foreach of the "parts", look for an "=" character,
|
|
and make sure neither the left nor the right is empty */
|
|
foreach ($parts as $part) {
|
|
if (! strpos($part,"="))
|
|
return false;
|
|
|
|
$sub_parts = explode("=",$part,2);
|
|
$left = $sub_parts[0];
|
|
$right = $sub_parts[1];
|
|
|
|
if ( ! strlen(trim($left)) || ! strlen(trim($right)))
|
|
return false;
|
|
|
|
if (strpos($left,'#') !== false)
|
|
return false;
|
|
}
|
|
|
|
# We survived the above rigor. This is a bonified DN string.
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Get whether a string looks like an email address (user@example.com).
|
|
*
|
|
* @param string $str The string to analyze.
|
|
* @return bool Returns true if the specified string looks like
|
|
* an email address or false otherwise.
|
|
*/
|
|
function is_mail_string($str) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_mail_string(): Entered with (%s)',2,$str);
|
|
|
|
$mail_regex = "/^[_A-Za-z0-9-]+(\\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*$/";
|
|
|
|
if (preg_match($mail_regex,$str))
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Get whether a string looks like a web URL (http://www.example.com/)
|
|
*
|
|
* @param string $str The string to analyze.
|
|
* @return bool Returns true if the specified string looks like
|
|
* a web URL or false otherwise.
|
|
*/
|
|
function is_url_string($str) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_url_string(): Entered with (%s)',2,$str);
|
|
|
|
$url_regex = '/(ftp|https?):\/\/+[\w\.\-\/\?\=\&]*\w+/';
|
|
|
|
if (preg_match($url_regex,$str))
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Utility wrapper for setting cookies, which takes into consideration
|
|
* phpLDAPadmin configuration values. On success, true is returned. On
|
|
* failure, false is returned.
|
|
*
|
|
* @param string $name The name of the cookie to set.
|
|
* @param string $val The value of the cookie to set.
|
|
* @param int $expire (optional) The duration in seconds of this cookie. If unspecified, $cookie_time
|
|
* is used from config.php
|
|
* @param string $dir (optional) The directory value of this cookie (see php.net/setcookie)
|
|
*
|
|
* @see setcookie
|
|
* @return bool
|
|
*/
|
|
function pla_set_cookie( $name, $val, $expire=null, $dir=null ) {
|
|
global $config;
|
|
|
|
# Set default return
|
|
$return = false;
|
|
|
|
if ($expire == null) {
|
|
$cookie_time = $config->GetValue('session','cookie_time');
|
|
$expire = $cookie_time == 0 ? null : time() + $cookie_time;
|
|
}
|
|
|
|
if ($dir == null)
|
|
$dir = dirname( $_SERVER['PHP_SELF'] );
|
|
|
|
if (@setcookie($name,$val,$expire,$dir)) {
|
|
$_COOKIE[$name] = $val;
|
|
$return = true;
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_set_cookie(): Entered with (%s,%s,%s,%s), Returning (%s)',1,$name,$val,$expire,$dir,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Responsible for setting two cookies/session-vars to indicate that a user has logged in,
|
|
* one for the logged in DN and one for the logged in password.
|
|
*
|
|
* This function is only used if 'auth_type' is set to 'cookie' or 'session'. The values
|
|
* written have the name "pla_login_dn_X" and "pla_login_pass_X" where X is the
|
|
* ID of the server to which the user is attempting login.
|
|
*
|
|
* Note that as with all cookie/session operations this function must be called BEFORE
|
|
* any output is sent to the browser.
|
|
*
|
|
* On success, true is returned. On failure, false is returned.
|
|
*
|
|
* @param object $ldapserver The LDAPServer object of the server which the user hsa logged in.
|
|
* @param string $dn The DN with which the user has logged in.
|
|
* @param string $password The password of the user logged in.
|
|
* @param bool $anon_bind Indicates that this is an anonymous bind such that
|
|
* a password of "0" is stored.
|
|
* @return bool
|
|
* @see unset_login_dn
|
|
*/
|
|
function set_login_dn($ldapserver,$dn,$password,$anon_bind) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('set_login_dn(): Entered with (%s,%s,%s,%s)',2,$ldapserver->server_id,$dn,$password,$anon_bind);
|
|
|
|
if (! $ldapserver->auth_type)
|
|
return false;
|
|
|
|
switch ($ldapserver->auth_type) {
|
|
case 'cookie':
|
|
$cookie_dn_name = sprintf("pla_login_dn_%s",$ldapserver->server_id);
|
|
$cookie_pass_name = sprintf("pla_login_pass_%s",$ldapserver->server_id);
|
|
|
|
# we set the cookie password to 0 for anonymous binds.
|
|
if ($anon_bind) {
|
|
$dn = 'anonymous';
|
|
$password = '0';
|
|
}
|
|
|
|
$res1 = pla_set_cookie($cookie_dn_name,pla_blowfish_encrypt($dn));
|
|
$res2 = pla_set_cookie($cookie_pass_name,pla_blowfish_encrypt($password));
|
|
if ($res1 && $res2)
|
|
return true;
|
|
else
|
|
return false;
|
|
|
|
break;
|
|
|
|
case 'session':
|
|
$sess_var_dn_name = sprintf("pla_login_dn_%s",$ldapserver->server_id);
|
|
$sess_var_pass_name = sprintf("pla_login_pass_%s",$ldapserver->server_id);
|
|
|
|
# we set the cookie password to 0 for anonymous binds.
|
|
if ($anon_bind) {
|
|
$dn = 'anonymous';
|
|
$password = '0';
|
|
}
|
|
|
|
$_SESSION[$sess_var_dn_name] = pla_blowfish_encrypt($dn);
|
|
$_SESSION[$sess_var_pass_name] = pla_blowfish_encrypt($password);
|
|
return true;
|
|
|
|
break;
|
|
|
|
default:
|
|
global $lang;
|
|
pla_error(sprintf($lang['unknown_auth_type'],htmlspecialchars($ldapserver->auth_type)));
|
|
break;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Log a user out of the LDAP server.
|
|
*
|
|
* Removes the cookies/session-vars set by set_login_dn()
|
|
* after a user logs out using "auth_type" of "session" or "cookie".
|
|
* Returns true on success, false on failure.
|
|
*
|
|
* @param object $ldapserver The LDAPServer object of the server which the user hsa logged in.
|
|
* @return bool True on success, false on failure.
|
|
* @see set_login_dn
|
|
*/
|
|
function unset_login_dn( $ldapserver ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('unset_login_dn(): Entered with (%s)',2,$ldapserver->server_id);
|
|
|
|
if (! $ldapserver->auth_type)
|
|
return false;
|
|
|
|
switch ($ldapserver->auth_type) {
|
|
case 'cookie':
|
|
$logged_in_dn = get_logged_in_dn($ldapserver);
|
|
if (! $logged_in_dn)
|
|
return false;
|
|
|
|
$logged_in_pass = get_logged_in_pass($ldapserver);
|
|
$anon_bind = $logged_in_dn == 'anonymous' ? true : false;
|
|
|
|
# set cookie with expire time already passed to erase cookie from client
|
|
$expire = time()-3600;
|
|
$cookie_dn_name = sprintf("pla_login_dn_%s",$ldapserver->server_id);
|
|
$cookie_pass_name = sprintf("pla_login_pass_%s",$ldapserver->server_id);
|
|
|
|
if ($anon_bind) {
|
|
$res1 = pla_set_cookie($cookie_dn_name,'anonymous',$expire);
|
|
$res2 = pla_set_cookie($cookie_pass_name,'0',$expire);
|
|
|
|
} else {
|
|
$res1 = pla_set_cookie($cookie_dn_name,pla_blowfish_encrypt($logged_in_dn),$expire);
|
|
$res2 = pla_set_cookie($cookie_pass_name,pla_blowfish_encrypt($logged_in_pass),$expire);
|
|
}
|
|
|
|
# Need to unset the cookies too, since they are still set if further processing occurs (eg: Timeout)
|
|
unset($_COOKIE[$cookie_dn_name]);
|
|
unset($_COOKIE[$cookie_pass_name]);
|
|
|
|
if (! $res1 || ! $res2)
|
|
return false;
|
|
else
|
|
return true;
|
|
|
|
break;
|
|
|
|
case 'session':
|
|
# unset session variables
|
|
$session_var_dn_name = sprintf("pla_login_dn_%s",$ldapserver->server_id);
|
|
$session_var_pass_name = sprintf("pla_login_pass_%s",$ldapserver->server_id);
|
|
|
|
if (array_key_exists($session_var_dn_name,$_SESSION))
|
|
unset($_SESSION[$session_var_dn_name]);
|
|
|
|
if (array_key_exists($session_var_pass_name,$_SESSION))
|
|
unset($_SESSION[$session_var_pass_name]);
|
|
|
|
session_write_close();
|
|
return true;
|
|
|
|
break;
|
|
|
|
default:
|
|
global $lang;
|
|
pla_error(sprintf($lang['unknown_auth_type'],htmlspecialchars($auth_type)));
|
|
break;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get a customized file for a server
|
|
* We don't need any caching, because it's done by PHP
|
|
*
|
|
* @param int $server_id The ID of the server
|
|
* @param string $filename The requested filename
|
|
*
|
|
* @return string The customized filename, if exists, or the standard one
|
|
*/
|
|
function get_custom_file($server_id,$filename,$path) {
|
|
global $ldapservers;
|
|
|
|
# Set default return
|
|
$return = $path.$filename;
|
|
|
|
$custom = $ldapservers->GetValue($server_id,'custom','pages_prefix');
|
|
if (! is_null($custom) && is_file(realpath($path.$custom.$filename)))
|
|
$return = $path.$custom.$filename;
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_custom_file(): Entered with (%s,%s,%s), Returning (%s)',1,$server_id,$filename,$path,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Call a customized function
|
|
*
|
|
* @param int $server_id The ID of the server
|
|
* @param string $filename The requested function
|
|
*
|
|
* @return any The result of the called function
|
|
*/
|
|
function call_custom_function( $server_id, $function ) {
|
|
global $ldapservers;
|
|
|
|
# Set default return
|
|
$return = $function;
|
|
|
|
$custom = $ldapservers->GetValue($server_id,'custom','pages_prefix');
|
|
if (! is_null($custom) && function_exists($custom.$function))
|
|
$return = $custom.$filename;
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_custom_file(): Entered with (%s,%s), Returning (%s)',1,$server_id,$function,$return);
|
|
|
|
return call_user_func($return );
|
|
}
|
|
|
|
/**
|
|
* Compares 2 DNs. If they are equivelant, returns 0, otherwise,
|
|
* returns their sorting order (similar to strcmp()):
|
|
* Returns < 0 if dn1 is less than dn2.
|
|
* Returns > 0 if dn1 is greater than dn2.
|
|
*
|
|
* The comparison is performed starting with the top-most element
|
|
* of the DN. Thus, the following list:
|
|
* <code>
|
|
* ou=people,dc=example,dc=com
|
|
* cn=Admin,ou=People,dc=example,dc=com
|
|
* cn=Joe,ou=people,dc=example,dc=com
|
|
* dc=example,dc=com
|
|
* cn=Fred,ou=people,dc=example,dc=org
|
|
* cn=Dave,ou=people,dc=example,dc=org
|
|
* </code>
|
|
* Will be sorted thus using usort( $list, "pla_compare_dns" ):
|
|
* <code>
|
|
* dc=com
|
|
* dc=example,dc=com
|
|
* ou=people,dc=example,dc=com
|
|
* cn=Admin,ou=People,dc=example,dc=com
|
|
* cn=Joe,ou=people,dc=example,dc=com
|
|
* cn=Dave,ou=people,dc=example,dc=org
|
|
* cn=Fred,ou=people,dc=example,dc=org
|
|
* </code>
|
|
*
|
|
* @param string $dn1 The first of two DNs to compare
|
|
* @param string $dn2 The second of two DNs to compare
|
|
* @return int
|
|
*/
|
|
function pla_compare_dns($dn1,$dn2) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_compare_dns(): Entered with (%s,%s)',2,$dn1,$dn2);
|
|
|
|
# If they are obviously the same, return immediately
|
|
if (! strcasecmp($dn1,$dn2))
|
|
return 0;
|
|
|
|
$dn1_parts = pla_explode_dn(pla_reverse_dn($dn1));
|
|
$dn2_parts = pla_explode_dn(pla_reverse_dn($dn2));
|
|
assert(is_array($dn1_parts));
|
|
assert(is_array($dn2_parts));
|
|
|
|
# Foreach of the "parts" of the smaller DN
|
|
for ($i=0; $i < count($dn1_parts) && $i < count($dn2_parts); $i++) {
|
|
/* dnX_part is of the form: "cn=joe" or "cn = joe" or "dc=example"
|
|
ie, one part of a multi-part DN. */
|
|
$dn1_part = $dn1_parts[$i];
|
|
$dn2_part = $dn2_parts[$i];
|
|
|
|
/* Each "part" consists of two sub-parts:
|
|
1. the attribute (ie, "cn" or "o")
|
|
2. the value (ie, "joe" or "example") */
|
|
$dn1_sub_parts = explode('=',$dn1_part,2);
|
|
$dn2_sub_parts = explode('=',$dn2_part,2);
|
|
|
|
$dn1_sub_part_attr = trim($dn1_sub_parts[0]);
|
|
$dn2_sub_part_attr = trim($dn2_sub_parts[0]);
|
|
|
|
if (0 != ($cmp = strcasecmp($dn1_sub_part_attr,$dn2_sub_part_attr)))
|
|
return $cmp;
|
|
|
|
$dn1_sub_part_val = trim($dn1_sub_parts[1]);
|
|
$dn2_sub_part_val = trim($dn2_sub_parts[1]);
|
|
if (0 != ($cmp = strcasecmp($dn1_sub_part_val,$dn2_sub_part_val)))
|
|
return $cmp;
|
|
}
|
|
|
|
/* If we iterated through all entries in the smaller of the two DNs
|
|
(ie, the one with fewer parts), and the entries are different sized,
|
|
then, the smaller of the two must be "less than" than the larger. */
|
|
if (count($dn1_parts) > count($dn2_parts)) {
|
|
return 1;
|
|
|
|
} elseif (count($dn2_parts) > count($dn1_parts)) {
|
|
return -1;
|
|
|
|
} else {
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Prunes off anything after the ";" in an attr name. This is useful for
|
|
* attributes that may have ";binary" appended to their names. With
|
|
* real_attr_name(), you can more easily fetch these attributes' schema
|
|
* with their "real" attribute name.
|
|
*
|
|
* @param string $attr_name The name of the attribute to examine.
|
|
* @return string
|
|
*/
|
|
function real_attr_name($attr_name) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('real_attr_name(): Entered with (%s)',2,$attr_name);
|
|
|
|
$attr_name = preg_replace('/;.*$/U','',$attr_name);
|
|
return $attr_name;
|
|
}
|
|
|
|
/**
|
|
* Returns true if the user has configured PLA to show
|
|
* helpful hints with the $show_hints setting.
|
|
* This is configured in config.php thus:
|
|
* <code>
|
|
* $show_hints = true;
|
|
* </code>
|
|
*
|
|
* @return bool
|
|
* @deprecated
|
|
*/
|
|
function show_hints() {
|
|
global $config;
|
|
return $config->GetValue('appearance','show_hints');
|
|
}
|
|
|
|
/**
|
|
* Determines if the user has enabled auto uidNumbers for the specified server ID.
|
|
*
|
|
* @param int $server_id The id of the server of interest.
|
|
* @return bool True if auto uidNumbers are enabled, false otherwise.
|
|
*/
|
|
function auto_uid_numbers_enabled($server_id) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('auto_uid_numbers_enabled(): Entered with (%s)',2,$server_id);
|
|
|
|
global $ldapservers;
|
|
return $ldapservers->GetValue($server_id,'auto_number','enable');
|
|
}
|
|
|
|
/**
|
|
* For hosts who have 'enable_auto_uid_numbers' set to true, this function will
|
|
* get the next available uidNumber using the host's preferred mechanism
|
|
* (uidpool or search). The uidpool mechanism uses a user-configured entry in
|
|
* the LDAP server to store the last used uidNumber. This mechanism simply fetches
|
|
* and increments and returns that value. The search mechanism is more complicated
|
|
* and slow. It searches all entries that have uidNumber set, finds the smalles and
|
|
* "fills in the gaps" by incrementing the smallest uidNumber until an unused value
|
|
* is found. Both mechanisms do NOT prevent race conditions or toe-stomping, so
|
|
* care must be taken when actually creating the entry to check that the uidNumber
|
|
* returned here has not been used in the mean time. Note that the two different
|
|
* mechanisms may (will!) return different values as they use different algorithms
|
|
* to arrive at their result. Do not be alarmed if (when!) this is the case.
|
|
*
|
|
* Also note that both algorithms are susceptible to a race condition. If two admins
|
|
* are adding users simultaneously, the users may get identical uidNumbers with this
|
|
* function.
|
|
*
|
|
* See config.php.example for more notes on the two auto uidNumber mechanisms.
|
|
*
|
|
* @param object $ldapserver The LDAP Server Object of interest.
|
|
* @return int
|
|
*
|
|
* @todo take advantage of multiple connections with new LDAPServer object.
|
|
* @todo rename this function as its a generic get_next_number function now.
|
|
* @todo Must turn off auto_uid|gid in template if config is disabled.
|
|
*/
|
|
function get_next_uid_number($ldapserver,$startbase='',$type='uid') {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_next_uid_number(): Entered with (%s,%s,%s)',2,$ldapserver->server_id,$startbase,$type);
|
|
|
|
global $config,$ldapservers,$lang;
|
|
|
|
if (! $ldapservers->GetValue($ldapserver->server_id,'auto_number','enable'))
|
|
return false;
|
|
|
|
# Based on the configured mechanism, go get the next available uidNumber!
|
|
$mechanism = $ldapservers->GetValue($ldapserver->server_id,'auto_number','mechanism');
|
|
|
|
switch ($mechanism) {
|
|
|
|
// @todo: This is being deprecated - unless somebody wants it?
