diff --git a/README.md b/README.md index 0505916..ed079ad 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ docker run \ -e "LDAP_ADMIN_BIND_PWD=secret"\ -e "LDAP_IGNORE_CERT_ERRORS=true" \ -e "EMAIL_DOMAIN=ldapusermanager.org" \ - wheelybird/ldap-user-manager:v1.7 + wheelybird/ldap-user-manager:v1.8 ``` Change the variable values to suit your environment. Now go to https://lum.example.com/setup. @@ -64,7 +64,12 @@ Change the variable values to suit your environment. Now go to https://lum.exam Configuration is via environmental variables. Please bear the following in mind: * This tool needs to bind to LDAP as a user that has the permissions to modify everything under the base DN. - * This interface is designed to work with a fresh LDAP server and should only be used against existing populated LDAP directories with caution and at your own risk. + * This interface is designed to work with a fresh LDAP server and should only be against existing, populated LDAP directories with caution and at your own risk. + +#### Containers: using files/secrets to set configuration variables + +When running the user manager as a container you can append `_FILE` to any of the configuration variables and set the value to a filepath. Then when the container starts up it will set the appropriate configuration variable with the contents of the file. +For example, if you're using Docker Swarm and you've set the LDAP bind password as a Docker secret (`echo "myLDAPadminPassword" | docker secret create ldap_admin_bind_pwd -`) then you can set `LDAP_ADMIN_BIND_PWD_FILE=/run/secrets/ldap_admin_bind_pwd`. This will result in `LDAP_ADMIN_BIND_PWD` being set with the contents of `/run/secrets/ldap_admin_bind_pwd`. ### Mandatory: @@ -87,20 +92,27 @@ Configuration is via environmental variables. Please bear the following in mind * `SERVER_HOSTNAME` (default: *ldapusername.org*): The hostname that this interface will be served from. * `SERVER_PATH` (default: */*): The path to the user manager on the webserver. Useful if running this behind a reverse proxy. - -* `SERVER_PORT` (default: *80 or 80+443*): The port the webserver inside the container will listen on. If undefined then the internal webserver will listen on ports 80 and 443 (if `NO_HTTPS` is true it's just 80) and HTTP traffic is redirected to HTTPS. When set this will disable the redirection and the internal webserver will listen for HTTPS traffic on this port (or for HTTP traffic if `NO_HTTPS` is true). This is for use when the container's Docker network mode is set to `host`. - + +* `SERVER_PORT` (default: *80 or 80 & 443*): The port the webserver inside the container will listen on. If undefined then the internal webserver will listen on ports 80 and 443 (if `NO_HTTPS` is true it's just 80) and HTTP traffic is redirected to HTTPS. When set this will disable the redirection and the internal webserver will listen for HTTPS traffic on this port (or for HTTP traffic if `NO_HTTPS` is true). This is for use when the container's Docker network mode is set to `host`. + * `NO_HTTPS` (default: *FALSE*): If you set this to *TRUE* then the server will run in HTTP mode, without any encryption. This is insecure and should only be used for testing. See [HTTPS certificates](#https-certificates) +* `SERVER_KEY_FILENAME`: (default *server.key*): The filename of the HTTPS server key file. See [HTTPS certificates](#https-certificates) + +* `SERVER_CERT_FILENAME`: (default *server.crt*): The filename of the HTTPS certficate file. See [HTTPS certificates](#https-certificates) + +* `CA_CERT_FILENAME`: (default *ca.crt*): The filename of the HTTPS server key file. See [HTTPS certificates](#https-certificates) + * `SESSION_TIMEOUT` (default: *10 minutes*): How long before an idle session will be timed out. -#### Organisation settings +#### Interface customisation * `ORGANISATION_NAME`: (default: *LDAP*): Your organisation's name. -* `SITE_NAME` (default: *{ORGANISATION_NAME} user manager*): Change this to replace the title in the menu, e.g. "My Company Account Management". - +* `SITE_NAME` (default: *`ORGANISATION_NAME` user manager*): Change this to replace the title in the menu, e.g. "My Company Account Management". + +* `SHOW_POSIX_ATTRIBUTES` (default: *FALSE*): If set to `TRUE` this show extra attributes for **posixAccount** and **posixGroup** in the account and group forms. Leave this set to `FALSE` if you don't use LDAP accounts to log into servers etc., as it makes the interface much simpler. The Posix values are still set in the background using the default values. This setting doesn't hide any Posix attributes set via `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` or `LDAP_GROUP_ADDITIONAL_ATTRIBUTES`. #### LDAP settings @@ -112,20 +124,26 @@ Configuration is via environmental variables. Please bear the following in mind * `LDAP_IGNORE_CERT_ERRORS` (default: *FALSE*): If *TRUE* then problems with the certificate presented by the LDAP server will be ignored (for example FQDN mismatches). Use this if your LDAP server is using a self-signed certificate and you don't have a CA certificate for it or you're connecting to a pool of different servers via round-robin DNS. -* `LDAP_TLS_CACERT` (no default): If you need to use a specific CA certificate for TLS connections to the LDAP server (when `LDAP_REQUIRE_STARTTLS` is set) then assign the contents of the CA certificate to this variable. e.g. `-e LDAP_TLS_CACERT="$(/opt/ca.crt - mkdir -p /etc/ldap - echo "TLS_CACERT /opt/ca.crt/" > /etc/ldap/ldap.conf + mkdir -p /etc/ldap + sed -i "s/TLS_CACERT.*/TLS_CACERT \/opt\/ca.crt/" /etc/ldap/ldap.conf fi if [ "${NO_HTTPS,,}" == "true" ]; then @@ -47,15 +58,15 @@ else ######################## #If there aren't any SSL certs then create a CA and then CA-signed certificate - if [ ! -f "${ssl_dir}/server.key" ] && [ ! -f "${ssl_dir}/server.crt" ]; then + if [ ! -f "${ssl_dir}/${SERVER_CERT_FILENAME:-server.crt}" ] && [ ! -f "${ssl_dir}/${SERVER_KEY_FILENAME:-server.key}" ]; then mkdir -p $ssl_dir confout="${ssl_dir}/conf" keyout="${ssl_dir}/server.key" certout="${ssl_dir}/server.crt" - cakey="${ssl_dir}/ca.key" - cacert="${ssl_dir}/ca.crt" - serialfile="${ssl_dir}/serial" + cakey="${ssl_dir}/.ca.key" + cacert="${ssl_dir}/.ca.crt" + serialfile="${ssl_dir}/.serial" echo "Generating CA key" openssl genrsa -out $cakey 2048 @@ -75,7 +86,7 @@ else echo "Generating openssl configuration" - cat <$confout + cat <$confout subjectAltName = DNS:${SERVER_HOSTNAME},IP:127.0.0.1 extendedKeyUsage = serverAuth EoCertConf @@ -113,7 +124,7 @@ EoCertConf ######################## #Create Apache config - if [ -f "${ssl_dir}/chain.pem" ]; then ssl_chain="SSLCertificateChainFile ${ssl_dir}/chain.pem"; fi + if [ -f "${ssl_dir}/${CA_CERT_FILENAME}" ]; then ssl_chain="SSLCertificateChainFile ${ssl_dir}/${CA_CERT_FILENAME}"; fi echo > /etc/apache2/sites-enabled/lum.conf echo > /etc/apache2/ports.conf @@ -152,8 +163,8 @@ EoHTTPrd SSLEngine On - SSLCertificateFile /opt/ssl/server.crt - SSLCertificateKeyFile /opt/ssl/server.key + SSLCertificateFile ${ssl_dir}/${SERVER_CERT_FILENAME:-server.crt} + SSLCertificateKeyFile ${ssl_dir}/${SERVER_KEY_FILENAME:-server.key} $ssl_chain @@ -161,13 +172,16 @@ EoHTTPSC fi +######################## +#If _FILE is set, read and export env_var from the referenced file's contents +env_file_replace ######################## #Run Apache # first arg is `-f` or `--some-option` if [ "${1#-}" != "$1" ]; then - set -- apache2-foreground "$@" + set -- apache2-foreground "$@" fi exec "$@" diff --git a/www/account_manager/download.php b/www/account_manager/download.php new file mode 100644 index 0000000..04734b4 --- /dev/null +++ b/www/account_manager/download.php @@ -0,0 +1,41 @@ + diff --git a/www/account_manager/groups.php b/www/account_manager/groups.php index 99a5d70..b6d865d 100644 --- a/www/account_manager/groups.php +++ b/www/account_manager/groups.php @@ -14,37 +14,18 @@ $ldap_connection = open_ldap_connection(); if (isset($_POST['delete_group'])) { - ?> - - - - $this_group was deleted."); } else { - ?> - - $this_group wasn't deleted. See the logs for more information.","danger",15000); } - } $groups = ldap_get_group_list($ldap_connection); @@ -72,18 +53,28 @@ render_js_username_check();