|
|
case 'uidpool' :
|
|
if( ! isset( $servers[ $ldapserver->server_id ][ 'auto_uid_number_uid_pool_dn' ] ) )
|
|
pla_error( sprintf( $lang['uidpool_not_set'], $ldapserver->name ) );
|
|
|
|
$uid_pool_dn = $servers[ $ldapserver->server_id ][ 'auto_uid_number_uid_pool_dn' ];
|
|
if( ! dn_exists( $ldapserver, $uid_pool_dn ) )
|
|
pla_error( sprintf( $lang['uidpool_not_exist'] , $uid_pool_dn ) );
|
|
|
|
$next_uid_number = get_object_attr( $ldapserver, $uid_pool_dn, 'uidNumber' );
|
|
$next_uid_number = intval( $next_uid_number[ 0 ] );
|
|
$next_uid_number++;
|
|
|
|
return $next_uid_number;
|
|
break;
|
|
|
|
case 'search' :
|
|
if (! $startbase) {
|
|
$base_dn = $ldapservers->GetValue($ldapserver->server_id,'auto_number','search_base');
|
|
if (is_null($base_dn))
|
|
pla_error( sprintf( $lang['specified_uidpool'] , $ldapserver->name ) );
|
|
|
|
} else {
|
|
$base_dn = $startbase;
|
|
}
|
|
$filter = "(|(uidNumber=*)(gidNumber=*))";
|
|
$results = array();
|
|
|
|
# Check see and use our alternate uid_dn and password if we have it.
|
|
if (! is_null($ldapservers->GetValue($ldapserver->server_id,'auto_number','dn')) &&
|
|
! is_null($ldapservers->GetValue($ldapserver->server_id,'auto_number','pass'))) {
|
|
|
|
$con = @ldap_connect($ldapserver->host,$ldapserver->port);
|
|
@ldap_set_option($con,LDAP_OPT_PROTOCOL_VERSION,3);
|
|
@ldap_set_option($con,LDAP_OPT_REFERRALS,0);
|
|
|
|
# Bind with the alternate ID.
|
|
$res = @ldap_bind($con,
|
|
$ldapservers->GetValue($ldapserver->server_id,'auto_number','dn'),
|
|
$ldapservers->GetValue($ldapserver->server_id,'auto_number','pass'));
|
|
|
|
if (! $res)
|
|
pla_error(sprintf($lang['auto_uid_invalid_credential'],$ldapserver->name));
|
|
|
|
$search = @ldap_search($con,$base_dn,$filter,array('uidNumber','gidNumber'),0,0,0,
|
|
$config->GetValue('deref','search'));
|
|
|
|
if (! $search)
|
|
pla_error(sprintf($lang['bad_auto_uid_search_base'],$ldapserver->name));
|
|
|
|
$search = @ldap_get_entries($con,$search);
|
|
$res = @ldap_unbind($con);
|
|
|
|
for ($i = 0;$i < $search['count']; $i++ ) {
|
|
$attrs = $search[$i];
|
|
|
|
switch ($type) {
|
|
case 'uid' :
|
|
if (isset($attrs['uidnumber'])) {
|
|
$entry['dn'] = $attrs['dn'];
|
|
$entry['uniqnumber'] = $attrs['uidnumber'][0];
|
|
}
|
|
break;
|
|
|
|
case 'gid' :
|
|
if (isset($attrs['gidnumber'])) {
|
|
$entry['dn'] = $attrs['dn'];
|
|
$entry['uniqnumber'] = $attrs['gidnumber'][0];
|
|
}
|
|
break;
|
|
}
|
|
$results[] = $entry;
|
|
}
|
|
|
|
} else {
|
|
$search = pla_ldap_search( $ldapserver, $filter, $base_dn, array('uidNumber','gidNumber'));
|
|
|
|
foreach ($search as $dn => $attrs) {
|
|
switch ($type) {
|
|
case 'uid' :
|
|
if (isset($attrs['uidNumber'])) {
|
|
$entry['dn'] = $attrs['dn'];
|
|
$entry['uniqnumber'] = $attrs['uidNumber'];
|
|
}
|
|
break;
|
|
|
|
case 'gid' :
|
|
if (isset($attrs['gidNumber'])) {
|
|
$entry['dn'] = $attrs['dn'];
|
|
$entry['uniqnumber'] = $attrs['gidNumber'];
|
|
}
|
|
break;
|
|
}
|
|
$results[] = $entry;
|
|
}
|
|
}
|
|
|
|
# construct a list of used numbers
|
|
$autonum = array();
|
|
foreach ($results as $result)
|
|
$autonum[] = $result['uniqnumber'];
|
|
|
|
$autonum = array_unique($autonum);
|
|
if (count($autonum) == 0)
|
|
return false;
|
|
|
|
sort($autonum);
|
|
foreach($autonum as $uid)
|
|
$uid_hash[$uid] = 1;
|
|
|
|
# start with the least existing autoNumber and add 1
|
|
if ($ldapservers->GetValue($ldapserver->server_id,'auto_number','min'))
|
|
$minNumber = $ldapservers->GetValue($ldapserver->server_id,'auto_number','min');
|
|
|
|
else
|
|
$minNumber = intval($autonum[0]) + 1;
|
|
|
|
# this loop terminates as soon as we encounter the next available minNumber
|
|
while (isset($uid_hash[$minNumber]))
|
|
$minNumber++;
|
|
|
|
return $minNumber;
|
|
|
|
break;
|
|
|
|
# No other cases allowed. The user has an error in the configuration
|
|
default :
|
|
pla_error( sprintf( $lang['auto_uid_invalid_value'] , $mechanism) );
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Used to determine if the specified attribute is indeed a jpegPhoto. If the
|
|
* specified attribute is one that houses jpeg data, true is returned. Otherwise
|
|
* this function returns false.
|
|
*
|
|
* @param int $server_id The ID of the server hosuing the attribute of interest
|
|
* @param string $attr_name The name of the attribute to test.
|
|
* @return bool
|
|
* @see draw_jpeg_photos
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function is_jpeg_photo($ldapserver,$attr_name) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_jpeg_photo(): Entered with (%s,%s)',2,$ldapserver->server_id,$attr_name);
|
|
|
|
# easy quick check
|
|
if (! strcasecmp($attr_name,'jpegPhoto') || ! strcasecmp($attr_name,'photo'))
|
|
return true;
|
|
|
|
# go to the schema and get the Syntax OID
|
|
$schema_attr = $ldapserver->getSchemaAttribute($attr_name);
|
|
if (! $schema_attr)
|
|
return false;
|
|
|
|
$oid = $schema_attr->getSyntaxOID();
|
|
$type = $schema_attr->getType();
|
|
|
|
if (! strcasecmp($type,'JPEG') || ($oid == '1.3.6.1.4.1.1466.115.121.1.28'))
|
|
return true;
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Given an attribute name and server ID number, this function returns
|
|
* whether the attrbiute contains boolean data. This is useful for
|
|
* developers who wish to display the contents of a boolean attribute
|
|
* with a drop-down.
|
|
*
|
|
* @param int $server_id The ID of the server of interest (required since
|
|
* this action requires a schema lookup on the server)
|
|
* @param string $attr_name The name of the attribute to test.
|
|
* @return bool
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function is_attr_boolean($ldapserver,$attr_name) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_attr_boolean(): Entered with (%s,%s)',2,$ldapserver->server_id,$attr_name);
|
|
|
|
$type = ($schema_attr = $ldapserver->getSchemaAttribute($attr_name)) ? $schema_attr->getType() : null;
|
|
|
|
if (! strcasecmp('boolean',$type ) ||
|
|
! strcasecmp('isCriticalSystemObject',$attr_name) ||
|
|
! strcasecmp('showInAdvancedViewOnly',$attr_name))
|
|
return true;
|
|
|
|
else
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Given an attribute name and server ID number, this function returns
|
|
* whether the attrbiute may contain binary data. This is useful for
|
|
* developers who wish to display the contents of an arbitrary attribute
|
|
* but don't want to dump binary data on the page.
|
|
*
|
|
* @param int $server_id The ID of the server of interest (required since
|
|
* this action requires a schema lookup on the server)
|
|
* @param string $attr_name The name of the attribute to test.
|
|
* @return bool
|
|
*
|
|
* @see is_jpeg_photo
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function is_attr_binary($ldapserver,$attr_name) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_attr_binary(): Entered with (%s,%s)',2,$ldapserver->server_id,$attr_name);
|
|
|
|
$attr_name = strtolower($attr_name);
|
|
/**
|
|
* Determining if an attribute is binary can be an expensive operation.
|
|
* We cache the results for each attr name on each server in the $attr_cache
|
|
* to speed up subsequent calls. The $attr_cache looks like this:
|
|
*
|
|
* Array
|
|
* 0 => Array
|
|
* 'objectclass' => false
|
|
* 'cn' => false
|
|
* 'usercertificate' => true
|
|
* 1 => Array
|
|
* 'jpegphoto' => true
|
|
* 'cn' => false
|
|
*/
|
|
|
|
static $attr_cache;
|
|
if( isset( $attr_cache[ $ldapserver->server_id ][ $attr_name ] ) )
|
|
return $attr_cache[ $ldapserver->server_id ][ $attr_name ];
|
|
|
|
if( $attr_name == 'userpassword' ) {
|
|
$attr_cache[ $ldapserver->server_id ][ $attr_name ] = false;
|
|
return false;
|
|
}
|
|
|
|
// Quick check: If the attr name ends in ";binary", then it's binary.
|
|
if( 0 == strcasecmp( substr( $attr_name, strlen( $attr_name ) - 7 ), ";binary" ) ) {
|
|
$attr_cache[ $ldapserver->server_id ][ $attr_name ] = true;
|
|
return true;
|
|
}
|
|
|
|
// See what the server schema says about this attribute
|
|
$schema_attr = $ldapserver->getSchemaAttribute($attr_name);
|
|
if( ! $schema_attr ) {
|
|
|
|
// Strangely, some attributeTypes may not show up in the server
|
|
// schema. This behavior has been observed in MS Active Directory.
|
|
$type = null;
|
|
$syntax = null;
|
|
|
|
} else {
|
|
$type = $schema_attr->getType();
|
|
$syntax = $schema_attr->getSyntaxOID();
|
|
}
|
|
|
|
if( 0 == strcasecmp( $type, 'Certificate' ) ||
|
|
0 == strcasecmp( $type, 'Binary' ) ||
|
|
0 == strcasecmp( $attr_name, 'usercertificate' ) ||
|
|
0 == strcasecmp( $attr_name, 'usersmimecertificate' ) ||
|
|
0 == strcasecmp( $attr_name, 'networkaddress' ) ||
|
|
0 == strcasecmp( $attr_name, 'objectGUID' ) ||
|
|
0 == strcasecmp( $attr_name, 'objectSID' ) ||
|
|
$syntax == '1.3.6.1.4.1.1466.115.121.1.10' ||
|
|
$syntax == '1.3.6.1.4.1.1466.115.121.1.28' ||
|
|
$syntax == '1.3.6.1.4.1.1466.115.121.1.5' ||
|
|
$syntax == '1.3.6.1.4.1.1466.115.121.1.8' ||
|
|
$syntax == '1.3.6.1.4.1.1466.115.121.1.9' ) {
|
|
|
|
$attr_cache[ $ldapserver->server_id ][ $attr_name ] = true;
|
|
return true;
|
|
|
|
} else {
|
|
$attr_cache[ $ldapserver->server_id ][ $attr_name ] = false;
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns true if the specified attribute is configured as read only
|
|
* in config.php with the $read_only_attrs array.
|
|
* Attributes are configured as read-only in config.php thus:
|
|
* <code>
|
|
* $read_only_attrs = array( "objectClass", "givenName" );
|
|
* </code>
|
|
*
|
|
* @param string $attr The name of the attribute to test.
|
|
* @return bool
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function is_attr_read_only( $ldapserver, $attr ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_attr_read_only(): Entered with (%s,%s)',2,$ldapserver->server_id,$attr);
|
|
|
|
global $read_only_attrs, $read_only_except_dn;
|
|
|
|
$attr = trim( $attr );
|
|
if( '' === $attr )
|
|
return false;
|
|
if( ! isset( $read_only_attrs ) )
|
|
return false;
|
|
if( ! is_array( $read_only_attrs) )
|
|
return false;
|
|
|
|
// Is the user excluded?
|
|
if (isset($read_only_except_dn) && userIsMember($ldapserver, get_logged_in_dn( $ldapserver ),$read_only_except_dn))
|
|
return false;
|
|
|
|
foreach( $read_only_attrs as $attr_name )
|
|
if( 0 == strcasecmp( $attr, trim($attr_name) ) )
|
|
return true;
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Returns true if the specified attribute is configured as hidden
|
|
* in config.php with the $hidden_attrs array or the $hidden_attrs_ro
|
|
* array.
|
|
* Attributes are configured as hidden in config.php thus:
|
|
* <code>
|
|
* $hidden_attrs = array( "objectClass", "givenName" );
|
|
* </code>
|
|
* or
|
|
* <code>
|
|
* $hidden_attrs_ro = array( "objectClass", "givenName", "shadowWarning",
|
|
* "shadowLastChange", "shadowMax", "shadowFlag",
|
|
* "shadowInactive", "shadowMin", "shadowExpire" );
|
|
* </code>
|
|
*
|
|
* @param string $attr The name of the attribute to test.
|
|
* @return bool
|
|
*/
|
|
function is_attr_hidden( $ldapserver, $attr ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_attr_hidden(): Entered with (%s,%s)',2,$ldapserver->server_id,$attr);
|
|
|
|
global $hidden_attrs, $hidden_attrs_ro, $hidden_except_dn;
|
|
|
|
$attr = trim( $attr );
|
|
if( '' === $attr )
|
|
return false;
|
|
if( ! isset( $hidden_attrs ) )
|
|
return false;
|
|
if( ! is_array( $hidden_attrs) )
|
|
return false;
|
|
|
|
if( ! isset( $hidden_attrs_ro ) )
|
|
$hidden_attrs_ro = $hidden_attrs;
|
|
if( ! is_array( $hidden_attrs_ro) )
|
|
$hidden_attrs_ro = $hidden_attrs;
|
|
|
|
// Is the user excluded?
|
|
if (isset($hidden_except_dn) && userIsMember($ldapserver, get_logged_in_dn( $ldapserver ),$hidden_except_dn))
|
|
return false;
|
|
|
|
if( $ldapserver->isReadOnly() ) {
|
|
foreach( $hidden_attrs_ro as $attr_name )
|
|
if( 0 == strcasecmp( $attr, trim($attr_name) ) )
|
|
return true;
|
|
|
|
} else {
|
|
foreach( $hidden_attrs as $attr_name )
|
|
if( 0 == strcasecmp( $attr, trim($attr_name) ) )
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Returns true if the specified server is configured to be displayed
|
|
* in read only mode. If a user has logged in via anonymous bind, and
|
|
* config.php specifies anonymous_bind_implies_read_only as true, then
|
|
* this also returns true. Servers can be configured read-only in
|
|
* config.php thus:
|
|
* <code>
|
|
* $server[$i]['read_only'] = true;
|
|
* </code>
|
|
*
|
|
* @param int $server_id The ID of the server of interest from the $servers array in config.php
|
|
* @return bool
|
|
* @deprecated
|
|
*/
|
|
function is_server_read_only( $server_id ) {
|
|
global $servers;
|
|
if( isset( $servers[$server_id]['read_only'] ) &&
|
|
$servers[$server_id]['read_only'] == true )
|
|
return true;
|
|
|
|
global $anonymous_bind_implies_read_only;
|
|
|
|
if( "anonymous" == get_logged_in_dn( $server_id ) &&
|
|
isset( $anonymous_bind_implies_read_only ) &&
|
|
$anonymous_bind_implies_read_only == true )
|
|
return true;
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Given a DN and server ID, this function reads the DN's objectClasses and
|
|
* determines which icon best represents the entry. The results of this query
|
|
* are cached in a session variable so it is not run every time the tree
|
|
* browser changes, just when exposing new DNs that were not displayed
|
|
* previously. That means we can afford a little bit of inefficiency here
|
|
* in favor of coolness. :)
|
|
*
|
|
* This function returns a string like "country.png". All icon files are assumed
|
|
* to be contained in the /images/ directory of phpLDAPadmin.
|
|
*
|
|
* Developers are encouraged to add new icons to the images directory and modify
|
|
* this function as needed to suit their types of LDAP entries. If the modifications
|
|
* are general to an LDAP audience, the phpLDAPadmin team will gladly accept them
|
|
* as a patch.
|
|
*
|
|
* @param int $server_id The ID of the LDAP server housing the DN of interest.
|
|
* @param string $dn The DN of the entry whose icon you wish to fetch.
|
|
*
|
|
* @return string
|
|
*/
|
|
function get_icon( $ldapserver, $dn ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_icon(): Entered with (%s,%s)',2,$ldapserver->server_id,$dn);
|
|
|
|
// fetch and lowercase all the objectClasses in an array
|
|
$object_classes = get_object_attr( $ldapserver, $dn, 'objectClass', true );
|
|
|
|
if( $object_classes === null || $object_classes === false || ! is_array( $object_classes ) )
|
|
$object_classes = array();
|
|
|
|
foreach( $object_classes as $i => $class )
|
|
$object_classes[$i] = strtolower( $class );
|
|
|
|
$rdn = get_rdn( $dn );
|
|
$rdn_parts = explode( '=', $rdn, 2 );
|
|
$rdn_value = isset( $rdn_parts[0] ) ? $rdn_parts[0] : null;
|
|
$rdn_attr = isset( $rdn_parts[1] ) ? $rdn_parts[1] : null;
|
|
unset( $rdn_parts );
|
|
|
|
// return icon filename based upon objectClass value
|
|
if( in_array( 'sambaaccount', $object_classes ) &&
|
|
'$' == $rdn{ strlen($rdn) - 1 } )
|
|
return 'nt_machine.png';
|
|
|
|
if( in_array( 'sambaaccount', $object_classes ) )
|
|
return 'nt_user.png';
|
|
|
|
elseif( in_array( 'person', $object_classes ) ||
|
|
in_array( 'organizationalperson', $object_classes ) ||
|
|
in_array( 'inetorgperson', $object_classes ) ||
|
|
in_array( 'account', $object_classes ) ||
|
|
in_array( 'posixaccount', $object_classes ) )
|
|
|
|
return 'user.png';
|
|
|
|
elseif( in_array( 'organization', $object_classes ) )
|
|
return 'o.png';
|
|
|
|
elseif( in_array( 'organizationalunit', $object_classes ) )
|
|
return 'ou.png';
|
|
|
|
elseif( in_array( 'organizationalrole', $object_classes ) )
|
|
return 'uid.png';
|
|
|
|
elseif( in_array( 'dcobject', $object_classes ) ||
|
|
in_array( 'domainrelatedobject', $object_classes ) ||
|
|
in_array( 'domain', $object_classes ) ||
|
|
in_array( 'builtindomain', $object_classes ))
|
|
|
|
return 'dc.png';
|
|
|
|
elseif( in_array( 'alias', $object_classes ) )
|
|
return 'go.png';
|
|
|
|
elseif( in_array( 'room', $object_classes ) )
|
|
return 'door.png';
|
|
|
|
elseif( in_array( 'device', $object_classes ) )
|
|
return 'device.png';
|
|
|
|
elseif( in_array( 'document', $object_classes ) )
|
|
return 'document.png';
|
|
|
|
elseif( in_array( 'country', $object_classes ) ) {
|
|
$tmp = pla_explode_dn( $dn );
|
|
$cval = explode( '=', $tmp[0], 2 );
|
|
$cval = isset( $cval[1] ) ? $cval[1] : false;
|
|
if( $cval && false === strpos( $cval, ".." ) &&
|
|
file_exists( realpath( sprintf("./images/countries/%s.png",strtolower($cval)) ) ) )
|
|
|
|
return sprintf("countries/%s.png",strtolower($cval));
|
|
|
|
else
|
|
return 'country.png';
|
|
}
|
|
|
|
elseif( in_array( 'jammvirtualdomain', $object_classes ) )
|
|
return 'mail.png';
|
|
|
|
elseif( in_array( 'locality', $object_classes ) )
|
|
return 'locality.png';
|
|
|
|
elseif( in_array( 'posixgroup', $object_classes ) ||
|
|
in_array( 'groupofnames', $object_classes ) ||
|
|
in_array( 'group', $object_classes ) )
|
|
|
|
return 'ou.png';
|
|
|
|
elseif( in_array( 'applicationprocess', $object_classes ) )
|
|
return 'process.png';
|
|
|
|
elseif( in_array( 'groupofuniquenames', $object_classes ) )
|
|
return 'uniquegroup.png';
|
|
|
|
elseif( in_array( 'iphost', $object_classes ) )
|
|
return 'host.png';
|
|
|
|
elseif( in_array( 'nlsproductcontainer', $object_classes ) )
|
|
return 'n.png';
|
|
|
|
elseif( in_array( 'ndspkikeymaterial', $object_classes ) )
|
|
return 'lock.png';
|
|
|
|
elseif( in_array( 'server', $object_classes ) )
|
|
return 'server-small.png';
|
|
|
|
elseif( in_array( 'volume', $object_classes ) )
|
|
return 'hard-drive.png';
|
|
|
|
elseif( in_array( 'ndscatcatalog', $object_classes ) )
|
|
return 'catalog.png';
|
|
|
|
elseif( in_array( 'resource', $object_classes ) )
|
|
return 'n.png';
|
|
|
|
elseif( in_array( 'ldapgroup', $object_classes ) )
|
|
return 'ldap-server.png';
|
|
|
|
elseif( in_array( 'ldapserver', $object_classes ) )
|
|
return 'ldap-server.png';
|
|
|
|
elseif( in_array( 'nisserver', $object_classes ) )
|
|
return 'ldap-server.png';
|
|
|
|
elseif( in_array( 'rbscollection', $object_classes ) )
|
|
return 'ou.png';
|
|
|
|
elseif( in_array( 'dfsconfiguration', $object_classes ) )
|
|
return 'nt_machine.png';
|
|
|
|
elseif( in_array( 'applicationsettings', $object_classes ) )
|
|
return 'server-settings.png';
|
|
|
|
elseif( in_array( 'aspenalias', $object_classes ) )
|
|
return 'mail.png';
|
|
|
|
elseif( in_array( 'container', $object_classes ) )
|
|
return 'folder.png';
|
|
|
|
elseif( in_array( 'ipnetwork', $object_classes ) )
|
|
return 'network.png';
|
|
|
|
elseif( in_array( 'samserver', $object_classes ) )
|
|
return 'server-small.png';
|
|
|
|
elseif( in_array( 'lostandfound', $object_classes ) )
|
|
return 'find.png';
|
|
|
|
elseif( in_array( 'infrastructureupdate', $object_classes ) )
|
|
return 'server-small.png';
|
|
|
|
elseif( in_array( 'filelinktracking', $object_classes ) )
|
|
return 'files.png';
|
|
|
|
elseif( in_array( 'automountmap', $object_classes ) ||
|
|
in_array( 'automount', $object_classes ) )
|
|
|
|
return 'hard-drive.png';
|
|
|
|
elseif( 0 === strpos( $rdn_value, "ipsec" ) ||
|
|
0 == strcasecmp( $rdn_value, "IP Security" ) ||
|
|
0 == strcasecmp( $rdn_value, "MSRADIUSPRIVKEY Secret" ) ||
|
|
0 === strpos( $rdn_value, "BCKUPKEY_" ) )
|
|
|
|
return 'lock.png';
|
|
|
|
elseif( 0 == strcasecmp( $rdn_value, "MicrosoftDNS" ) )
|
|
return 'dc.png';
|
|
|
|
// Oh well, I don't know what it is. Use a generic icon.
|
|
else
|
|
return 'object.png';
|
|
}
|
|
|
|
/**
|
|
* Does the same thing as get_icon(), but it tries to fetch the icon name from the
|
|
* tree_icons session variable first. If not found, resorts to get_icon() and stores
|
|
* the icon nmae in the tree_icons session before returing the icon.
|
|
*
|
|
* @param int $server_id The ID of the server housing the DN of interest.
|
|
* @param string $dn The DN of the entry of interest.
|
|
*
|
|
* @return string
|
|
*
|
|
* @see get_icon
|
|
*/
|
|
function get_icon_use_cache( $ldapserver, $dn ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_icon_use_cache(): Entered with (%s,%s)',2,$ldapserver->server_id,$dn);
|
|
|
|
initialize_session_tree();
|
|
|
|
if( array_key_exists( 'tree_icons', $_SESSION ) ) {
|
|
if( array_key_exists( $ldapserver->server_id, $_SESSION['tree_icons'] ) &&
|
|
array_key_exists( $dn, $_SESSION['tree_icons'][$ldapserver->server_id] ) ) {
|
|
return $_SESSION['tree_icons'][ $ldapserver->server_id ][ $dn ];
|
|
|
|
} else {
|
|
$icon = get_icon( $ldapserver, $dn );
|
|
$_SESSION['tree_icons'][ $ldapserver->server_id ][ $dn ] = $icon;
|
|
return $icon;
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Given a server_id, returns whether or not we have enough information
|
|
* to authenticate against the server. For example, if the user specifies
|
|
* auth_type of 'cookie' in the config for that server, it checks the $_COOKIE array to
|
|
* see if the cookie username and password is set for the server. If the auth_type
|
|
* is 'session', the $_SESSION array is checked.
|
|
*
|
|
* There are three cases for this function depending on the auth_type configured for
|
|
* the specified server. If the auth_type is form or http, then get_logged_in_dn() is
|
|
* called to verify that the user has logged in. If the auth_type is config, then the
|
|
* $servers array in config.php is checked to ensure that the user has specified
|
|
* login information. In any case, if phpLDAPadmin has enough information to login
|
|
* to the server, true is returned. Otherwise false is returned.
|
|
*
|
|
* @param int $server_id
|
|
* @return bool
|
|
* @see get_logged_in_dn
|
|
* @deprecated
|
|
*/
|
|
function have_auth_info( $server_id )
|
|
{
|
|
global $servers, $ldapservers;
|
|
$ldapserver = $ldapservers->Instance($server_id);
|
|
|
|
$server = $servers[$server_id];
|
|
|
|
// For session or cookie auth_types, we check the session or cookie to see if a user has logged in.
|
|
if( isset( $server['auth_type'] ) && ( in_array( $server['auth_type'], array( 'session', 'cookie' ) ) ) ) {
|
|
// we don't look at get_logged_in_pass() cause it may be null for anonymous binds
|
|
// get_logged_in_dn() will never return null if someone is really logged in.
|
|
if( get_logged_in_dn( $ldapserver ) )
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
// whether or not the login_dn or pass is specified, we return
|
|
// true here. (if they are blank, we do an anonymous bind anyway)
|
|
elseif( ! isset( $server['auth_type'] ) || $server['auth_type'] == 'config' ) {
|
|
return true;
|
|
}
|
|
else {
|
|
global $lang;
|
|
pla_error( sprintf( $lang['error_auth_type_config'],
|
|
htmlspecialchars( $server[ 'auth_type' ] ) ) );
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Fetches the password of the currently logged in user (for auth_types "form" and "http" only)
|
|
* or false if the current login is anonymous.
|
|
*
|
|
* @param object $ldapserver The LDAPServer object of the server which the user hsa logged in.
|
|
* @return string
|
|
* @see have_auth_info
|
|
* @see get_logged_in_dn
|
|
*/
|
|
function get_logged_in_pass( $ldapserver ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_logged_in_pass(): Entered with (%s)',2,$ldapserver->server_id);
|
|
|
|
if (! $ldapserver->auth_type)
|
|
return false;
|
|
|
|
switch( $ldapserver->auth_type )
|
|
{
|
|
case 'cookie':
|
|
$cookie_name = sprintf('pla_login_pass_%s',$ldapserver->server_id);
|
|
$pass = isset( $_COOKIE[ $cookie_name ] ) ? $_COOKIE[ $cookie_name ] : false;
|
|
|
|
if( $pass == '0' )
|
|
return null;
|
|
else
|
|
return pla_blowfish_decrypt( $pass );
|
|
break;
|
|
|
|
case 'session':
|
|
$session_var_name = sprintf('pla_login_pass_%s',$ldapserver->server_id);
|
|
$pass = isset( $_SESSION[ $session_var_name ] ) ? $_SESSION[ $session_var_name ] : false;
|
|
|
|
if( $pass == '0' )
|
|
return null;
|
|
else
|
|
return pla_blowfish_decrypt ( $pass );
|
|
break;
|
|
|
|
case 'config':
|
|
return $ldapserver->login_pass;
|
|
break;
|
|
|
|
default:
|
|
global $lang;
|
|
pla_error( sprintf( $lang['unknown_auth_type'], htmlspecialchars( $ldapserver->auth_type ) ) );
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns the DN who is logged in currently to the given server, which may
|
|
* either be a DN or the string 'anonymous'. This applies only for auth_types
|
|
* "form" and "http".
|
|
*
|
|
* One place where this function is used is the tree viewer:
|
|
* After a user logs in, the text "Logged in as: " is displayed under the server
|
|
* name. This information is retrieved from this function.
|
|
*
|
|
* @param object $ldapserver The LDAPServer object of the server which the user hsa logged in.
|
|
* @return string
|
|
* @see have_auth_info
|
|
* @see get_logged_in_pass
|
|
*/
|
|
function get_logged_in_dn($ldapserver) {
|
|
# Set default return
|
|
$return = false;
|
|
|
|
if ($ldapserver->auth_type) {
|
|
switch ($ldapserver->auth_type) {
|
|
case 'cookie':
|
|
$cookie_name = sprintf('pla_login_dn_%s',$ldapserver->server_id);
|
|
|
|
if (isset($_COOKIE[$cookie_name]))
|
|
$return = pla_blowfish_decrypt($_COOKIE[$cookie_name]);
|
|
else
|
|
$return = false;
|
|
|
|
break;
|
|
|
|
case 'session':
|
|
$session_var_name = sprintf('pla_login_dn_%s',$ldapserver->server_id);
|
|
|
|
if (isset($_SESSION[$session_var_name]))
|
|
$return = pla_blowfish_decrypt($_SESSION[$session_var_name]);
|
|
else
|
|
$return = false;
|
|
|
|
break;
|
|
|
|
case 'config':
|
|
$return = $ldapserver->login_dn;
|
|
break;
|
|
|
|
default:
|
|
global $lang;
|
|
pla_error(sprintf($lang['unknown_auth_type'],htmlspecialchars($auth_type)));
|
|
}
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_logged_in_dn(): Entered with (%s), Returning (%s)',1,$ldapserver->server_id,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Appends a servers base to a "sub" dn or returns the base.
|
|
*
|
|
* @param string $base The baseDN to be added if the DN is relative
|
|
* @param string $sub_dn The DN to be made absolute
|
|
* @return string|null Returns null if both base is null and sub_dn is null or empty
|
|
*/
|
|
function expand_dn_with_base( $base,$sub_dn ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('expand_dn_with_base(): Entered with (%s,%s)',2,$base,$sub_dn);
|
|
|
|
$empty_str = ( is_null($sub_dn) || ( ( $len = strlen( trim( $sub_dn ) ) ) == 0 ) );
|
|
|
|
if ( $empty_str ) {
|
|
return $base;
|
|
|
|
} elseif ( $sub_dn[$len - 1] != ',' ) {
|
|
// If we have a string which doesn't need a base
|
|
return $sub_dn;
|
|
} else {
|
|
return $sub_dn . $base;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Gets a list of child entries for an entry. Given a DN, this function fetches the list of DNs of
|
|
* child entries one level beneath the parent. For example, for the following tree:
|
|
*
|
|
* <code>
|
|
* dc=example,dc=com
|
|
* ou=People
|
|
* cn=Dave
|
|
* cn=Fred
|
|
* cn=Joe
|
|
* ou=More People
|
|
* cn=Mark
|
|
* cn=Bob
|
|
* </code>
|
|
*
|
|
* Calling <code>get_container_contents( $server_id, "ou=people,dc=example,dc=com" )</code>
|
|
* would return the following list:
|
|
*
|
|
* <code>
|
|
* cn=Dave
|
|
* cn=Fred
|
|
* cn=Joe
|
|
* ou=More People
|
|
* </code>
|
|
*
|
|
* @param object $ldapserver The LDAP Server Object housing the entry of interest
|
|
* @param string $dn The DN of the entry whose children to return.
|
|
* @param int $size_limit (optional) The maximum number of entries to return.
|
|
* If unspecified, no limit is applied to the number of entries in the returned.
|
|
* @param string $filter (optional) An LDAP filter to apply when fetching children, example: "(objectClass=inetOrgPerson)"
|
|
* @return array An array of DN strings listing the immediate children of the specified entry.
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function get_container_contents( $ldapserver, $dn, $size_limit=0, $filter='(objectClass=*)', $deref=LDAP_DEREF_ALWAYS ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_container_contents(): Entered with (%s,%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$dn,$size_limit,$filter,$deref);
|
|
|
|
$search = @ldap_list( $ldapserver->connect(), $dn, $filter, array( 'dn' ), 1, $size_limit, 0, $deref );
|
|
if( ! $search )
|
|
return array();
|
|
|
|
$search = ldap_get_entries( $ldapserver->connect(), $search );
|
|
|
|
$return = array();
|
|
for( $i=0; $i<$search['count']; $i++ ) {
|
|
$entry = $search[$i];
|
|
$dn = $entry['dn'];
|
|
$return[] = $dn;
|
|
}
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Builds the initial tree that is stored in the session variable 'tree'.
|
|
* Simply returns an array with an entry for each active server in
|
|
* config.php. The structure of the returned array is simple, and looks like
|
|
* this:
|
|
* <code>
|
|
* Array (
|
|
* 0 => Array ( )
|
|
* 1 => Array ( )
|
|
* )
|
|
* </code>
|
|
* This function is not meant as a user callable function, but rather a convenient,
|
|
* automated method for setting up the initial structure for the tree viewer.
|
|
*/
|
|
function build_initial_tree() {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('build_initial_tree(): Entered with ()',2);
|
|
|
|
global $ldapservers;
|
|
$return = array();
|
|
|
|
foreach ($ldapservers->GetServerList() as $id) {
|
|
if( $ldapservers->GetValue($id,'server','host') == '' )
|
|
continue;
|
|
|
|
$return[$id] = array();
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('build_initial_tree(): Returning (%s)',1,serialize($return));
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Builds the initial array that stores the icon-lookup for each server's DN in the tree browser. The returned
|
|
* array is then stored in the current session. The structure of the returned array is simple, and looks like
|
|
* this:
|
|
* <code>
|
|
* Array
|
|
* (
|
|
* [0] => Array
|
|
* (
|
|
* [dc=example,dc=com] => "dcobject.png"
|
|
* )
|
|
* [1] => Array
|
|
* (
|
|
* [o=Corporation] => "o.png"
|
|
* )
|
|
* )
|
|
* </code>
|
|
* This function is not meant as a user-callable function, but rather a convenient, automated method for
|
|
* setting up the initial data structure for the tree viewer's icon cache.
|
|
*/
|
|
function build_initial_tree_icons() {
|
|
global $ldapservers;
|
|
|
|
$return = array();
|
|
|
|
# initialize an empty array for each server
|
|
foreach ($ldapservers->GetServerList() as $id) {
|
|
if( $ldapservers->GetValue($id,'server','host') == '' )
|
|
continue;
|
|
|
|
$ldapserver = $ldapservers->Instance($id);
|
|
|
|
$return[$id] = array();
|
|
foreach ($ldapserver->getBaseDN() as $base_dn)
|
|
$return[$id][$base_dn] = get_icon($ldapserver,$base_dn);
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('build_initial_tree_icons(): Entered with (), Returning (%s)',1,serialize($return));
|
|
|
|
return $return;
|
|
}
|
|
|
|
/*
|
|
* Checks and fixes an initial session's tree cache if needed.
|
|
*
|
|
* This function is not meant as a user-callable function, but rather a convenient,
|
|
* automated method for checking the initial data structure of the session.
|
|
*/
|
|
function initialize_session_tree() {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('initialize_session_tree(): Entered with ()',2);
|
|
|
|
// From the PHP manual: If you use $_SESSION don't use
|
|
// session_register(), session_is_registered() or session_unregister()!
|
|
if( ! array_key_exists( 'tree', $_SESSION ) )
|
|
$_SESSION['tree'] = build_initial_tree();
|
|
if( ! array_key_exists( 'tree_icons', $_SESSION ) )
|
|
$_SESSION['tree_icons'] = build_initial_tree_icons();
|
|
|
|
// Make sure that the tree index is indeed well formed.
|
|
if( ! is_array( $_SESSION['tree'] ) )
|
|
$_SESSION['tree'] = build_initial_tree();
|
|
if( ! is_array( $_SESSION['tree_icons'] ) )
|
|
$_SESSION['tree_icons'] = build_initial_tree_icons();
|
|
}
|
|
|
|
/**
|
|
* Gets the operational attributes for an entry. Given a DN, this function fetches that entry's
|
|
* operational (ie, system or internal) attributes. These attributes include "createTimeStamp",
|
|
* "creatorsName", and any other attribute that the LDAP server sets automatically. The returned
|
|
* associative array is of this form:
|
|
* <code>
|
|
* Array
|
|
* (
|
|
* [creatorsName] => Array
|
|
* (
|
|
* [0] => "cn=Admin,dc=example,dc=com"
|
|
* )
|
|
* [createTimeStamp]=> Array
|
|
* (
|
|
* [0] => "10401040130"
|
|
* )
|
|
* [hasSubordinates] => Array
|
|
* (
|
|
* [0] => "FALSE"
|
|
* )
|
|
* )
|
|
* </code>
|
|
*
|
|
* @param object $ldapserver The LDAP Server Object of interest
|
|
* @param string $dn The DN of the entry whose interal attributes are desired.
|
|
* @param int $deref For aliases and referrals, this parameter specifies whether to
|
|
* follow references to the referenced DN or to fetch the attributes for
|
|
* the referencing DN. See http://php.net/ldap_search for the 4 valid
|
|
* options.
|
|
* @return array An associative array whose keys are attribute names and whose values
|
|
* are arrays of values for the aforementioned attribute.
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function get_entry_system_attrs( $ldapserver, $dn, $deref=LDAP_DEREF_NEVER ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_entry_system_attrs(): Entered with (%s,%s,%s)',2,$ldapserver->server_id,$dn,$deref);
|
|
|
|
$attrs = array( 'creatorsname', 'createtimestamp', 'modifiersname',
|
|
'structuralObjectClass', 'entryUUID', 'modifytimestamp',
|
|
'subschemaSubentry', 'hasSubordinates', '+' );
|
|
|
|
$search = @ldap_read( $ldapserver->connect(), $dn, '(objectClass=*)', $attrs, 0, 0, 0, $deref );
|
|
if( ! $search )
|
|
return false;
|
|
|
|
$entry = ldap_first_entry( $ldapserver->connect(), $search );
|
|
if (! $entry)
|
|
return false;
|
|
|
|
$attrs = ldap_get_attributes( $ldapserver->connect(), $entry );
|
|
if( ! $attrs )
|
|
return false;
|
|
|
|
if( ! isset( $attrs['count'] ) )
|
|
return false;
|
|
|
|
$count = $attrs['count'];
|
|
unset( $attrs['count'] );
|
|
$return_attrs = array();
|
|
|
|
for( $i=0; $i<$count; $i++ ) {
|
|
$attr_name = $attrs[$i];
|
|
unset( $attrs[$attr_name]['count'] );
|
|
$return_attrs[$attr_name] = $attrs[$attr_name];
|
|
}
|
|
|
|
return $return_attrs;
|
|
}
|
|
|
|
/**
|
|
* Gets the attributes/values of an entry. Returns an associative array whose
|
|
* keys are attribute value names and whose values are arrays of values for
|
|
* said attribute. Optionally, callers may specify true for the parameter
|
|
* $lower_case_attr_names to force all keys in the associate array (attribute
|
|
* names) to be lower case.
|
|
*
|
|
* Sample return value of <code>get_object_attrs( 0, "cn=Bob,ou=pepole,dc=example,dc=com" )</code>
|
|
*
|
|
* <code>
|
|
* Array
|
|
* (
|
|
* [objectClass] => Array
|
|
* (
|
|
* [0] => person
|
|
* [1] => top
|
|
* )
|
|
* [cn] => Array
|
|
* (
|
|
* [0] => Bob
|
|
* )
|
|
* [sn] => Array
|
|
* (
|
|
* [0] => Jones
|
|
* )
|
|
* [dn] => Array
|
|
* (
|
|
* [0] => cn=Bob,ou=pepole,dc=example,dc=com
|
|
* )
|
|
* )
|
|
* </code>
|
|
*
|
|
* @param object $ldapserver The LDAP Server Object of interest
|
|
* @param string $dn The distinguished name (DN) of the entry whose attributes/values to fetch.
|
|
* @param bool $lower_case_attr_names (optional) If true, all keys of the returned associative
|
|
* array will be lower case. Otherwise, they will be cased as the LDAP server returns
|
|
* them.
|
|
* @param int $deref For aliases and referrals, this parameter specifies whether to
|
|
* follow references to the referenced DN or to fetch the attributes for
|
|
* the referencing DN. See http://php.net/ldap_search for the 4 valid
|
|
* options.