/show_group.php" method="post"> - group   +  
- + - + + \n \n \n"; diff --git a/www/account_manager/index.php b/www/account_manager/index.php index 72bc478..c6d5e28 100644 --- a/www/account_manager/index.php +++ b/www/account_manager/index.php @@ -14,46 +14,29 @@ $ldap_connection = open_ldap_connection(); if (isset($_POST['delete_user'])) { - ?> - - - - $this_user was deleted."); } else { - ?> - - $this_user wasn't deleted. See the logs for more information.","danger",15000); } } -#' + $people = ldap_get_user_list($ldap_connection); ?>
- account   - +   + +
Group name
$group
@@ -64,7 +47,17 @@ $people = ldap_get_user_list($ldap_connection); - + + $attribs){ diff --git a/www/account_manager/new_user.php b/www/account_manager/new_user.php index bbaa1ac..7a8e4eb 100644 --- a/www/account_manager/new_user.php +++ b/www/account_manager/new_user.php @@ -6,29 +6,37 @@ include_once "web_functions.inc.php"; include_once "ldap_functions.inc.php"; include_once "module_functions.inc.php"; -$attribute_map = ldap_complete_account_attribute_array(); +$attribute_map = $LDAP['default_attribute_map']; +if (isset($LDAP['account_additional_attributes'])) { $attribute_map = ldap_complete_attribute_array($attribute_map,$LDAP['account_additional_attributes']); } +unset($attribute_map['uidnumber']); +unset($attribute_map['gidnumber']); + +if (! array_key_exists($LDAP['account_attribute'], $attribute_map)) { + $attribute_r = array_merge($attribute_map, array($LDAP['account_attribute'] => array("label" => "Account UID"))); +} if ( isset($_POST['setup_admin_account']) ) { - $admin_setup = TRUE; - validate_setup_cookie(); - set_page_access("setup"); + $admin_setup = TRUE; - $completed_action="${SERVER_PATH}log_in"; - $page_title="New administrator account"; + validate_setup_cookie(); + set_page_access("setup"); - render_header("$ORGANISATION_NAME account manager - setup administrator account", FALSE); + $completed_action="${SERVER_PATH}log_in"; + $page_title="New administrator account"; + + render_header("$ORGANISATION_NAME account manager - setup administrator account", FALSE); } else { - set_page_access("admin"); + set_page_access("admin"); - $completed_action="${THIS_MODULE_PATH}/"; - $page_title="New account"; - $admin_setup = FALSE; + $completed_action="${THIS_MODULE_PATH}/"; + $page_title="New account"; + $admin_setup = FALSE; - render_header("$ORGANISATION_NAME account manager"); - render_submenu(); + render_header("$ORGANISATION_NAME account manager"); + render_submenu(); } $invalid_password = FALSE; @@ -39,45 +47,72 @@ $invalid_email = FALSE; $disabled_email_tickbox = TRUE; $invalid_cn = FALSE; $invalid_account_identifier = FALSE; +$account_attribute = $LDAP['account_attribute']; $new_account_r = array(); foreach ($attribute_map as $attribute => $attr_r) { - if (isset($_POST[$attribute])) { - $$attribute = filter_var($_POST[$attribute], FILTER_SANITIZE_STRING); - } - elseif (isset($attr_r['default'])) { - $$attribute = $attr_r['default']; - } - if (isset($$attribute)) { $new_account_r[$attribute] = $$attribute; } + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $new_account_r[$attribute] = $this_attribute; + unset($new_account_r[$attribute]['count']); + + } + + if (isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute]) and count($_POST[$attribute]) > 0) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + if (count($this_attribute) > 0) { + $this_attribute['count'] = count($this_attribute); + $$attribute = $this_attribute; + } + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $$attribute = $this_attribute; + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + if (isset($$attribute)) { + $new_account_r[$attribute] = $$attribute; + unset($new_account_r[$attribute]['count']); + } + } ## if (isset($_GET['account_request'])) { - $givenname=filter_var($_GET['first_name'], FILTER_SANITIZE_STRING); + $givenname[0]=filter_var($_GET['first_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); $new_account_r['givenname'] = $givenname; + unset($new_account_r['givenname']['count']); - $sn=filter_var($_GET['last_name'], FILTER_SANITIZE_STRING); + $sn[0]=filter_var($_GET['last_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); $new_account_r['sn'] = $sn; + unset($new_account_r['sn']['count']); - $uid = generate_username($givenname,$sn); - $new_account_r['uid'] = $uid; - - if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) { - $cn = "$givenname$sn"; - } - else { - $cn = "$givenname $sn"; - } - - $new_account_r['cn'] = $cn; - - $mail=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); - if ($mail == "") { + $mail[0]=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); + if ($mail[0] == "") { if (isset($EMAIL_DOMAIN)) { - $mail = $uid . "@" . $EMAIL_DOMAIN; + $mail[0] = $uid . "@" . $EMAIL_DOMAIN; $disabled_email_tickbox = FALSE; } } @@ -85,27 +120,56 @@ if (isset($_GET['account_request'])) { $disabled_email_tickbox = FALSE; } $new_account_r['mail'] = $mail; + unset($new_account_r['mail']['count']); } + +if (isset($_GET['account_request']) or isset($_POST['create_account'])) { + + if (!isset($uid[0])) { + $uid[0] = generate_username($givenname[0],$sn[0]); + $new_account_r['uid'] = $uid; + unset($new_account_r['uid']['count']); + } + + if (!isset($cn[0])) { + if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) { + $cn[0] = $givenname[0] . $sn[0]; + } + else { + $cn[0] = $givenname[0] . " " . $sn[0]; + } + $new_account_r['cn'] = $cn; + unset($new_account_r['cn']['count']); + } + +} + + if (isset($_POST['create_account'])) { $password = $_POST['password']; - $new_account_r['password'] = $password; - $account_identifier = $new_account_r[$LDAP["account_attribute"]]; + $new_account_r['password'][0] = $password; + $account_identifier = $new_account_r[$account_attribute][0]; + $this_cn=$cn[0]; + $this_mail=$mail[0]; + $this_givenname=$givenname[0]; + $this_sn=$sn[0]; + $this_password=$password[0]; - if (!isset($cn) or $cn == "") { $invalid_cn = TRUE; } + if (!isset($this_cn) or $this_cn == "") { $invalid_cn = TRUE; } if ((!isset($account_identifier) or $account_identifier == "") and $invalid_cn != TRUE) { $invalid_account_identifier = TRUE; } if ((!is_numeric($_POST['pass_score']) or $_POST['pass_score'] < 3) and $ACCEPT_WEAK_PASSWORDS != TRUE) { $weak_password = TRUE; } - if (isset($mail) and !is_valid_email($mail)) { $invalid_email = TRUE; } + if (isset($this_mail) and !is_valid_email($this_mail)) { $invalid_email = TRUE; } if (preg_match("/\"|'/",$password)) { $invalid_password = TRUE; } if ($password != $_POST['password_match']) { $mismatched_passwords = TRUE; } - if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE and !preg_match("/$POSIX_REGEX/",$account_identifier)) { $invalid_account_identifier = TRUE; } + if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE and !preg_match("/$USERNAME_REGEX/",$account_identifier)) { $invalid_account_identifier = TRUE; } if (isset($_POST['send_email']) and isset($mail) and $EMAIL_SENDING_ENABLED == TRUE) { $send_user_email = TRUE; } - if ( isset($givenname) - and isset($sn) - and isset($password) + if ( isset($this_givenname) + and isset($this_sn) + and isset($this_password) and !$mismatched_passwords and !$weak_password and !$invalid_password @@ -124,13 +188,13 @@ if (isset($_POST['create_account'])) { include_once "mail_functions.inc.php"; - $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $givenname, $sn); - $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $givenname, $sn); + $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $this_givenname, $this_sn); + $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $this_givenname, $this_sn); - $sent_email = send_email($mail,"$givenname $sn",$mail_subject,$mail_body); + $sent_email = send_email($this_mail,"$this_givenname $this_sn",$mail_subject,$mail_body); $creation_message = "The account was created"; if ($sent_email) { - $creation_message .= " and an email sent to $mail."; + $creation_message .= " and an email sent to $this_mail."; } else { $creation_message .= " but unfortunately the email wasn't sent.