|
|
* @return array
|
|
* @see get_entry_system_attrs
|
|
* @see get_object_attr
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function get_object_attrs( $ldapserver, $dn, $lower_case_attr_names=false, $deref=LDAP_DEREF_NEVER ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_object_attrs(): Entered with (%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$dn,$lower_case_attr_names,$deref);
|
|
|
|
$search = @ldap_read( $ldapserver->connect(), $dn, '(objectClass=*)', array( ), 0, 0, 0, $deref );
|
|
if( ! $search )
|
|
return false;
|
|
|
|
$entry = ldap_first_entry( $ldapserver->connect(), $search );
|
|
if( ! $entry )
|
|
return false;
|
|
|
|
$attrs = ldap_get_attributes( $ldapserver->connect(), $entry );
|
|
if( ! $attrs || $attrs['count'] == 0 )
|
|
return false;
|
|
|
|
$num_attrs = $attrs['count'];
|
|
unset( $attrs['count'] );
|
|
|
|
// strip numerical inices
|
|
for( $i=0; $i<$num_attrs; $i++ )
|
|
unset( $attrs[$i] );
|
|
|
|
$return_array = array();
|
|
foreach( $attrs as $attr => $vals ) {
|
|
if( $lower_case_attr_names )
|
|
$attr = strtolower( $attr );
|
|
|
|
if( is_attr_binary( $ldapserver, $attr ) )
|
|
$vals = ldap_get_values_len( $ldapserver->connect(), $entry, $attr );
|
|
|
|
unset( $vals['count'] );
|
|
$return_array[ $attr ] = $vals;
|
|
}
|
|
|
|
ksort( $return_array );
|
|
return $return_array;
|
|
}
|
|
|
|
/**
|
|
* Returns true if the passed string $temp contains all printable
|
|
* ASCII characters. Otherwise (like if it contains binary data),
|
|
* returns false.
|
|
*/
|
|
function is_printable_str($temp) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_printable_str(): Entered with (%s)',2,$temp);
|
|
|
|
$len = strlen($temp);
|
|
|
|
for ($i=0; $i<$len; $i++) {
|
|
$ascii_val = ord( substr( $temp,$i,1 ) );
|
|
if( $ascii_val < 32 || $ascii_val > 126 )
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Much like get_object_attrs(), but only returns the values for
|
|
* one attribute of an object. Example calls:
|
|
*
|
|
* <code>
|
|
* print_r( get_object_attr( 0, "cn=Bob,ou=people,dc=example,dc=com", "sn" ) );
|
|
* // prints:
|
|
* // Array
|
|
* // (
|
|
* // [0] => "Smith"
|
|
* // )
|
|
*
|
|
* print_r( get_object_attr( 0, "cn=Bob,ou=people,dc=example,dc=com", "objectClass" ) );
|
|
* // prints:
|
|
* // Array
|
|
* // (
|
|
* // [0] => "top"
|
|
* // [1] => "person"
|
|
* // )
|
|
* </code>
|
|
*
|
|
* @param int $server_id The ID of the server of interest
|
|
* @param string $dn The distinguished name (DN) of the entry whose attributes/values to fetch.
|
|
* @param string $attr The attribute whose value(s) to return (ie, "objectClass", "cn", "userPassword")
|
|
* @param bool $lower_case_attr_names (optional) If true, all keys of the returned associative
|
|
* array will be lower case. Otherwise, they will be cased as the LDAP server returns
|
|
* them.
|
|
* @param int $deref For aliases and referrals, this parameter specifies whether to
|
|
* follow references to the referenced DN or to fetch the attributes for
|
|
* the referencing DN. See http://php.net/ldap_search for the 4 valid
|
|
* options.
|
|
* @see get_object_attrs
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function get_object_attr( $ldapserver, $dn, $attr, $lower_case_attr_names=false, $deref=LDAP_DEREF_NEVER ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_object_attr(): Entered with (%s,%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$dn,$attr,$lower_case_attr_names,$deref);
|
|
|
|
if ($lower_case_attr_names)
|
|
$attr = strtolower( $attr );
|
|
|
|
$attrs = get_object_attrs( $ldapserver, $dn, $lower_case_attr_names, $deref );
|
|
if( isset( $attrs[$attr] ) )
|
|
return $attrs[$attr];
|
|
else
|
|
return false;
|
|
|
|
//echo "get_object_attr( $server_id, $dn, $attr )<br />";
|
|
|
|
/*
|
|
$search = @ldap_read( $ldapesrver->connect(), $dn, '(objectClass=*)', array( $attr ), 0, 0, 0, $deref );
|
|
if( ! $search )
|
|
return false;
|
|
|
|
$entry = ldap_first_entry( $ldapesrver->connect(), $search );
|
|
if( ! $entry )
|
|
return false;
|
|
|
|
$attrs = ldap_get_attributes( $ldapesrver->connect(), $entry );
|
|
if( ! $attrs || $attrs['count'] == 0 )
|
|
return false;
|
|
|
|
if( is_attr_binary( $ldapserver, $attr ) )
|
|
$vals = ldap_get_values_len( $ldapesrver->connect(), $entry, $attr );
|
|
else
|
|
$vals = ldap_get_values( $ldapesrver->connect(), $entry, $attr );
|
|
unset( $vals['count'] );
|
|
return $vals;
|
|
*/
|
|
}
|
|
|
|
/**
|
|
* A handy ldap searching function very similar to PHP's ldap_search() with the
|
|
* following exceptions: Callers may specify a search scope and the return value
|
|
* is an array containing the search results rather than an LDAP result resource.
|
|
*
|
|
* Example usage:
|
|
* <code>
|
|
* $samba_users = ldap_search( 0, "(&(objectClass=sambaAccount)(objectClass=posixAccount))",
|
|
* "ou=People,dc=example,dc=com", array( "uid", "homeDirectory" ) );
|
|
* print_r( $samba_users );
|
|
* // prints (for example):
|
|
* // Array
|
|
* // (
|
|
* // [uid=jsmith,ou=People,dc=example,dc=com] => Array
|
|
* // (
|
|
* // [dn] => "uid=jsmith,ou=People,dc=example,dc=com"
|
|
* // [uid] => "jsmith"
|
|
* // [homeDirectory] => "\\server\jsmith"
|
|
* // )
|
|
* // [uid=byoung,ou=People,dc=example,dc=com] => Array
|
|
* // (
|
|
* // [dn] => "uid=byoung,ou=Samba,ou=People,dc=example,dc=com"
|
|
* // [uid] => "byoung"
|
|
* // [homeDirectory] => "\\server\byoung"
|
|
* // )
|
|
* // )
|
|
* </code>
|
|
*
|
|
* WARNING: This function will use a lot of memory on large searches since the entire result set is
|
|
* stored in a single array. For large searches, you should consider sing the less memory intensive
|
|
* PHP LDAP API directly (ldap_search(), ldap_next_entry(), ldap_next_attribute(), etc).
|
|
*
|
|
* @param int $server_id The ID of the server to search on.
|
|
* @param string $filter The LDAP filter to use when searching (example: "(objectClass=*)") (see RFC 2254)
|
|
* @param string $base_dn The DN of the base of search.
|
|
* @param array $attrs An array of attributes to include in the search result (example: array( "objectClass", "uid", "sn" )).
|
|
* @param string $scope The LDAP search scope. Must be one of "base", "one", or "sub". Standard LDAP search scope.
|
|
* @param bool $sort_results Specify false to not sort results by DN or true to have the
|
|
* returned array sorted by DN (uses ksort)
|
|
* @param int $deref When handling aliases or referrals, this specifies whether to follow referrals. Must be one of
|
|
* LDAP_DEREF_ALWAYS, LDAP_DEREF_NEVER, LDAP_DEREF_SEARCHING, or LDAP_DEREF_FINDING. See the PHP LDAP API for details.
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function pla_ldap_search( $ldapserver, $filter, $base_dn=null, $attrs=array(), $scope='sub', $sort_results=true, $deref=LDAP_DEREF_ALWAYS ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_ldap_search(): Entered with (%s,%s,%s,%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$filter,$base_dn,count($attrs),$scope,$sort_results,$deref);
|
|
|
|
if( is_null($base_dn)) {
|
|
foreach ($ldapserver->getBaseDN() as $baseDN) {
|
|
$base_dn = $baseDN;
|
|
break;
|
|
}
|
|
}
|
|
|
|
switch( $scope ) {
|
|
case 'base':
|
|
$search = @ldap_read( $ldapserver->connect(false), $base_dn, $filter, $attrs, 0, 0, 0, $deref );
|
|
break;
|
|
case 'one':
|
|
$search = @ldap_list( $ldapserver->connect(false), $base_dn, $filter, $attrs, 0, 0, 0, $defef );
|
|
break;
|
|
case 'sub':
|
|
default:
|
|
$search = @ldap_search( $ldapserver->connect(false), $base_dn, $filter, $attrs, 0, 0, 0, $deref );
|
|
break;
|
|
}
|
|
|
|
if( ! $search )
|
|
return array();
|
|
|
|
$return = array();
|
|
|
|
//get the first entry identifier
|
|
if( $entry_id = ldap_first_entry($ldapserver->connect(false),$search) )
|
|
|
|
//iterate over the entries
|
|
while($entry_id) {
|
|
|
|
//get the distinguished name of the entry
|
|
$dn = ldap_get_dn($ldapserver->connect(false),$entry_id);
|
|
|
|
//get the attributes of the entry
|
|
$attrs = ldap_get_attributes($ldapserver->connect(false),$entry_id);
|
|
$return[$dn]['dn'] = $dn;
|
|
|
|
//get the first attribute of the entry
|
|
if($attr = ldap_first_attribute($ldapserver->connect(false),$entry_id,$attrs))
|
|
|
|
//iterate over the attributes
|
|
while($attr) {
|
|
if( is_attr_binary($ldapserver,$attr))
|
|
$values = ldap_get_values_len($ldapserver->connect(false),$entry_id,$attr);
|
|
else
|
|
$values = ldap_get_values($ldapserver->connect(false),$entry_id,$attr);
|
|
|
|
//get the number of values for this attribute
|
|
$count = $values['count'];
|
|
unset($values['count']);
|
|
if($count==1)
|
|
$return[$dn][$attr] = $values[0];
|
|
else
|
|
$return[$dn][$attr] = $values;
|
|
|
|
$attr = ldap_next_attribute($ldapserver->connect(false),$entry_id,$attrs);
|
|
}// end while attr
|
|
|
|
$entry_id = ldap_next_entry($ldapserver->connect(false),$entry_id);
|
|
|
|
} // end while entry_id
|
|
|
|
if( $sort_results && is_array( $return ) )
|
|
ksort( $return );
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Reads the query, checks all values and sets defaults.
|
|
*
|
|
* @param int $query_id The ID of the predefined query.
|
|
* @return array The fixed query or null on error
|
|
* @todo Fix base_dn processing and use getBaseDN()
|
|
* @todo expand_dn_with_base no longer knows what the base_dn is, so you need to pass it the base, need to fix this function.
|
|
*/
|
|
function get_cleaned_up_predefined_search( $query_id ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_cleaned_up_predefined_search(): Entered with (%s)',2,$query_id);
|
|
|
|
global $ldapservers,$queries;
|
|
|
|
if( ! isset( $queries[$query_id] ) )
|
|
return null;
|
|
|
|
$query = $queries[$query_id];
|
|
|
|
if( isset( $query['server'] ) && ( is_numeric( $query['server'] ) ) )
|
|
$server_id = $query['server'];
|
|
else $server_id = 0;
|
|
|
|
$ldapserver = $ldapservers->Instance($server_id);
|
|
|
|
$base = ( isset( $query['base'] ) ) ? $query['base'] : null;
|
|
// Multiple base strings mean we can't do this properly
|
|
// Could just take the first entry or return an array rather than a string
|
|
// Ignore for now
|
|
// $base = expand_dn_with_base( $ldapserver, $base );
|
|
|
|
if( isset( $query['filter'] ) && strlen( trim( $query['filter'] ) ) > 0 )
|
|
$filter = $query['filter'];
|
|
else
|
|
$filter = 'objectclass=*';
|
|
|
|
$scope = isset( $query['scope'] )
|
|
&& ( in_array( $query['scope'], array( 'base', 'sub', 'one' ) ) )
|
|
? $query['scope'] : 'sub';
|
|
|
|
if( isset( $query['attributes'] ) && strlen( trim( $query['filter'] ) ) > 0 )
|
|
$attrib = $query['attributes'];
|
|
else
|
|
$attrib = "dn, cn, sn, objectClass";
|
|
|
|
return array (
|
|
'server' => $server_id, 'base' => $base,
|
|
'filter' => $filter, 'scope' => $scope, 'attributes' => $attrib );
|
|
}
|
|
|
|
/**
|
|
* Checks the specified server id for sanity. Ensures that the server is indeed in the configured
|
|
* list and active. This is used by many many scripts to ensure that valid server ID values
|
|
* are passed in POST and GET.
|
|
* @deprecated
|
|
*/
|
|
function check_server_id( $server_id ) {
|
|
global $ldapservers;
|
|
|
|
$ldapserver = $ldapservers->Instance($server_id);
|
|
if(! isset( $ldapserver->host ) || $ldapserver->host == '' )
|
|
return false;
|
|
else
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Used to generate a random salt for crypt-style passwords. Salt strings are used
|
|
* to make pre-built hash cracking dictionaries difficult to use as the hash algorithm uses
|
|
* not only the user's password but also a randomly generated string. The string is
|
|
* stored as the first N characters of the hash for reference of hashing algorithms later.
|
|
*
|
|
* --- added 20021125 by bayu irawan <bayuir@divnet.telkom.co.id> ---
|
|
* --- ammended 20030625 by S C Rigler <srigler@houston.rr.com> ---
|
|
*
|
|
* @param int $length The length of the salt string to generate.
|
|
* @return string The generated salt string.
|
|
*/
|
|
function random_salt( $length ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('random_salt(): Entered with (%s)',2,$length);
|
|
|
|
$possible = '0123456789'.
|
|
'abcdefghijklmnopqrstuvwxyz'.
|
|
'ABCDEFGHIJKLMNOPQRSTUVWXYZ'.
|
|
'./';
|
|
$str = "";
|
|
mt_srand((double)microtime() * 1000000);
|
|
|
|
while( strlen( $str ) < $length )
|
|
$str .= substr( $possible, ( rand() % strlen( $possible ) ), 1 );
|
|
|
|
/**
|
|
* Commented out following line because of problem
|
|
* with crypt function in update.php
|
|
* --- 20030625 by S C Rigler <srigler@houston.rr.com> ---
|
|
*/
|
|
//$str = "\$1\$".$str."\$";
|
|
return $str;
|
|
}
|
|
|
|
/**
|
|
* Given a DN string, this returns the 'RDN' portion of the string.
|
|
* For example. given 'cn=Manager,dc=example,dc=com', this function returns
|
|
* 'cn=Manager' (it is really the exact opposite of get_container()).
|
|
*
|
|
* @param string $dn The DN whose RDN to return.
|
|
* @param bool $include_attrs If true, include attributes in the RDN string.
|
|
* See http://php.net/ldap_explode_dn for details
|
|
*
|
|
* @return string The RDN
|
|
* @see get_container
|
|
*/
|
|
function get_rdn( $dn, $include_attrs=0 ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_rdn(): Entered with (%s,%s)',2,$dn,$include_attrs);
|
|
|
|
if( $dn == null )
|
|
return null;
|
|
$rdn = pla_explode_dn( $dn, $include_attrs );
|
|
if( 0 == count($rdn) )
|
|
return $dn;
|
|
if( ! isset( $rdn[0] ) )
|
|
return $dn;
|
|
$rdn = $rdn[0];
|
|
return $rdn;
|
|
}
|
|
|
|
/**
|
|
* Given a DN string, this returns the parent container portion of the string.
|
|
* For example. given 'cn=Manager,dc=example,dc=com', this function returns
|
|
* 'dc=example,dc=com'.
|
|
*
|
|
* @param string $dn The DN whose container string to return.
|
|
*
|
|
* @return string The container
|
|
* @see get_rdn
|
|
*/
|
|
function get_container( $dn ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_container(): Entered with (%s)',2,$dn);
|
|
|
|
$parts = pla_explode_dn( $dn );
|
|
if( count( $parts ) <= 1 )
|
|
return null;
|
|
$container = $parts[1];
|
|
for( $i=2; $i<count($parts); $i++ )
|
|
$container .= ',' . $parts[$i];
|
|
return $container;
|
|
}
|
|
|
|
/**
|
|
* Given a DN string, this returns the top container portion of the string.
|
|
* @param object $ldapserver The LDAPserver being used.
|
|
* @param string $dn The DN whose container string to return.
|
|
* @return string The container
|
|
* @see get_rdn
|
|
* @see get_container
|
|
* @todo: need to fix this, it should just produce the base_dn for the DN entered, not the top .
|
|
*/
|
|
function get_container_top($ldapserver,$dn) {
|
|
# First determine which base this DN belongs to.
|
|
foreach ($ldapserver->getBaseDN() as $base_dn) {
|
|
if (preg_match("/${base_dn}$/",$dn)) {
|
|
$return = $base_dn;
|
|
break;
|
|
}
|
|
}
|
|
|
|
debug_log(sprintf('get_container_top(): Entered with (%s), Returning (%s)',$dn,$return),1);
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Given a DN string and a path like syntax, this returns the parent container portion of the string.
|
|
* @param object $ldapserver The LDAPserver being used.
|
|
* @param string $dn The DN whose container string to return.
|
|
* @param string $path Either '/', '.' or a series of '../'
|
|
* @return string The container
|
|
* @see get_rdn
|
|
* @see get_container
|
|
*/
|
|
function get_container_parent($ldapserver,$container,$path) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_container_parent(): Entered with (%s,%s)',2,$container,$path);
|
|
|
|
$top = get_container_top($ldapserver,$container);
|
|
|
|
if ($path == '/') {
|
|
return $top;
|
|
|
|
} elseif ($path == '.') {
|
|
return $container;
|
|
|
|
} else {
|
|
$parenttree = explode('/',$path);
|
|
|
|
foreach ($parenttree as $index => $value) {
|
|
if ($value == '..') {
|
|
if (get_container($container))
|
|
$container = get_container($container);
|
|
|
|
if ($container == $top)
|
|
break;
|
|
|
|
} else {
|
|
break;
|
|
}
|
|
}
|
|
|
|
return $container;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Given an LDAP error number, returns a verbose description of the error.
|
|
* This function parses ldap_error_codes.txt and looks up the specified
|
|
* ldap error number, and returns the verbose message defined in that file.
|
|
*
|
|
* @param string $err_no The hex error number (ie, "0x42") of the LDAP error of interest.
|
|
* @return array An associative array contianing the error title and description like so:
|
|
* <code>
|
|
* Array
|
|
* (
|
|
* [title] => "Invalid Credentials"
|
|
* [description] => "An invalid username and/or password was supplied to the LDAP server."
|
|
* )
|
|
* </code>
|
|
*/
|
|
function pla_verbose_error( $err_no ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_verbose_error(): Entered with (%s)',2,$err_no);
|
|
|
|
static $err_codes;
|
|
|
|
if( count($err_codes) <= 0 ) {
|
|
$err_codes_file = LIBDIR.'ldap_error_codes.txt';
|
|
|
|
if (! file_exists($err_codes_file) || ! is_readable($err_codes_file) || ! ($f = fopen($err_codes_file,'r')))
|
|
return false;
|
|
|
|
$contents = fread( $f, filesize( $err_codes_file ) );
|
|
fclose( $f );
|
|
$entries = array();
|
|
preg_match_all( "/0x[A-Fa-f0-9][A-Za-z0-9]\s+[0-9A-Za-z_]+\s+\"[^\"]*\"\n/",
|
|
$contents, $entries );
|
|
$err_codes = array();
|
|
foreach( $entries[0] as $e ) {
|
|
$entry = array();
|
|
preg_match( "/(0x[A-Za-z0-9][A-Za-z0-9])\s+([0-9A-Za-z_]+)\s+\"([^\"]*)\"/", $e, $entry );
|
|
$hex_code = isset( $entry[1] ) ? $entry[1] : null;
|
|
$title = isset( $entry[2] ) ? $entry[2] : null;
|
|
$desc = isset( $entry[3] ) ? $entry[3] : null;
|
|
$desc = preg_replace( "/\s+/", " ", $desc );
|
|
$err_codes[ "$hex_code" ] = array( 'title' => $title, 'desc' => $desc );
|
|
}
|
|
}
|
|
|
|
if( isset( $err_codes[ $err_no ] ) )
|
|
return $err_codes[ $err_no ];
|
|
else
|
|
return array( 'title' => null, 'desc' => null );
|
|
}
|
|
|
|
// @todo: describe this function
|
|
function support_oid_to_text($oid_id) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('support_oid_to_text(): Entered with (%s)',2,$oid_id);
|
|
|
|
static $oid;
|
|
|
|
if( count($oid) <= 0 ) {
|
|
$oid_codes_file = LIBDIR.'ldap_supported_oids.txt';
|
|
|
|
if(! file_exists($oid_codes_file) || ! is_readable($oid_codes_file) || ! ($f = fopen($oid_codes_file,'r')))
|
|
return false;
|
|
|
|
$contents = fread( $f, filesize( $oid_codes_file ) );
|
|
fclose( $f );
|
|
$entries = array();
|
|
preg_match_all( "/[0-9]\..+\s+\"[^\"]*\"\n/", $contents, $entries );
|
|
$err_codes = array();
|
|
foreach( $entries[0] as $e ) {
|
|
$entry = array();
|
|
preg_match( "/([0-9]\.([0-9]+\.)*[0-9]+)(\s+\"([^\"]*)\")?(\s+\"([^\"]*)\")?(\s+\"([^\"]*)\")?/", $e, $entry );
|
|
$oid_id_a = isset( $entry[1] ) ? $entry[1] : null;
|
|
|
|
if ($oid_id_a) {
|
|
$oid[$oid_id_a]['title'] = isset( $entry[4] ) ? $entry[4] : null;
|
|
$oid[$oid_id_a]['ref'] = isset( $entry[6] ) ? $entry[6] : null;
|
|
$desc = isset( $entry[8] ) ? $entry[8] : null;
|
|
$oid[$oid_id_a]['desc'] = preg_replace( "/\s+/", " ", $desc );
|
|
}
|
|
}
|
|
}
|
|
|
|
if( isset( $oid[ $oid_id ] ) )
|
|
return $oid[ $oid_id ];
|
|
else
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Prints an HTML-formatted error string. If you specify the optional
|
|
* parameters $ldap_err_msg and $ldap_err_no, this function will
|
|
* lookup the error number and display a verbose message in addition
|
|
* to the message you pass it.
|
|
*
|
|
* @param string $msg The error message to display.
|
|
* @param string $ldap_err_msg (optional) The error message supplied by the LDAP server
|
|
* @param string $ldap_err_no (optional) The hexadecimal error number string supplied by the LDAP server
|
|
* @param bool $fatal (optional) If true, phpLDAPadmin will terminate execution with the PHP die() function.
|
|
*
|
|
* @see die
|
|
* @see ldap_errno
|
|
* @see pla_verbose_error
|
|
*/
|
|
function pla_error( $msg, $ldap_err_msg=null, $ldap_err_no=-1, $fatal=true ) {
|
|
if (defined('DEBUG_ENABLED') && (DEBUG_ENABLED))
|
|
debug_log('pla_error(): Entered with (%s,%s,%s,%s)',2,$msg,$ldap_err_msg,$ldap_err_no,$fatal);
|
|
|
|
@include_once HTDOCDIR.'header.php';
|
|
global $lang, $config;
|
|
|
|
?>
|
|
<center>
|
|
<table class="error"><tr><td class="img"><img src="images/warning.png" /></td>
|
|
<td><center><h2><?php echo $lang['ferror_error'];?></h2></center>
|
|
<?php echo $msg; ?>
|
|
<br />
|
|
<br />
|
|
<?php
|
|
|
|
if (function_exists('syslog_err'))
|
|
syslog_err($msg);
|
|
|
|
if( $ldap_err_msg ) {
|
|
echo sprintf($lang['ldap_said'], htmlspecialchars( $ldap_err_msg ));
|
|
echo '<br />';
|
|
}
|
|
|
|
if( $ldap_err_no != -1 ) {
|
|
$ldap_err_no = ( '0x' . str_pad( dechex( $ldap_err_no ), 2, 0, STR_PAD_LEFT ) );
|
|
$verbose_error = pla_verbose_error( $ldap_err_no );
|
|
|
|
if( $verbose_error ) {
|
|
echo sprintf( $lang['ferror_number'], $ldap_err_no, $verbose_error['title']);
|
|
echo '<br />';
|
|
echo sprintf( $lang['ferror_discription'], $verbose_error['desc']);
|
|
} else {
|
|
echo sprintf($lang['ferror_number_short'], $ldap_err_no);
|
|
echo '<br />';
|
|
echo $lang['ferror_discription_short'];
|
|
}
|
|
|
|
if (function_exists('syslog_err'))
|
|
syslog_err(sprintf($lang['ferror_number_short'],$ldap_err_no));
|
|
}
|
|
?>
|
|
<br />
|
|
<!-- Commented out due to too many false bug reports. :)
|
|
<br />
|
|
<center>
|
|
<small>
|
|
<?php echo sprintf($lang['ferror_submit_bug'] , get_href( 'add_bug' ));?>
|
|
<?php
|
|
if( function_exists( "debug_print_backtrace" ) )
|
|
debug_print_backtrace();
|
|
?>
|
|
</small>
|
|
</center>
|
|
-->
|
|
</td></tr></table>
|
|
</center>
|
|
<?php
|
|
|
|
if( $fatal ) {
|
|
echo "</body>\n</html>";
|
|
die();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* phpLDAPadmin's custom error handling function. When a PHP error occurs,
|
|
* PHP will call this function rather than printing the typical PHP error string.
|
|
* This provides phpLDAPadmin the ability to format an error message more "pretty"
|
|
* and provide a link for users to submit a bug report. This function is not to
|
|
* be called by users. It is exclusively for the use of PHP internally. If this
|
|
* function is called by PHP from within a context where error handling has been
|
|
* disabled (ie, from within a function called with "@" prepended), then this
|
|
* function does nothing.
|
|
*
|
|
* @param int $errno The PHP error number that occurred (ie, E_ERROR, E_WARNING, E_PARSE, etc).
|
|
* @param string $errstr The PHP error string provided (ie, "Warning index "foo" is undefined)
|
|
* @param string $file The file in which the PHP error ocurred.
|
|
* @param int $lineno The line number on which the PHP error ocurred
|
|
*
|
|
* @see set_error_handler
|
|
*/
|
|
function pla_error_handler( $errno, $errstr, $file, $lineno ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_error_handler(): Entered with (%s,%s,%s,%s)',2,$errno,$errstr,$file,$lineno);
|
|
|
|
global $lang;
|
|
|
|
// error_reporting will be 0 if the error context occurred
|
|
// within a function call with '@' preprended (ie, @ldap_bind() );
|
|
// So, don't report errors if the caller has specifically
|
|
// disabled them with '@'
|
|
if( 0 == ini_get( 'error_reporting' ) || 0 == error_reporting() )
|
|
return;
|
|
|
|
$file = basename( $file );
|
|
$caller = basename( $_SERVER['PHP_SELF'] );
|
|
$errtype = "";
|
|
switch( $errno ) {
|
|
case E_STRICT: $errtype = "E_STRICT"; break;
|
|
case E_ERROR: $errtype = "E_ERROR"; break;
|
|
case E_WARNING: $errtype = "E_WARNING"; break;
|
|
case E_PARSE: $errtype = "E_PARSE"; break;
|
|
case E_NOTICE: $errtype = "E_NOTICE"; break;
|
|
case E_CORE_ERROR: $errtype = "E_CORE_ERROR"; break;
|
|
case E_CORE_WARNING: $errtype = "E_CORE_WARNING"; break;
|
|
case E_COMPILE_ERROR: $errtype = "E_COMPILE_ERROR"; break;
|
|
case E_COMPILE_WARNING: $errtype = "E_COMPILE_WARNING"; break;
|
|
case E_USER_ERROR: $errtype = "E_USER_ERROR"; break;
|
|
case E_USER_WARNING: $errtype = "E_USER_WARNING"; break;
|
|
case E_USER_NOTICE: $errtype = "E_USER_NOTICE"; break;
|
|
case E_ALL: $errtype = "E_ALL"; break;
|
|
default: $errtype = $lang['ferror_unrecognized_num'] . $errno;
|
|
}
|
|
|
|
$errstr = preg_replace("/\s+/"," ",$errstr);
|
|
if( $errno == E_NOTICE ) {
|
|
echo sprintf($lang['ferror_nonfatil_bug'], $errstr, $errtype, $file,
|
|
$lineno, $caller, pla_version(), phpversion(), php_sapi_name(),
|
|
$_SERVER['SERVER_SOFTWARE'], get_href('search_bug',"&summary_keyword=".htmlspecialchars($errstr)),get_href('add_bug'));
|
|
return;
|
|
}
|
|
|
|
$server = isset( $_SERVER['SERVER_SOFTWARE'] ) ? $_SERVER['SERVER_SOFTWARE'] : 'undefined';
|
|
$phpself = isset( $_SERVER['PHP_SELF'] ) ? basename( $_SERVER['PHP_SELF'] ) : 'undefined';
|
|
pla_error( sprintf($lang['ferror_congrats_found_bug'], $errstr, $errtype, $file,
|
|
$lineno, $phpself, pla_version(),
|
|
phpversion(), php_sapi_name(), $server ));
|
|
}
|
|
|
|
/**
|
|
* Reads the friendly_attrs array as defined in config.php and lower-cases all
|
|
* the keys. Will return an empty array if the friendly_attrs array is not defined
|
|
* in config.php. This is simply used so we can more easily lookup user-friendly
|
|
* attributes configured by the admin.
|
|
*/
|
|
function process_friendly_attr_table() {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('process_friendly_attr_table(): Entered with ()',2);
|
|
|
|
// require 'config.php';
|
|
global $friendly_attrs;
|
|
$attrs_table = array();
|
|
if( isset( $friendly_attrs ) && is_array( $friendly_attrs ) )
|
|
foreach( $friendly_attrs as $old_name => $new_name )
|
|
$attrs_table[ strtolower( $old_name ) ] = $new_name;
|
|
else
|
|
return array();
|
|
|
|
return $attrs_table;
|
|
}
|
|
|
|
/**
|
|
* Show friendly attribute.
|
|
*/
|
|
function show_friendly_attribute($attr) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('show_friendly_attribute(): Entered with (%s)',2,$attr);
|
|
|
|
$friendly_attrs = process_friendly_attr_table();
|
|
|
|
if (isset($friendly_attrs[strtolower($attr)]))
|
|
$return = $friendly_attrs[strtolower($attr)];
|
|
else
|
|
$return = $attr;
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('show_friendly_attribute(): Returning (%s)',1,$return);
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Gets whether an entry exists based on its DN. If the entry exists,
|
|
* returns true. Otherwise returns false.
|
|
*
|
|
* @param object $ldapserver The LDAP Server Object of interest
|
|
* @param string $dn The DN\of the entry of interest.
|
|
*
|
|
* @return bool
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function dn_exists($ldapserver,$dn) {
|
|
# Set default return
|
|
$return = false;
|
|
|
|
$search_result = @ldap_read($ldapserver->connect(false),$dn,'objectClass=*',array('dn'));
|
|
|
|
if ($search_result) {
|
|
$num_entries = ldap_count_entries($ldapserver->connect(false),$search_result);
|
|
|
|
if ($num_entries > 0)
|
|
$return = true;
|
|
else
|
|
$return = false;
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('dn_exists(): Entered with (%s,%s), Returning (%s)',1,$ldapserver->server_id,$dn,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Draw the jpegPhoto image(s) for an entry wrapped in HTML. Many options are available to
|
|
* specify how the images are to be displayed.
|
|
*
|
|
* Usage Examples:
|
|
* <code>
|
|
* draw_jpeg_photos( 0, "cn=Bob,ou=People,dc=example,dc=com", "jpegPhoto" true, false, "border: 1px; width: 150px" );
|
|
* draw_jpeg_photos( 1, "cn=Fred,ou=People,dc=example,dc=com" );
|
|
* </code>
|
|
*
|
|
* @param int $server_id The ID of the server of interest.
|
|
* @param string $dn The DN of the entry that contains the jpeg attribute you want to draw.
|
|
* @param string $attr_name The name of the attribute containing the jpeg data (usually 'jpegPhoto').
|
|
* @param bool $draw_delete_buttons If true, draws a button beneath the image titled 'Delete' allowing the user
|
|
* to delete the jpeg attribute by calling JavaScript function deleteAttribute() provided
|
|
* in the default modification template.
|
|
* @param bool $draw_bytes_and_size If true, draw text below the image indicating the byte size and dimensions.
|
|
* @param string $table_html_attrs Specifies optional CSS style attributes for the table tag.
|
|
*
|
|
* @return void
|
|
*/
|
|
function draw_jpeg_photos( $ldapserver, $dn, $attr_name='jpegPhoto', $draw_delete_buttons=false,
|
|
$draw_bytes_and_size=true, $table_html_attrs='align="left"', $img_html_attrs='' ) {
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('draw_jpeg_photos(): Entered with (%s,%s,%s,%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$dn,$attr_name,$draw_delete_buttons,
|
|
$draw_bytes_and_size,$table_html_attrs,$img_html_attrs);
|
|
|
|
global $config, $lang;
|
|
|
|
$fixed_width = false;
|
|
$fixed_height = false;
|
|
if (eregi(" width",$img_html_attrs) || eregi("^width",$img_html_attrs))
|
|
$fixed_width = true;
|
|
if (eregi(" height=",$img_html_attrs) || eregi("^height=",$img_html_attrs))
|
|
$fixed_height = true;
|
|
|
|
$search_result = ldap_read( $ldapserver->connect(), $dn, 'objectClass=*', array( $attr_name ) );
|
|
$entry = ldap_first_entry( $ldapserver->connect(), $search_result );
|
|
|
|
if (isset($table_html_attrs) && $table_html_attrs != "" )
|
|
echo "<table $table_html_attrs><td><center>\n\n";
|
|
|
|
// for each jpegPhoto in the entry, draw it (there may be only one, and that's okay)
|
|
$jpeg_data = @ldap_get_values_len( $ldapserver->connect(), $entry, $attr_name );
|
|
if( ! is_array( $jpeg_data ) ) {
|
|
printf( $lang['jpeg_unable_toget'], htmlspecialchars( $attr_name ));
|
|
return;
|
|
}
|
|
|
|
for( $i=0; $i<$jpeg_data['count']; $i++ ) {
|
|
// ensures that the photo is written to the specified jpeg['tmpdir']
|
|
$jpeg_temp_dir = realpath($config->GetValue('jpeg','tmpdir').'/');
|
|
if( ! is_writable( $jpeg_temp_dir ) )
|
|
pla_error( $lang['jpeg_dir_not_writable'] );
|
|
|
|
$jpeg_filename = tempnam($jpeg_temp_dir.'/', 'pla');
|
|
$outjpeg = @fopen($jpeg_filename, "wb");
|
|
if( ! $outjpeg )
|
|
pla_error( sprintf( $lang['jpeg_dir_not_writable_error'],$jpeg_temp_dir ));
|
|
fwrite($outjpeg, $jpeg_data[$i]);
|
|
fclose ($outjpeg);
|
|
|
|
$jpeg_data_size = filesize( $jpeg_filename );
|
|
if( $jpeg_data_size < 6 && $draw_delete_buttons ) {
|
|
echo $lang['jpeg_contains_errors'];
|
|
echo '<a href="javascript:deleteAttribute( \'' . $attr_name . '\' );" style="color:red; font-size: 75%">'. $lang['delete_photo'] .'</a>';
|
|
continue;
|
|
}
|
|
|
|
if( function_exists( 'getimagesize' ) ) {
|
|
$jpeg_dimensions = @getimagesize( $jpeg_filename );
|
|
$width = $jpeg_dimensions[0];
|
|
$height = $jpeg_dimensions[1];
|
|
|
|
} else {
|
|
$width = 0;
|
|
$height = 0;
|
|
}
|
|
|
|
if( $width > 300 ) {
|
|
$scale_factor = 300 / $width;
|
|
$img_width = 300;
|
|
$img_height = $height * $scale_factor;
|
|
|
|
} else {
|
|
$img_width = $width;
|
|
$img_height = $height;
|
|
}
|
|
|
|
print "<img ".
|
|
($fixed_width ? '' : "width=\"$img_width\" ").
|
|
($fixed_height ? '' : "height=\"$img_height\" ").
|
|
" $img_html_attrs src=\"view_jpeg_photo.php?file=" . basename($jpeg_filename) . "\" /><br />\n";
|
|
|
|
if( $draw_bytes_and_size ) {
|
|
echo "<small>" . number_format($jpeg_data_size) . " bytes. ";
|
|
echo "$width x $height pixels.<br /></small>\n\n";
|
|
}
|
|
|
|
if( $draw_delete_buttons ) { ?>
|
|
<!-- JavaScript function deleteJpegPhoto() to be defined later by calling script -->
|
|
<a href="javascript:deleteAttribute( '<?php echo $attr_name; ?>' );" style="color:red; font-size: 75%"><?php echo $lang['jpeg_delete'] ?></a>
|
|
<?php }
|
|
}
|
|
|
|
if (isset($table_html_attrs) && $table_html_attrs != "" )
|
|
echo "</center></td></table>\n\n";
|
|
|
|
// delete old jpeg files.
|
|
$jpegtmp_wildcard = "/^pla/";
|
|
$handle = opendir($jpeg_temp_dir);
|
|
while( ($file = readdir($handle) ) != false ) {
|
|
if( preg_match( $jpegtmp_wildcard, $file ) ) {
|
|
$file = "$jpeg_temp_dir/$file";
|
|
if ((time() - filemtime($file)) > $config->GetValue('jpeg','tmp_keep_time'))
|
|
@unlink( $file );
|
|
}
|
|
}
|
|
closedir($handle);
|
|
}
|
|
|
|
/**
|
|
* Hashes a password and returns the hash based on the specified enc_type.
|
|
*
|
|
* @param string $password_clear The password to hash in clear text.
|
|
* @param string $enc_type Standard LDAP encryption type which must be one of
|
|
* crypt, ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, or clear.
|
|
* @return string The hashed password.
|
|
*/
|
|
function password_hash( $password_clear, $enc_type ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('password_hash(): Entered with (%s,%s)',2,$password_clear,$enc_type);
|
|
|
|
global $lang;
|
|
|
|
$enc_type = strtolower( $enc_type );
|
|
|
|
switch( $enc_type ) {
|
|
case 'crypt':
|
|
$new_value = '{CRYPT}' . crypt( $password_clear, random_salt(2) );
|
|
break;
|
|
|
|
case 'ext_des':
|
|
// extended des crypt. see OpenBSD crypt man page.
|
|
if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 )
|
|
pla_error( $lang['install_not_support_ext_des'] );
|
|
|
|
$new_value = '{CRYPT}' . crypt( $password_clear, '_' . random_salt(8) );
|
|
break;
|
|
|
|
case 'md5crypt':
|
|
if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 )
|
|
pla_error( $lang['install_not_support_md5crypt'] );
|
|
|
|
$new_value = '{CRYPT}' . crypt( $password_clear , '$1$' . random_salt(9) );
|
|
break;
|
|
|
|
case 'blowfish':
|
|
if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 )
|
|
pla_error( $lang['install_not_support_blowfish'] );
|
|
|
|
// hardcoded to second blowfish version and set number of rounds
|
|
$new_value = '{CRYPT}' . crypt( $password_clear , '$2a$12$' . random_salt(13) );
|
|
break;
|
|
|
|
case 'md5':
|
|
$new_value = '{MD5}' . base64_encode( pack( 'H*' , md5( $password_clear) ) );
|
|
break;
|
|
|
|
case 'sha':
|
|
if( function_exists('sha1') ) {
|
|
// use php 4.3.0+ sha1 function, if it is available.