More information will be available in the logs."; @@ -189,7 +253,7 @@ if (isset($_POST['create_account'])) { $errors=""; if ($invalid_cn) { $errors.="
  • The Common Name is required
    • \n"; } -if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$LDAP['account_attribute']]['label'] . ") is invalid.
    • \n"; } +if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$account_attribute]['label'] . ") is invalid.
    • \n"; } if ($weak_password) { $errors.="
  • The password is too weak
    • \n"; } if ($invalid_password) { $errors.="
  • The password contained invalid characters
    • \n"; } if ($invalid_email) { $errors.="
  • The email address is invalid
    • \n"; } @@ -212,6 +276,7 @@ render_js_username_check(); render_js_username_generator('givenname','sn','uid','uid_div'); render_js_cn_generator('givenname','sn','cn','cn_div'); render_js_email_generator('uid','mail'); +render_js_homedir_generator('uid','homedirectory'); $tabindex=1; @@ -273,37 +338,32 @@ $tabindex=1; + +
    -
    +
    -
    + - - $attr_r) { - $label = $attr_r['label']; - if ($attribute == $LDAP['account_attribute']) { $label = "$label*"; } - ?> -
    - -
    - > -
    -
    - + $attr_r) { + $label = $attr_r['label']; + if (isset($attr_r['onkeyup'])) { $onkeyup = $attr_r['onkeyup']; } else { $onkeyup = ""; } + if ($attribute == $LDAP['account_attribute']) { $label = "$label*"; } + if (isset($$attribute)) { $these_values=$$attribute; } else { $these_values = array(); } + if (isset($attr_r['inputtype'])) { $inputtype = $attr_r['inputtype']; } else { $inputtype = ""; } + render_attribute_fields($attribute,$label,$these_values,"",$onkeyup,$inputtype,$tabindex); + $tabindex++; + } + ?>
    diff --git a/www/account_manager/show_group.php b/www/account_manager/show_group.php index 86cfdab..08a05f4 100644 --- a/www/account_manager/show_group.php +++ b/www/account_manager/show_group.php @@ -12,114 +12,225 @@ render_submenu(); $ldap_connection = open_ldap_connection(); - if (!isset($_POST['group_name']) and !isset($_GET['group_name'])) { ?>

    The group name is missing.

    The group name is invalid.