|
|
$new_value = '{SHA}' . base64_encode( pack( 'H*' , sha1( $password_clear) ) );
|
|
|
|
} elseif( function_exists( 'mhash' ) ) {
|
|
$new_value = '{SHA}' . base64_encode( mhash( MHASH_SHA1, $password_clear) );
|
|
|
|
} else {
|
|
pla_error( $lang['install_no_mash'] );
|
|
}
|
|
break;
|
|
|
|
case 'ssha':
|
|
if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) ) {
|
|
mt_srand( (double) microtime() * 1000000 );
|
|
$salt = mhash_keygen_s2k( MHASH_SHA1, $password_clear, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
|
|
$new_value = "{SSHA}".base64_encode( mhash( MHASH_SHA1, $password_clear.$salt ).$salt );
|
|
|
|
} else {
|
|
pla_error( $lang['install_no_mash'] );
|
|
}
|
|
break;
|
|
|
|
case 'smd5':
|
|
if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) ) {
|
|
mt_srand( (double) microtime() * 1000000 );
|
|
$salt = mhash_keygen_s2k( MHASH_MD5, $password_clear, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
|
|
$new_value = "{SMD5}".base64_encode( mhash( MHASH_MD5, $password_clear.$salt ).$salt );
|
|
|
|
} else {
|
|
pla_error( $lang['install_no_mash'] );
|
|
}
|
|
break;
|
|
|
|
case 'clear':
|
|
default:
|
|
$new_value = $password_clear;
|
|
}
|
|
|
|
return $new_value;
|
|
}
|
|
|
|
/**
|
|
* Given a clear-text password and a hash, this function determines if the clear-text password
|
|
* is the password that was used to generate the hash. This is handy to verify a user's password
|
|
* when all that is given is the hash and a "guess".
|
|
* @param String $hash The hash.
|
|
* @param String $clear The password in clear text to test.
|
|
* @return Boolean True if the clear password matches the hash, and false otherwise.
|
|
*/
|
|
function password_check( $cryptedpassword, $plainpassword ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('password_check(): Entered with (%s,%s)',2,$cryptedpassword,$plainpassword);
|
|
|
|
global $lang;
|
|
|
|
//echo "password_check( $cryptedpassword, $plainpassword )\n";
|
|
if( preg_match( "/{([^}]+)}(.*)/", $cryptedpassword, $cypher ) ) {
|
|
$cryptedpassword = $cypher[2];
|
|
$_cypher = strtolower($cypher[1]);
|
|
|
|
} else {
|
|
$_cypher = NULL;
|
|
}
|
|
|
|
switch( $_cypher ) {
|
|
// SSHA crypted passwords
|
|
case 'ssha':
|
|
// check php mhash support before using it
|
|
if( function_exists( 'mhash' ) ) {
|
|
$hash = base64_decode($cryptedpassword);
|
|
$salt = substr($hash, -4);
|
|
$new_hash = base64_encode( mhash( MHASH_SHA1, $plainpassword.$salt).$salt );
|
|
|
|
if( strcmp( $cryptedpassword, $new_hash ) == 0 )
|
|
return true;
|
|
else
|
|
return false;
|
|
|
|
} else {
|
|
pla_error( $lang['install_no_mash'] );
|
|
}
|
|
break;
|
|
|
|
// Salted MD5
|
|
case 'smd5':
|
|
// check php mhash support before using it
|
|
if( function_exists( 'mhash' ) ) {
|
|
$hash = base64_decode($cryptedpassword);
|
|
$salt = substr($hash, -4);
|
|
$new_hash = base64_encode( mhash( MHASH_MD5, $plainpassword.$salt).$salt );
|
|
|
|
if( strcmp( $cryptedpassword, $new_hash ) == 0)
|
|
return true;
|
|
else
|
|
return false;
|
|
|
|
} else {
|
|
pla_error( $lang['install_no_mash'] );
|
|
}
|
|
break;
|
|
|
|
// SHA crypted passwords
|
|
case 'sha':
|
|
if( strcasecmp( password_hash($plainpassword,'sha' ), "{SHA}".$cryptedpassword ) == 0 )
|
|
return true;
|
|
else
|
|
return false;
|
|
break;
|
|
|
|
// MD5 crypted passwords
|
|
case 'md5':
|
|
if( strcasecmp( password_hash( $plainpassword,'md5' ), "{MD5}".$cryptedpassword ) == 0 )
|
|
return true;
|
|
else
|
|
return false;
|
|
break;
|
|
|
|
// Crypt passwords
|
|
case 'crypt':
|
|
// Check if it's blowfish crypt
|
|
if( preg_match("/^\\$2+/",$cryptedpassword ) ) {
|
|
|
|
// make sure that web server supports blowfish crypt
|
|
if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 )
|
|
pla_error( $lang['install_not_support_blowfish'] );
|
|
|
|
list(,$version,$rounds,$salt_hash) = explode('$',$cryptedpassword);
|
|
|
|
if( crypt( $plainpassword, '$'. $version . '$' . $rounds . '$' .$salt_hash ) == $cryptedpassword )
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
// Check if it's an crypted md5
|
|
elseif( strstr( $cryptedpassword, '$1$' ) ) {
|
|
|
|
// make sure that web server supports md5 crypt
|
|
if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 )
|
|
pla_error( $lang['install_not_support_md5crypt'] );
|
|
|
|
list(,$type,$salt,$hash) = explode('$',$cryptedpassword);
|
|
|
|
if( crypt( $plainpassword, '$1$' .$salt ) == $cryptedpassword )
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
// Check if it's extended des crypt
|
|
elseif (strstr( $cryptedpassword, '_' ) ) {
|
|
|
|
// make sure that web server supports ext_des
|
|
if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 )
|
|
pla_error( $lang['install_not_support_ext_des'] );
|
|
|
|
if( crypt($plainpassword, $cryptedpassword ) == $cryptedpassword )
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
// Password is plain crypt
|
|
else {
|
|
|
|
if( crypt($plainpassword, $cryptedpassword ) == $cryptedpassword )
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
break;
|
|
|
|
// No crypt is given assume plaintext passwords are used
|
|
default:
|
|
if( $plainpassword == $cryptedpassword )
|
|
return true;
|
|
else
|
|
return false;
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Detects password encryption type
|
|
*
|
|
* Returns crypto string listed in braces. If it is 'crypt' password,
|
|
* returns crypto detected in password hash. Function should detect
|
|
* md5crypt, blowfish and extended DES crypt. If function fails to detect
|
|
* encryption type, it returns NULL.
|
|
* @param string hashed password
|
|
* @return string
|
|
*/
|
|
function get_enc_type( $user_password ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_enc_type(): Entered with (%s)',2,$user_password);
|
|
|
|
/* Capture the stuff in the { } to determine if this is crypt, md5, etc. */
|
|
$enc_type = null;
|
|
|
|
if( preg_match( "/{([^}]+)}/", $user_password, $enc_type) )
|
|
$enc_type = strtolower( $enc_type[1] );
|
|
else
|
|
return null;
|
|
|
|
/* handle crypt types */
|
|
if( strcasecmp( $enc_type, 'crypt') == 0 ) {
|
|
|
|
if( preg_match( "/{[^}]+}\\$1\\$+/", $user_password) ) {
|
|
$enc_type = "md5crypt";
|
|
|
|
} elseif ( preg_match( "/{[^}]+}\\$2+/", $user_password) ) {
|
|
$enc_type = "blowfish";
|
|
|
|
} elseif ( preg_match( "/{[^}]+}_+/", $user_password) ) {
|
|
$enc_type = "ext_des";
|
|
}
|
|
|
|
/*
|
|
* No need to check for standard crypt,
|
|
* because enc_type is already equal to 'crypt'.
|
|
*/
|
|
}
|
|
return $enc_type;
|
|
}
|
|
|
|
/**
|
|
* Gets the default enc_type configured in config.php for the server indicated by $server_id;
|
|
* @param int $server_id The ID of the server of interest.
|
|
* @return String The enc_type, like 'sha', 'md5', 'ssha', 'md5crypt', for example.
|
|
*/
|
|
function get_default_hash($server_id) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_default_hash(): Entered with (%s)',2,$server_id);
|
|
|
|
global $ldapservers;
|
|
return $ldapservers->GetValue($server_id,'appearance','password_hash');
|
|
}
|
|
|
|
/**
|
|
* Returns the phpLDAPadmin version currently running. The version
|
|
* is read from the file named VERSION.
|
|
*
|
|
* @return string The current version as read from the VERSION file.
|
|
*/
|
|
function pla_version() {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_version(): Entered with ()',2);
|
|
|
|
$version_file = realpath('../VERSION');
|
|
if (! file_exists($version_file))
|
|
return 'unknown version';
|
|
|
|
$f = fopen($version_file,'r');
|
|
$version = fread($f, filesize($version_file));
|
|
fclose($f);
|
|
return trim($version);
|
|
}
|
|
|
|
/**
|
|
* Draws an HTML browse button which, when clicked, pops up a DN chooser dialog.
|
|
* @param string $form_element The name of the form element to which this chooser
|
|
* dialog will publish the user's choice. The form element must be a member
|
|
* of a form with the "name" or "id" attribute set in the form tag, and the element
|
|
* must also define "name" or "id" for JavaScript to uniquely identify it.
|
|
* Example $form_element values may include "creation_form.container" or
|
|
* "edit_form.member_uid". See /templates/modification/default.php for example usage.
|
|
* @param bool $include_choose_text (optional) If true, the function draws the localized text "choose" to the right of the button.
|
|
*/
|
|
function draw_chooser_link( $form_element, $include_choose_text=true, $rdn="none" ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('draw_chooser_link(): Entered with (%s,%s,%s)',2,$form_element,$include_choose_text,$rdn);
|
|
|
|
global $lang;
|
|
|
|
if ($rdn == "none") {
|
|
$href = "javascript:dnChooserPopup('$form_element', '');";
|
|
|
|
} else {
|
|
$href = "javascript:dnChooserPopup('$form_element', '$rdn');";
|
|
}
|
|
|
|
$title = $lang['chooser_link_tooltip'];
|
|
|
|
printf('<nobr><a href="%s" title="%s"><img class="chooser" src="images/find.png" /></a>',$href,$title);
|
|
if ($include_choose_text)
|
|
printf('<span class="x-small"><a href="%s" title="%s">%s</a></span>',$href,$title,$lang['fbrowse']);
|
|
|
|
echo "</nobr>";
|
|
}
|
|
|
|
/**
|
|
* Explode a DN into an array of its RDN parts. This function is UTF-8 safe
|
|
* and replaces the buggy PHP ldap_explode_dn() which does not properly
|
|
* handle UTF-8 DNs and also causes segmentation faults with some inputs.
|
|
*
|
|
* @param string $dn The DN to explode.
|
|
* @param int $with_attriutes (optional) Whether to include attribute names (see http://php.net/ldap_explode_dn for details)
|
|
*
|
|
* @return array An array of RDN parts of this format:
|
|
* <code>
|
|
* Array
|
|
* (
|
|
* [0] => uid=ppratt
|
|
* [1] => ou=People
|
|
* [2] => dc=example
|
|
* [3] => dc=com
|
|
* )
|
|
* </code>
|
|
*/
|
|
function pla_explode_dn( $dn, $with_attributes=0 ) {
|
|
# replace "\," with the hexadecimal value for safe split
|
|
$var = preg_replace("/\\\,/","\\\\\\\\2C",$dn);
|
|
|
|
# split the dn
|
|
$result = explode(",",$var);
|
|
|
|
# translate hex code into ascii for display
|
|
foreach( $result as $key => $value )
|
|
$result[$key] = preg_replace("/\\\([0-9A-Fa-f]{2})/e", "''.chr(hexdec('\\1')).''", $value);
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_explode_dn(): Entered with (%s,%s), Returning (%s)',1,$dn,$with_attributes,serialize($result));
|
|
|
|
return $result;
|
|
}
|
|
|
|
/**
|
|
* Fetches the URL for the specified item. This is a convenience function for
|
|
* fetching project HREFs (like bugs)
|
|
*
|
|
* @param string $type One of "open_bugs", "add_bug", "donate", or "add_rfe"
|
|
* (rfe = request for enhancement)
|
|
* @return string The URL to the requested item.
|
|
*/
|
|
function get_href( $type, $extra_info='' ) {
|
|
$group_id = "61828";
|
|
$bug_atid = "498546";
|
|
$rfe_atid = "498549";
|
|
$forum_id = "34809";
|
|
|
|
switch( $type ) {
|
|
case 'open_bugs': return "https://sourceforge.net/tracker/?group_id=$group_id&atid=$bug_atid";
|
|
case 'add_bug': return "https://sourceforge.net/tracker/?func=add&group_id=$group_id&atid=$bug_atid";
|
|
case 'add_rfe': return "https://sourceforge.net/tracker/?func=add&group_id=$group_id&atid=$rfe_atid";
|
|
case 'forum': return "http://sourceforge.net/mailarchive/forum.php?forum_id=$forum_id";
|
|
case 'search_bug': return "https://sourceforge.net/tracker/?func=search&group_id=$group_id&atid=$bug_atid&set=custom&_status=100&_group=100&order=summary$extra_info";
|
|
case 'donate': return "donate.php";
|
|
case 'help': return "help.php";
|
|
default: return null;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns the current time as a double (including micro-seconds).
|
|
*
|
|
* @return double The current time in seconds since the beginning of the UNIX epoch (Midnight Jan. 1, 1970)
|
|
*/
|
|
function utime () {
|
|
$time = explode(' ',microtime());
|
|
$usec = (double)$time[0];
|
|
$sec = (double)$time[1];
|
|
return $sec + $usec;
|
|
}
|
|
|
|
/**
|
|
* Converts an array to a query-string with the option to exclude certain variables
|
|
* from the returned query string. This is convenient if callers want to convert the
|
|
* current GET query string or POST array into a string and replace certain
|
|
* variables with their own.
|
|
*
|
|
* @param array $array The associate array to convert whose form is such that the keys are the
|
|
* names of the variables and the values are said variables' values like this:
|
|
* <code>
|
|
* Array
|
|
* (
|
|
* [server_id] = 0,
|
|
* [dn] = "dc=example,dc=com",
|
|
* [attr] = "sn"
|
|
* )
|
|
* </code>
|
|
* This will produce a string like this: "server_id=0&dn=dc=example,dc=com&attr=sn"
|
|
* @param array $exclude_vars (optional) An array of variables to exclude in the resulting string
|
|
* @param bool $url_encode_ampersands (optional) By default, this function encodes all ampersand-separators
|
|
* as & but callers may dislabe this by specifying false here. For example, URLs on HTML
|
|
* pages should encode the ampersands but URLs in header( "Location: http://example.com" ) should
|
|
* not be encoded.
|
|
* @return string The string created from the array.
|
|
*/
|
|
function array_to_query_string( $array, $exclude_vars=array(), $url_encode_ampersands=true ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('array_to_query_string(): Entered with (%s,%s,%s)',2,
|
|
count($array),count($exclude_vars),$url_encode_ampersands);
|
|
|
|
if( ! is_array( $array ) )
|
|
return '';
|
|
if( ! $array )
|
|
return '';
|
|
$str = '';
|
|
$i=0;
|
|
foreach( $array as $name => $val ) {
|
|
if( ! in_array( $name, $exclude_vars ) ) {
|
|
if( $i>0 )
|
|
if( $url_encode_ampersands )
|
|
$str .= '&';
|
|
else
|
|
$str .= '&';
|
|
$str .= urlencode( $name ) . '=' . urlencode( $val );
|
|
$i++;
|
|
}
|
|
}
|
|
return $str;
|
|
}
|
|
|
|
/**
|
|
* Reverses a DN such that the top-level RDN is first and the bottom-level RDN is last
|
|
* For example:
|
|
* <code>
|
|
* cn=Brigham,ou=People,dc=example,dc=com
|
|
* </code>
|
|
* Becomes:
|
|
* <code>
|
|
* dc=com,dc=example,ou=People,cn=Brigham
|
|
* </code>
|
|
* This makes it possible to sort lists of DNs such that they are grouped by container.
|
|
*
|
|
* @param string $dn The DN to reverse
|
|
*
|
|
* @return string The reversed DN
|
|
*
|
|
* @see pla_compare_dns
|
|
*/
|
|
function pla_reverse_dn($dn) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_reverse_dn(): Entered with (%s)',2,$dn);
|
|
|
|
foreach (pla_explode_dn($dn) as $key => $branch) {
|
|
|
|
// pla_expode_dn returns the array with an extra count attribute, we can ignore that.
|
|
if ( $key === "count" ) continue;
|
|
|
|
if (isset($rev)) {
|
|
$rev = $branch.",".$rev;
|
|
} else {
|
|
$rev = $branch;
|
|
}
|
|
}
|
|
return $rev;
|
|
}
|
|
|
|
/**
|
|
* Determins if the specified attribute is contained in the $unique_attrs list
|
|
* configured in config.php.
|
|
* @return Bool True if the specified attribute is in the $unique_attrs list and false
|
|
* otherwise.
|
|
*/
|
|
function is_unique_attr( $attr_name ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_unique_attr(): Entered with (%s)',2,$attr_name);
|
|
|
|
global $unique_attrs;
|
|
if( isset( $unique_attrs ) && is_array( $unique_attrs ) ) {
|
|
foreach( $unique_attrs as $attr )
|
|
if( 0 === strcasecmp( $attr_name, $attr ) )
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* This function will check whether the value for an attribute being changed
|
|
* is already assigned to another DN.
|
|
*
|
|
* Inputs:
|
|
* @param object $ldapserver The LDAP Server Object of interest
|
|
* @param dn $dn DN that is being changed
|
|
* @param string $attr_name Attribute being changed
|
|
* @param string|array $new values New values for the attribute
|
|
*
|
|
* Returns the bad value, or null if all values are OK
|
|
* @todo Implement alternate conection with LDAPserver object
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function checkUniqueAttr( $ldapserver, $dn, $attr_name, $new_value ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('checkUniqueAttr(): Entered with (%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$dn,$attr_name,count($new_value));
|
|
|
|
global $ldapservers,$lang;
|
|
|
|
// Is this attribute in the unique_attrs list?
|
|
if ( is_unique_attr( $attr_name ) ) {
|
|
|
|
// Search the tree and make sure that attribute doesnt already exist to somebody else.
|
|
|
|
// Check see and use our alternate uid_dn and password if we have it.
|
|
$unique_attrs_dn = $ldapservers->GetValue($ldapserver->server_id,'unique_attrs','dn');
|
|
$unique_attrs_pass = $ldapservers->GetValue($ldapserver->server_id,'unique_attrs','pass');
|
|
$need_to_unbind = false;
|
|
|
|
if ( isset( $unique_attrs_dn ) && $unique_attrs_dn != '' && isset( $uniqe_attrs_pass ) )
|
|
{
|
|
$con = @ldap_connect( $ldapserver->host, $ldapserver->port );
|
|
|
|
@ldap_set_option( $con, LDAP_OPT_PROTOCOL_VERSION, 3 );
|
|
|
|
// Bind with the alternate ID.
|
|
$res = @ldap_bind( $con, $unuque_attrs_dn, $unique_attrs_pass );
|
|
|
|
if (! $res) pla_error( sprintf( $lang['unique_attrs_invalid_credential'] , $ldapserver->name ) );
|
|
|
|
$need_to_unbind = true;
|
|
|
|
} else {
|
|
$con = $ldapserver->connect();
|
|
}
|
|
|
|
// Build our search filter to double check each attribute.
|
|
$searchfilter = "(|";
|
|
|
|
if ( is_array( $new_value ) ) {
|
|
foreach ($new_value as $val) {
|
|
$searchfilter .= sprintf("($attr_name=%s)",clean_search_vals($val));
|
|
}
|
|
|
|
} elseif ( $new_value ) {
|
|
$searchfilter .= sprintf("($attr_name=%s)",clean_search_vals($new_value));
|
|
}
|
|
|
|
$searchfilter .= ")";
|
|
|
|
// Do we need a sanity check to just in case $new_value was null and hence the search string is bad?
|
|
|
|
foreach ($ldapserver->getBaseDN() as $base_dn) {
|
|
|
|
// Do the search
|
|
$search = @ldap_search( $con, $base_dn, $searchfilter, array('dn',$attr_name), 0, 0, 0, LDAP_DEREF_ALWAYS);
|
|
if (! $search)
|
|
continue;
|
|
|
|
$search = ldap_get_entries( $con, $search );
|
|
|
|
foreach ($search as $result) {
|
|
// Skip the count result and go to the array.
|
|
if (! is_array($result)) continue;
|
|
|
|
// If one of the attributes is owned to somebody else, then we may as well die here.
|
|
if ($result['dn'] != $dn) {
|
|
|
|
// Find which attribute matched.
|
|
foreach ($result[strtolower($attr_name)] as $attr) {
|
|
foreach ($new_value as $new_value_attr) {
|
|
if ($attr == $new_value_attr)
|
|
return $attr;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if ( $need_to_unbind ) {
|
|
$res = @ldap_unbind( $con );
|
|
}
|
|
|
|
// If we get here, then it must be OK?
|
|
return;
|
|
|
|
} else {
|
|
return;
|
|
}
|
|
}
|
|
|
|
/**
|
|
*
|
|
*/
|
|
|
|
function sortAttrs($a,$b) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('sortAttrs(): Entered with (%s,%s)',2,$a,$b);
|
|
|
|
global $friendly_attrs, $attrs_display_order;
|
|
|
|
// If $attrs_display_order is not set, make it a blank array.
|
|
if (! isset($attrs_display_order))
|
|
$attrs_display_order = array();
|
|
|
|
if ( $a == $b ) return 0;
|
|
|
|
// Check if $a is in $attrs_display_order, get its key
|
|
$a_key = array_search($a, $attrs_display_order);
|
|
// If not, check if its friendly name is $attrs_display_order, get its key
|
|
// If not, assign one greater than number of elements.
|
|
if ( $a_key == '' ) {
|
|
if (isset($friendly_attrs[ strtolower( $a ) ])) {
|
|
$a_key = array_search( $friendly_attrs[ strtolower( $a ) ], $attrs_display_order);
|
|
if ( $a_key == '' ) $a_key = count($attrs_display_order)+1;
|
|
}
|
|
else {
|
|
$a_key = count($attrs_display_order)+1;
|
|
}
|
|
}
|
|
|
|
$b_key = array_search($b, $attrs_display_order);
|
|
if ( $b_key == '' ) {
|
|
if (isset($friendly_attrs[ strtolower( $b ) ])) {
|
|
$b_key = array_search( $friendly_attrs[ strtolower( $b ) ], $attrs_display_order);
|
|
if ( $b_key == '' ) $b_key = count($attrs_display_order)+1;
|
|
}
|
|
else {
|
|
$b_key = count($attrs_display_order)+1;
|
|
}
|
|
}
|
|
|
|
// Case where neither $a, nor $b are in $attrs_display_order, $a_key = $b_key = one greater than num elements.
|
|
// So we sort them alphabetically
|
|
if ( $a_key == $b_key ) {
|
|
$a = strtolower( (isset($friendly_attrs[ strtolower( $a ) ]) ? $friendly_attrs[ strtolower( $a ) ] : $a));
|
|
$b = strtolower( (isset($friendly_attrs[ strtolower( $b ) ]) ? $friendly_attrs[ strtolower( $b ) ] : $b));
|
|
return strcmp ($a, $b);
|
|
}
|
|
|
|
// Case where at least one attribute or its friendly name is in $attrs_display_order
|
|
// return -1 if $a before $b in $attrs_display_order
|
|
return ( $a_key < $b_key ) ? -1 : 1;
|
|
}
|
|
|
|
/**
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function userIsMember($ldapserver,$user,$group) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('userIsMember(): Entered with (%s,%s,%s)',2,$ldapserver->server_id,$user,$group);
|
|
|
|
$group = get_object_attrs( $ldapserver, $group, false, $deref=LDAP_DEREF_NEVER );
|
|
|
|
if( is_array($group) ) {
|
|
// If you are using groupOfNames objectClass
|
|
if ( array_key_exists('member',$group) and in_array(strtolower($user),arrayLower($group['member'])) )
|
|
return true;
|
|
// If you are using groupOfUniqueNames objectClass
|
|
if ( array_key_exists('uniqueMember',$group) and in_array(strtolower($user),arrayLower($group['uniqueMember'])) )
|
|
return true;
|
|
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @todo Move this to an LDAPServer object method.
|
|
*/
|
|
function userIsAllowedLogin($ldapserver,$user) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('userIsAllowedLogin(): Entered with (%s,%s)',2,$ldapserver->server_id,$user);
|
|
|
|
global $ldapservers;
|
|
|
|
$user = strtolower($user);
|
|
|
|
if (! $ldapservers->GetValue($ldapserver->server_id,'login','allowed_dns'))
|
|
return true;
|
|
|
|
foreach ($ldapservers->GetValue($ldapserver->server_id,'login','allowed_dns') as $login_allowed_dn) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('userIsAllowedLogin: Working through (%s)',9,$login_allowed_dn);
|
|
|
|
// Check if $login_allowed_dn is an ldap search filter
|
|
// Is first occurence of 'filter=' (case ensitive) at position 0 ?
|
|
if ( preg_match('/^\([&|]\(/',$login_allowed_dn) ) {
|
|
$filter = $login_allowed_dn;
|
|
|
|
foreach($ldapserver->getBaseDN() as $base_dn) {
|
|
$results = array();
|
|
$results = pla_ldap_search( $ldapserver, $filter, $base_dn, array('dn') );
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('userIsAllowedLogin: Search, Filter [%s], BaseDN [%s] Results [%s]',9,
|
|
$filter, $base_dn, is_array($results));
|
|
|
|
$dn_array = array();
|
|
|
|
if ($results) {
|
|
foreach ($results as $result)
|
|
$dn_array[] = $result['dn'];
|
|
$dn_array = array_unique( $dn_array );
|
|
|
|
if( count( $dn_array ) !== 0 )
|
|
foreach($dn_array as $result_dn) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('userIsAllowedLogin: Comparing with [%s]',9,$result_dn);
|
|
|
|
// Check if $result_dn is a user DN
|
|
if ( 0 == strcasecmp( trim($user), trim(strtolower($result_dn)) ) )
|
|
return true;
|
|
|
|
// Check if $result_dn is a group DN
|
|
if ( userIsMember($ldapserver,$user,$result_dn) )
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Check if $login_allowed_dn is a user DN
|
|
if ( 0 == strcasecmp( trim($user), trim(strtolower($login_allowed_dn)) ) )
|
|
return true;
|
|
|
|
// Check if $login_allowed_dn is a group DN
|
|
if ( userIsMember($ldapserver,$user,$login_allowed_dn) )
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Reads an array and returns the array values back in lower case
|
|
* @param array $array The array to convert the values to lowercase.
|
|
* @returns array Array with values converted to lowercase.
|
|
*/
|
|
function arrayLower($array) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('arrayLower(): Entered with (%s)',2,serialize($array));
|
|
|
|
if (! is_array($array))
|
|
return $array;
|
|
|
|
$newarray = array();
|
|
foreach ($array as $key => $value) {
|
|
$newarray[$key] = strtolower($value);
|
|
}
|
|
|
|
return $newarray;
|
|
}
|
|
|
|
/**
|
|
* Strips all slashes from the specified array in place (pass by ref).
|
|
* @param Array $array The array to strip slashes from, typically one of
|
|
* $_GET, $_POST, or $_COOKIE.
|
|
*/
|
|
function array_stripslashes(&$array) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('array_stripslashes(): Entered with (%s)',2,serialize($array));
|
|
|
|
if (is_array($array))
|
|
while (list($key) = each($array))
|
|
if (is_array($array[$key]) && $key != $array)
|
|
array_stripslashes($array[$key]);
|
|
else
|
|
$array[$key] = stripslashes($array[$key]);
|
|
}
|
|
|
|
/**
|
|
* Gets the USER_AGENT string from the $_SERVER array, all in lower case in
|
|
* an E_NOTICE safe manner.
|
|
* @return string|false The user agent string as reported by the browser.
|
|
*/
|
|
function get_user_agent_string() {
|
|
if( isset( $_SERVER['HTTP_USER_AGENT'] ) )
|
|
$return = strtolower( $_SERVER['HTTP_USER_AGENT'] );
|
|
else
|
|
$return = false;
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_user_agent_string(): Entered with (), Returning (%s)',1,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Determines whether the browser's operating system is UNIX (or something like UNIX).
|
|
* @return boolean True if the brower's OS is UNIX, false otherwise.
|
|
*/
|
|
function is_browser_os_unix() {
|
|
$agent_strs = array(
|
|
'sunos','sunos 4','sunos 5',
|
|
'i86',
|
|
'irix','irix 5','irix 6','irix6',
|
|
'hp-ux','09.','10.',
|
|
'aix','aix 1','aix 2','aix 3','aix 4',
|
|
'inux',
|
|
'sco',
|
|
'unix_sv','unix_system_v','ncr','reliant','dec','osf1',
|
|
'dec_alpha','alphaserver','ultrix','alphastation',
|
|
'sinix',
|
|
'freebsd','bsd',
|
|
'x11','vax','openvms'
|
|
);
|
|
|
|
$return = string_in_array_value(get_user_agent_string(),$agent_strs);
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_browser_os_unix(): Entered with (), Returning (%s)',1,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Determines whether the browser's operating system is Windows.
|
|
* @return boolean True if the brower's OS is Windows, false otherwise.
|
|
*/
|
|
function is_browser_os_windows() {
|
|
$agent_strs = array(
|
|
'win','win95','windows 95',
|
|
'win16','windows 3.1','windows 16-bit','windows','win31','win16','winme',
|
|
'win2k','winxp',
|
|
'win98','windows 98','win9x',
|
|
'winnt','windows nt','win32',
|
|
'32bit'
|
|
);
|
|
|
|
$return = string_in_array_value(get_user_agent_string(),$agent_strs);
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_browser_os_windows(): Entered with (), Returning (%s)',1,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Determines whether the browser's operating system is Macintosh.
|
|
* @return boolean True if the brower's OS is mac, false otherwise.
|
|
*/
|
|
function is_browser_os_mac() {
|
|
$agent_strs = array(
|
|
'mac','68000','ppc','powerpc'
|
|
);
|
|
|
|
$return = string_in_array_value(get_user_agent_string(),$agent_strs);
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('is_browser_os_windows(): Entered with (), Returning (%s)',1,$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Return posix group entries.
|
|
* @return Array An associative array of posix group entries with attributes as keys, and values as values.
|
|
* @param int $server_id The ID of the server to search.
|
|
* @param string $base_dn The base of the search.
|
|
* @deprecated
|
|
*/
|
|
function get_posix_groups($ldapserver,$base_dn=null) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_posix_groups(): Entered with (%s,%s)',2,$ldapserver->server_id,$base_dn);
|
|
|
|
$results = pla_ldap_search($ldapserver,"objectclass=posixGroup",$base_dn,array());
|
|
|
|
if (!$results)
|
|
return array();
|
|
else
|
|
return $results;
|
|
}
|
|
|
|
/**
|
|
* Return the default format for search results.
|
|
*
|
|
* @return string The format to use.
|
|
*/
|
|
function get_default_search_display() {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_default_search_display(): Entered with ()',2);
|
|
|
|
global $default_search_display, $lang;
|
|
|
|
if( ! isset( $default_search_display ) || is_null( $default_search_display ) )
|
|
return 'list';
|
|
|
|
elseif( 0 == strcasecmp( $default_search_display, 'list' ) )
|
|
return 'list';
|
|
|
|
elseif( 0 == strcasecmp( $default_search_display, 'table' ) )
|
|
return 'table';
|
|
|
|
else
|
|
pla_error( sprintf( $lang['bad_search_display'], htmlspecialchars( $default_search_display ) ) );
|
|
}
|
|
|
|
/**
|
|
* Checks if a string exists in an array, ignoring case.
|
|
*
|
|
* @param string $needle What you are looking for
|
|
* @param array $haystack The array that you think it is in.
|
|
* @return bool True if its there, false if its not.
|
|
*/
|
|
function in_array_ignore_case( $needle, $haystack ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('in_array_ignore_case(): Entered with (%s,%s)',2,$needle,serialize($haystack));
|
|
|
|
if( ! is_array( $haystack ) )
|
|
return false;
|
|
if( ! is_string( $needle ) )
|
|
return false;
|
|
|
|
foreach( $haystack as $element )
|
|
if( is_string( $element ) && 0 == strcasecmp( $needle, $element ) )
|
|
return true;
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Checks if a string exists in part in an array value, ignoring case.
|
|
*
|
|
* @param string $needle What you are looking for
|
|
* @param array $haystack The array that you think it is in.
|
|
* @return bool True if its there, false if its not.
|
|
*/
|
|
function string_in_array_value( $needle, $haystack ) {
|
|
# Set default return
|
|
$return = false;
|
|
|
|
if (! is_string($needle)) return $return;
|
|
if (! is_array($haystack)) return $return;
|
|
|
|
foreach ($haystack as $element)
|
|
if (is_string($element) && (strpos($needle,$element) !== false)) {
|
|
$return = true;
|
|
break;
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('string_in_array_value(): Entered with (%s,%s), Returning (%s)',1,$needle,serialize($haystack),$return);
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* String padding
|
|
*
|
|
* @param string input string
|
|
* @param integer length of the result
|
|
* @param string the filling string
|
|
* @param integer padding mode
|
|
*
|
|
* @return string the padded string
|
|
*/
|
|
function full_str_pad($input, $pad_length, $pad_string = '', $pad_type = 0) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('full_str_pad(): Entered with (%s,%s,%s,%s)',2,$input,$pad_length,$pad_string,$pad_type);
|
|
|
|
$str = '';
|
|
$length = $pad_length - strlen($input);
|
|
|
|
if ($length > 0) { // str_repeat doesn't like negatives
|
|
if ($pad_type == STR_PAD_RIGHT) { // STR_PAD_RIGHT == 1
|
|
$str = $input.str_repeat($pad_string, $length);
|
|
} elseif ($pad_type == STR_PAD_BOTH) { // STR_PAD_BOTH == 2
|
|
$str = str_repeat($pad_string, floor($length/2));
|
|
$str .= $input;
|
|
$str .= str_repeat($pad_string, ceil($length/2));
|
|
} else { // defaults to STR_PAD_LEFT == 0
|
|
$str = str_repeat($pad_string, $length).$input;
|
|
}
|
|
|
|
} else { // if $length is negative or zero we don't need to do anything
|
|
$str = $input;
|
|
}
|
|
return $str;
|
|
}
|
|
|
|
/**
|
|
* Encryption using blowfish algorithm
|
|
*
|
|
* @param string original data
|
|
* @param string the secret
|
|
*
|
|
* @return string the encrypted result
|
|
*
|
|
* @access public
|
|
*
|
|
* @author lem9 (taken from the phpMyAdmin source)
|
|
*/
|
|
function pla_blowfish_encrypt( $data, $secret=null ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_blowfish_encrypt(): Entered with (%s,%s)',2,$data,$secret);
|
|
|
|
global $config;
|
|
|
|
# If our secret is null or blank, get the default.
|
|
if( $secret === null || ! trim($secret))
|
|
$secret = $config->GetValue('session','blowfish');
|
|
|
|
# If the secret isnt set, then just return the data.
|
|
if (! trim($secret))
|
|
return $data;
|
|
|
|
require_once LIBDIR.'blowfish.php';
|
|
|
|
$pma_cipher = new Horde_Cipher_blowfish;
|
|
$encrypt = '';
|
|
|
|
for ($i=0; $i<strlen($data); $i+=8) {
|
|
$block = substr($data, $i, 8);
|
|
|
|
if (strlen($block) < 8)
|
|
$block = full_str_pad($block,8,"\0", 1);
|
|
|
|
$encrypt .= $pma_cipher->encryptBlock($block, $secret);
|
|
}
|
|
return base64_encode($encrypt);
|
|
}
|
|
|
|
/**
|
|
* Decryption using blowfish algorithm
|
|
*
|
|
* @param string encrypted data
|
|
* @param string the secret
|
|
*
|
|
* @return string original data
|
|
*
|
|
* @access public
|
|
*
|
|
* @author lem9 (taken from the phpMyAdmin source)
|
|
*/
|
|
function pla_blowfish_decrypt( $encdata, $secret=null ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('pla_blowfish_decrypt(): Entered with (%s,%s)',2,$encdata,$secret);
|
|
|
|
global $config;
|
|
|
|
// This cache gives major speed up for stupid callers :)
|
|
static $cache = array();
|
|
|
|
if( isset( $cache[$encdata] ) )
|
|
return $cache[$encdata];
|
|
|
|
# If our secret is null or blank, get the default.
|
|
if( $secret === null || ! trim($secret))
|
|
$secret = $config->GetValue('session','blowfish');
|
|
|
|
# If the secret isnt set, then just return the data.
|
|
if (! trim($secret))
|
|
return $encdata;
|
|
|
|
require_once LIBDIR.'blowfish.php';
|
|
|
|
$pma_cipher = new Horde_Cipher_blowfish;
|
|
$decrypt = '';
|
|
$data = base64_decode($encdata);
|
|
|
|
for ($i=0; $i<strlen($data); $i+=8) {
|
|
$decrypt .= $pma_cipher->decryptBlock(substr($data, $i, 8), $secret);
|
|
}
|
|
|
|
$return = trim($decrypt);
|
|
$cache[$encdata] = $return;
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Gets a DN string using the user-configured tree_display_format string to format it.
|
|
*/
|
|
function draw_formatted_dn( $ldapserver, $dn ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('draw_formatted_dn(): Entered with (%s,%s)',2,$ldapserver->server_id,$dn);
|
|
|
|
global $config;
|
|
|
|
$format = $config->GetValue('appearance','tree_display_format');
|
|
preg_match_all( "/%[a-zA-Z_0-9]+/", $format, $tokens );
|
|
$tokens = $tokens[0];
|
|
foreach( $tokens as $token ) {
|
|
if( 0 == strcasecmp( $token, '%dn' ) )
|
|
$format = str_replace( $token, pretty_print_dn( $dn ), $format );
|
|
|
|
elseif( 0 == strcasecmp( $token, '%rdn' ) )
|
|
$format = str_replace( $token, pretty_print_dn( get_rdn( $dn ) ), $format );
|
|
|
|
elseif( 0 == strcasecmp( $token, '%rdnvalue' ) ) {
|
|
$rdn = get_rdn( $dn );
|
|
$rdn_value = explode( '=', $rdn, 2 );
|
|
$rdn_value = $rdn_value[1];
|
|
$format = str_replace( $token, $rdn_value, $format );
|
|
|
|
} else {
|
|
$attr_name = str_replace( '%', '', $token );
|
|
$attr_values = get_object_attr( $ldapserver, $dn, $attr_name );
|
|
|
|
if( null == $attr_values )
|
|
$display = 'none';
|
|
|
|
elseif( is_array( $attr_values ) )
|
|
$display = htmlspecialchars( implode( ', ', $attr_values ) );
|
|
|
|
else
|
|
$display = htmlspecialchars( $attr_values );
|
|
|
|
$format = str_replace( $token, $display, $format );
|
|
}
|
|
}
|
|
echo $format;
|
|
}
|
|
|
|
/**
|
|
* Gets the date format from the config - default locale if none.
|
|
* @deprecated
|
|
*/
|
|
function get_date_format() {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_date_format(): Entered with ()',2);
|
|
|
|
global $config;
|
|
|
|
return $config->GetValue('appearance','date');
|
|
}
|
|
|
|
/**
|
|
* Takes a shadow* attribute and returns the date as an integer.
|
|
*/
|
|
function shadow_date( $attrs, $attr) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('shadow_date(): Entered with (%s,%s)',2,serialize($attrs),$attr);
|
|
|
|
$shadowLastChange = isset($attrs['shadowLastChange']) ? $attrs['shadowLastChange'][0] : null;
|
|
$shadowMax = isset($attrs['shadowMax']) ? $attrs['shadowMax'][0] : null;
|
|
|
|
if( 0 == strcasecmp( $attr, 'shadowLastChange' ) && $shadowLastChange)
|
|
$shadow_date = $shadowLastChange;
|
|
|
|
elseif ( 0 == strcasecmp( $attr, 'shadowMax' ) && ($shadowMax > 0) && $shadowLastChange )
|
|
$shadow_date = $shadowLastChange+$shadowMax;
|
|
|
|
elseif ( 0 == strcasecmp( $attr, 'shadowWarning' ) && ($attrs[$attr][0] > 0) && $shadowLastChange && $shadowMax && $shadowMax > 0)
|
|
$shadow_date = $shadowLastChange+$shadowMax-$attrs[$attr][0];
|
|
|
|
elseif ( 0 == strcasecmp( $attr, 'shadowInactive' ) && ($attrs[$attr][0] > 0) && $shadowLastChange && $shadowMax && $shadowMax > 0)
|
|
$shadow_date = $shadowLastChange+$shadowMax+$attrs[$attr][0];
|
|
|
|
elseif ( 0 == strcasecmp( $attr, 'shadowMin' ) && ($attrs[$attr][0] > 0) && $shadowLastChange)
|
|
$shadow_date = $shadowLastChange+$attrs[$attr][0];
|
|
|
|
elseif ( 0 == strcasecmp( $attr, 'shadowExpire' ) && ($attrs[$attr][0] > 0))
|
|
$shadow_date = $attrs[$attr][0];
|
|
|
|
else // Couldn't interpret the shadow date (could be 0 or -1 or something)
|
|
return false;
|
|
|
|
return $shadow_date*24*3600;
|
|
}
|
|
|
|
/**
|
|
* This function will clean up the values use during a search - namely, values that have brackets
|
|
* as that messes up the search filter.
|
|
* @param string $val String that will be used in the search filter.
|
|
* @return string $result String that is ready for the search filter.
|
|
*/
|
|
function clean_search_vals( $val ) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('clean_search_vals(): Entered with (%s)',2,$val);
|
|
|
|
# Remove any escaped brackets already.
|
|
$val = preg_replace("/\\\\([\(\)])/","$1",$val);
|
|
|
|
# The string might be a proper search filter
|
|
if (preg_match("/^\([&\|]\(/",$val))
|
|
return $val;
|
|
|
|
else
|
|
return preg_replace("/([\(\)])/","\\\\$1",$val);
|
|
}
|
|
|
|
/**
|
|
* Server html select list
|
|
*/
|
|
function server_select_list ($select_id=null,$only_logged_on=true,$select_name='server_id',$js_script=null) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('server_select_list(): Entered with (%s,%s,%s,%s)',2,$select_id,$only_logged_on,$select_name,$js_script);
|
|
|
|
global $ldapservers;
|
|
|
|
$count = 0;
|
|
$server_menu_html = sprintf('<select name="%s" %s>',$select_name,$js_script);
|
|
|
|
foreach ($ldapservers->GetServerList() as $id) {
|
|
|
|
$ldapserver = $ldapservers->Instance($id);
|
|
|
|
if ($ldapserver->isVisible()) {
|
|
|
|
if ($only_logged_on && ! $ldapserver->haveAuthInfo())
|
|
continue;
|
|
|
|
$count++;
|
|
$server = $ldapserver;
|
|
|
|
$server_menu_html .= sprintf('<option value="%s" %s>%s</option>',
|
|
$ldapserver->server_id,( $ldapserver->server_id == $select_id ? 'selected' : '' ),$ldapserver->name);
|
|
}
|
|
}
|
|
|
|
$server_menu_html .= '</select>';
|
|
|
|
if ($count > 1)
|
|
return $server_menu_html;
|
|
|
|
elseif ($count)
|
|
return sprintf('%s <input type="hidden" name="%s" value="%s">',
|
|
$server->name,$select_name,$server->server_id);
|
|
|
|
else
|
|
return null;
|
|
}
|
|
|
|
function server_info_list() {
|
|
global $ldapservers;
|
|
|
|
$server_info_list = array();
|
|
|
|
foreach ($ldapservers->GetServerList() as $id) {
|
|
$ldapserver = $ldapservers->Instance($id);
|
|
|
|
if (! $ldapserver->haveAuthInfo() || ! $ldapserver->isValidServer($id))
|
|
continue;
|
|
|
|
$server_info_list[$id]['id'] = $id;
|
|
$server_info_list[$id]['name'] = $ldapserver->name;
|
|
$server_info_list[$id]['base_dns'] = $ldapserver->getBaseDN();
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('server_info_list(): Entered with (), Returning (%s)',1,serialize($server_info_list));
|
|
|
|
return $server_info_list;
|
|
}
|
|
|
|
/**
|
|
* Debug Logging to Syslog
|
|
*
|
|
* If the log level of the message is less than the log level of the debug setting in the config file
|
|
* then log the message to syslog.
|
|
*
|
|
* This has been extended to allow multiple arguments after the level.
|
|
* If this form is used then the $msg is treated as a sprintf format
|
|
* and the remaining arguments are passed to this. The advantage of this
|
|
* is that the string is only composed if the message is going to be logged.
|
|
*
|
|
* Suggested logging level messages:
|
|
* 1 = Return results from function calls.
|
|
* 2 = Entry parameters to function calls.
|
|
* 3 = CACHE returning indications
|
|
* 4 = High level processing
|
|
* 5 = 2nd level processing
|
|
* 9 = Very verbose (describing what the code is doing)
|
|
* @param string $msg Message to send to syslog
|
|
* @param int $level Log level of this message.
|
|
* @see syslog.php
|
|
*/
|
|
|
|
function debug_log($msg,$level=0) {
|
|
global $config,$debug_file;
|
|
|
|
# In case we are called before we are fully initialised or if debugging is not set.
|
|
if (! isset($config) || ! ($config->GetValue('debug','file') || $config->GetValue('debug','syslog')))
|
|
return false;
|
|
|
|
$debug_level = $config->GetValue('debug','level');
|
|
if (! $debug_level)
|
|
$debug_level = -1;
|
|
if ($level > $debug_level)
|
|
return false;
|
|
|
|
$caller = basename( $_SERVER['PHP_SELF'] );
|
|
|
|
if (func_num_args() > 2) {
|
|
$args = func_get_args();
|
|
unset($args[0]);
|
|
unset($args[1]);
|
|
$msg = vsprintf($msg, array_values($args));
|
|
}
|
|
|
|
if ($level <= $debug_level) {
|
|
$debug_message = sprintf('%s(%s): %s',basename($_SERVER['PHP_SELF']),$level,substr($msg,0,200));
|
|
|
|
if ($debug_file || $config->GetValue('debug','file')) {
|
|
if (! $debug_file)
|
|
$debug_file = fopen($config->GetValue('debug','file'),'w');
|
|
//@todo: change this to append.
|
|
|
|
fwrite($debug_file,$debug_message."\n");
|
|
}
|
|
|
|
if ($config->GetValue('debug','syslog'))
|
|
syslog_notice($debug_message);
|
|
}
|
|
return syslog_notice( sprintf('%s(%s): %s',$caller,$level,$msg) );
|
|
}
|
|
|
|
function enc_type_select_list($enc_type) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('enc_type_select_list(): Entered with (%s)',2,$enc_type);
|
|
|
|
$html = '<select name="enc_type">';
|
|
$html .= '<option>clear</option>';
|
|
|
|
foreach (array('crypt','ext_des','md5crypt','blowfish','md5','smd5','sha','ssha') as $option)
|
|
$html .= sprintf('<option%s>%s</option>',($enc_type == $option ? ' selected="true"' : ''),$option);
|
|
|
|
$html .= "</select>";
|
|
|
|
return $html;
|
|
}
|
|
|
|
// Converts a little-endian hex-number to one, that 'hexdec' can convert
|
|
function littleEndian($hex) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('littleEndian(): Entered with (%s)',2,$hex);
|
|
|
|
$result = '';
|
|
|
|
for ($x=strlen($hex)-2; $x >= 0; $x=$x-2)
|
|
$result .= substr($hex,$x,2);
|
|
|
|
return $result;
|
|
}
|
|
|
|
function binSIDtoText($binsid) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('binSIDtoText(): Entered with (%s)',2,$binsid);
|
|
|
|
$hex_sid=bin2hex($binsid);
|
|
$rev = hexdec(substr($hex_sid,0,2)); // Get revision-part of SID
|
|
$subcount = hexdec(substr($hex_sid,2,2)); // Get count of sub-auth entries
|
|
$auth = hexdec(substr($hex_sid,4,12)); // SECURITY_NT_AUTHORITY
|
|
|
|
$result = "$rev-$auth";
|
|
|
|
for ($x=0;$x < $subcount; $x++) {
|
|
$subauth[$x] =
|
|
hexdec(littleEndian(substr($hex_sid,16+($x*8),8))); // get all SECURITY_NT_AUTHORITY
|
|
$result .= "-".$subauth[$x];
|
|
}
|
|
|
|
return $result;
|
|
}
|
|
|
|
if (! function_exists('session_cache_expire')) {
|
|
|
|
/**
|
|
* session_cache_expire is a php 4.2.0 function, we'll emulate it if we are using php <4.2.0
|
|
*/
|
|
|
|
function session_cache_expire() {
|
|
if (defined('DEBUG_ENABLED') && (DEBUG_ENABLED))
|
|
debug_log('session_cache_expire(): Entered with ()',2);
|
|
|
|
return 180;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Sort a multi dimensional array.
|
|
* @param array $data Multi demension array passed by reference
|
|
* @param string $sortby Comma delimited string of sort keys.
|
|
* @param bool $rev Whether to reverse sort.
|
|
* @returnn array $data Sorted multi demension array.
|
|
*/
|
|
function masort(&$data, $sortby, $rev=0) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('masort(): Entered with (%s,%s,%s)',2,serialize($data),$sortby,$rev);
|
|
|
|
static $sort_funcs = array();
|
|
|
|
if (empty($sort_funcs[$sortby])) {
|
|
$code = "\$c=0;\n";
|
|
foreach (split(',', $sortby) as $key) {
|
|
$code .= "if ((! isset(\$a['$key'])) && (! isset(\$b['$key']))) return 0;\n";
|
|
$code .= "if ((! isset(\$a['$key'])) && isset(\$b['$key'])) return -1;\n";
|
|
$code .= "if (isset(\$a['$key']) && (! isset(\$b['$key']))) return 1;\n";
|
|
$code .= "if (is_numeric(\$a['$key']) && is_numeric(\$b['$key'])) {\n";
|
|
|
|
$code .= " if (\$a['$key'] != \$b['$key'])\n";
|
|
if ($rev)
|
|
$code .= " return (\$a['$key'] < \$b['$key'] ? -1 : 1);\n";
|
|
else
|
|
$code .= " return (\$a['$key'] > \$b['$key'] ? -1 : 1);\n";
|
|
|
|
$code .= "} else {\n";
|
|
|
|
if ($rev)
|
|
$code .= " if ( (\$c = strcasecmp(\$b['$key'],\$a['$key'])) != 0 ) return \$c;\n";
|
|
else
|
|
$code .= " if ( (\$c = strcasecmp(\$a['$key'],\$b['$key'])) != 0 ) return \$c;\n";
|
|
$code .= "}\n";
|
|
}
|
|
$code .= 'return $c;';
|
|
$sort_func = $sort_funcs[$sortby] = create_function('$a, $b', $code);
|
|
} else {
|
|
$sort_func = $sort_funcs[$sortby];
|
|
}
|
|
$sort_func = $sort_funcs[$sortby];
|
|
uasort($data, $sort_func);
|
|
}
|
|
|
|
/**
|
|
* Query LDAP and return a hash.
|
|
* @param object $ldapserver The LDAPServer object of the server which the user hsa logged in.
|
|
* @param string $base_dn The base DN to use.
|
|
* @param string $filter LDAP Query filter.
|
|
* @param string $key LDAP attribute to use as key.
|
|
* @param array $attrs LDAP attributes to use as values.
|
|
* @return array $results Array of values keyed by $key.
|
|
*/
|
|
function return_ldap_hash($ldapserver,$base_dn,$filter,$key,$attrs) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('return_ldap_hash(): Entered with (%s,%s,%s,%s,%s)',2,
|
|
$ldapserver->server_id,$base_dn,$filter,$key,count($attrs));
|
|
|
|
$ldapquery = pla_ldap_search($ldapserver,$filter,$base_dn,$attrs);
|
|
|
|
$results = array();
|
|
|
|
foreach ($ldapquery as $dn => $dnattrs) {
|
|
foreach ($attrs as $attr) {
|
|
if (isset($dnattrs[$attr]))
|
|
$results[$dnattrs[$key]][$attr] = $dnattrs[$attr];
|
|
}
|
|
}
|
|
return $results;
|
|
}
|
|
|
|
// @todo: document this function
|
|
function debug_dump($variable,$die=false) {
|
|
print "<PRE>";
|
|
print_r($variable);
|
|
if ($die)
|
|
die();
|
|
}
|
|
|
|
/**
|
|
* This function returns a string automatically generated
|
|
* based on the criteria defined in the array $criteria in config.php
|
|
*/
|
|
function password_generate() {
|
|
global $config;
|
|
|
|
$no_use_similiar = ! $config->GetValue('password','use_similar');
|
|
$lowercase = $config->GetValue('password','lowercase');
|
|
$uppercase = $config->GetValue('password','uppercase');
|
|
$digits = $config->GetValue('password','numbers');
|
|
$punctuation = $config->GetValue('password','punctuation');
|
|
$length = $config->GetValue('password','length');
|
|
|
|
$outarray = array();
|
|
|
|
if ($no_use_similiar) {
|
|
$raw_lower = "a b c d e f g h k m n p q r s t u v w x y z";
|
|
$raw_numbers = "2 3 4 5 6 7 8 9";
|
|
$raw_punc = "# $ % ^ & * ( ) _ - + = . , [ ] { } :";
|
|
|
|
} else {
|
|
$raw_lower = "a b c d e f g h i j k l m n o p q r s t u v w x y z";
|
|
$raw_numbers = "1 2 3 4 5 6 7 8 9 0";
|
|
$raw_punc = "# $ % ^ & * ( ) _ - + = . , [ ] { } : |";
|
|
}
|
|
|
|
$llower = explode(" ", $raw_lower);
|
|
shuffle($llower);
|
|
$lupper = explode(" ", strtoupper($raw_lower));
|
|
shuffle($lupper);
|
|
$numbers = explode(" ", $raw_numbers);
|
|
shuffle($numbers);
|
|
$punc = explode(" ", $raw_punc);
|
|
shuffle($punc);
|
|
|
|
if ($lowercase > 0)
|
|
$outarray = array_merge($outarray,a_array_rand($llower,$lowercase));
|
|
|
|
if ($uppercase > 0)
|
|
$outarray = array_merge($outarray,a_array_rand($lupper,$uppercase));
|
|
|
|
if ($digits > 0)
|
|
$outarray = array_merge($outarray,a_array_rand($numbers,$digits));
|
|
|
|
if ($punctuation > 0)
|
|
$outarray = array_merge($outarray,a_array_rand($punc,$punctuation));
|
|
|
|
$num_spec = $lowercase + $uppercase + $digits + $punctuation;
|
|
|
|
if ($num_spec < $length) {
|
|
$leftover = array();
|
|
if ($lowercase > 0)
|
|
$leftover = array_merge($leftover, $llower);
|
|
if ($uppercase > 0)
|
|
$leftover = array_merge($leftover, $lupper);
|
|
if ($digits > 0)
|
|
$leftover = array_merge($leftover, $numbers);
|
|
if ($punctuation > 0)
|
|
$leftover = array_merge($leftover, $punc);
|
|
|
|
if (count($leftover) == 0)
|
|
$leftover = array_merge($leftover,$llower,$lupper,$numbers,$punc);
|
|
|
|
shuffle($leftover);
|
|
$outarray = array_merge($outarray, a_array_rand($leftover, $criteria['num'] - $num_spec));
|
|
}
|
|
|
|
shuffle($outarray);
|
|
$return = implode('', $outarray);
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('password_generate(): Entered with (), Returning (%s)',1,$return);
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* This function returns an array of $num_req values
|
|
* randomly picked from the $input array
|
|
*
|
|
* @param array of values
|
|
* @param integer, number of values in returned array
|
|
* @return string the padded string
|
|
*/
|
|
function a_array_rand($input,$num_req) {
|
|
if (count($input) == 0)
|
|
return array();
|
|
|
|
if ($num_req < 1)
|
|
return array();
|
|
|
|
$return = array();
|
|
if ($num_req > count($input)) {
|
|
for($i = 0; $i < $num_req; $i++) {
|
|
$idx = array_rand($input, 1);
|
|
$return[] = $input[$idx];
|
|
}
|
|
|
|
} else {
|
|
$idxlist = array_rand($input, $num_req);
|
|
if ($num_req == 1)
|
|
$idxlist = array($idxlist);
|
|
|
|
for($i = 0; $i < count($idxlist); $i++)
|
|
$return[] = $input[$idxlist[$i]];
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('a_array_rand(): Entered with (%s,%s), Returning (%s)',1,serialize($input),$num_req,serialize($return));
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Returns the cached array of LDAP resources.
|
|
*
|
|
* Note that internally, this function utilizes a two-layer cache,
|
|
* one in memory using a static variable for multiple calls within
|
|
* the same page load, and one in a session for multiple calls within
|
|
* the same user session (spanning multiple page loads).
|
|
*
|
|
* @return Returns the cached attributed requested,
|
|
* or null if there is nothing cached..
|
|
*/
|
|
function get_cached_item($server_id,$item,$subitem='null') {
|
|
global $config;
|
|
|
|
# Set default return
|
|
$return = null;
|
|
|
|
# Check config to make sure session-based caching is enabled.
|
|
if ($config->GetValue('cache',$item)) {
|
|
|
|
static $cache;
|
|
if (isset($cache[$server_id][$item][$subitem])) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_cached_item(): Returning MEMORY cached [%s] (%s)',3,$item,$subitem);
|
|
|
|
$return = $cache[$server_id][$item][$subitem];
|
|
|
|
} elseif (isset($_SESSION['cache'][$server_id][$item][$subitem])) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_cached_item(): Returning SESSION cached [%s] (%s)',3,$item,$subitem);
|
|
|
|
$return = $_SESSION['cache'][$server_id][$item][$subitem];
|
|
$cache[$server_id][$item][$subitem] = $return;
|
|
|
|
}
|
|
}
|
|
|
|
if (DEBUG_ENABLED)
|
|
debug_log('get_cached_item(): Entered with (%s,%s,%s), Returning (%s)',1,
|
|
$server_id,$item,$subitem,serialize($return));
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Caches the specified $item for the specified $server_id.
|
|
*
|
|
* Returns true on success of false on failure.
|
|
*/
|
|
function set_cached_item($server_id,$item,$subitem='null',$data) {
|
|
if (DEBUG_ENABLED)
|
|
debug_log('set_cached_item(): Entered with (%s,%s,%s,%s)',2,$server_id,$item,$subitem,serialize($data));
|
|
|
|
global $config;
|
|
|
|
# Check config to make sure session-based caching is enabled.
|
|
if ($config->GetValue('cache',$item)) {
|
|
|
|
static $cache;
|
|
$cache[$server_id][$item][$subitem] = $data;
|
|
$_SESSION['cache'][$server_id][$item][$subitem] = $data;
|
|
return true;
|
|
|
|
} else
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Get the LDAP base DN for a named DN.
|
|
*
|
|
* @param string $dn DN in question
|
|
* @param object $ldapserver Server ID where DN is located
|
|
* @return string $base_dn
|
|
*/
|
|
function dn_get_base($ldapserver,$dn) {
|
|
foreach ($ldapserver->getBaseDN() as $base_dn) {
|
|
if (preg_match("/".$base_dn."$/",$dn))
|
|
return $base_dn;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Draws an HTML date selector button which, when clicked, pops up a date selector dialog.
|
|
* @param string $attr The name of the date type attribute
|
|
*/
|
|
function draw_date_selector_link( $attr ) {
|
|
debug_log(sprintf('draw_date_selector_link(): Entered with (%s)',$attr),2);
|
|
|
|
global $lang;
|
|
|
|
$href = "javascript:dateSelector('$attr');";
|
|
|
|
$title = $lang['date_selector_link'];
|
|
|
|
printf('<nobr><a href="%s" title="%s"><img class="chooser" src="images/calendar.png" id="f_trigger_%s" readonly="1" style="cursor: pointer;" /></a>',$href,$title,$attr);
|
|
echo "</nobr>";
|
|
}
|
|
|
|
# @deprecated
|
|
function get_schema_attribute ($object,$attr,$dn) {
|
|
return $object->getSchemaAttribute($attr,$dn);
|
|
}
|
|
# @deprecated
|
|
function get_schema_objectclass ($object,$oclass) {
|
|
return $object->getSchemaObjectClass($oclass);
|
|
}
|
|
|
|
?>
|