    $attr_r) { + + if (isset($this_group[0][$attribute]) and $this_group[0][$attribute]['count'] > 0) { + $$attribute = $this_group[0][$attribute]; + } + else { + $$attribute = array(); + } + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + + } + + if (isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute])) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + $this_attribute['count'] = count($this_attribute); + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + + if ($this_attribute != $$attribute) { + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + +} + +if (!isset($gidnumber[0]) or !is_numeric($gidnumber[0])) { + $gidnumber[0]=ldap_get_highest_id($ldap_connection,$type="gid"); + $gidnumber['count']=1; +} + +###################################################################################### $all_accounts = ldap_get_user_list($ldap_connection); $all_people = array(); foreach ($all_accounts as $this_person => $attrs) { - array_push($all_people, $this_person); + array_push($all_people, $this_person); } $non_members = array_diff($all_people,$current_members); if (isset($_POST["update_members"])) { - $updated_membership = array(); + $updated_membership = array(); - foreach ($_POST as $index => $member) { - - if (is_numeric($index)) { - array_push($updated_membership,$member); + foreach ($_POST['membership'] as $index => $member) { + if (is_numeric($index)) { + array_push($updated_membership,filter_var($member, FILTER_SANITIZE_FULL_SPECIAL_CHARS)); + } } - } - if ($group_cn == $LDAP['admins_group'] and !array_search($USER_ID, $updated_membership)){ - array_push($updated_membership,$USER_ID); - } + if ($group_cn == $LDAP['admins_group'] and !array_search($USER_ID, $updated_membership)){ + array_push($updated_membership,$USER_ID); + } - $members_to_del = array_diff($current_members,$updated_membership); - $members_to_add = array_diff($updated_membership,$current_members); + $members_to_del = array_diff($current_members,$updated_membership); + $members_to_add = array_diff($updated_membership,$current_members); - if ($initialise_group == TRUE) { - $initial_member = array_shift($members_to_add); - $group_add = ldap_new_group($ldap_connection,$group_cn,$initial_member); - } - foreach ($members_to_add as $this_member) { - ldap_add_member_to_group($ldap_connection,$group_cn,$this_member); - } + if ($initialise_group == TRUE) { - foreach ($members_to_del as $this_member) { - ldap_delete_member_from_group($ldap_connection,$group_cn,$this_member); - } + $initial_member = array_shift($members_to_add); + $group_add = ldap_new_group($ldap_connection,$group_cn,$initial_member,$to_update); + if (!$group_add) { + render_alert_banner("There was a problem creating the group. See the logs for more information.","danger",10000); + $group_exists = FALSE; + $new_group = TRUE; + } + else { + $group_exists = TRUE; + $new_group = FALSE; + } - $non_members = array_diff($all_people,$updated_membership); - $group_members = $updated_membership; + } - ?> - - + if ($group_exists == TRUE) { - 0) { + + if (isset($this_group[0]['objectclass'])) { + $existing_objectclasses = $this_group[0]['objectclass']; + unset($existing_objectclasses['count']); + if ($existing_objectclasses != $LDAP['group_objectclasses']) { $to_update['objectclass'] = $LDAP['group_objectclasses']; } + } + + $updated_attr = ldap_update_group_attributes($ldap_connection,$group_cn,$to_update); + + if ($updated_attr) { + render_alert_banner("The group attributes have been updated."); + } + else { + render_alert_banner("There was a problem updating the group attributes. See the logs for more information.","danger",15000); + } + + } + + foreach ($members_to_add as $this_member) { + ldap_add_member_to_group($ldap_connection,$group_cn,$this_member); + } + + foreach ($members_to_del as $this_member) { + ldap_delete_member_from_group($ldap_connection,$group_cn,$this_member); + } + + $non_members = array_diff($all_people,$updated_membership); + $group_members = $updated_membership; + + $rfc2307bis_available = ldap_detect_rfc2307bis($ldap_connection); + if ($rfc2307bis_available == TRUE and count($group_members) == 0) { + + $group_members = ldap_get_group_members($ldap_connection,$group_cn); + $non_members = array_diff($all_people,$group_members); + render_alert_banner("Groups can't be empty, so the final member hasn't been removed. You could try deleting the group","danger",15000); + } + else { + render_alert_banner("The group has been ${has_been}."); + } + + } + else { + + $group_members = array(); + $non_members = $all_people; + + } } else { - $group_members = $current_members; + + $group_members = $current_members; + } ldap_close($ldap_connection); @@ -147,7 +258,7 @@ ldap_close($ldap_connection); for (var i = 0; i < member_list.length; ++i) { var hidden = document.createElement("input"); hidden.type = "hidden"; - hidden.name = i; + hidden.name = 'membership[]'; hidden.value = member_list[i]['textContent']; members_form.appendChild(hidden); @@ -175,7 +286,10 @@ ldap_close($ldap_connection); $('.list-right ul li.active').removeClass('active'); actives.remove(); } - $("#submit_members").prop("disabled", false); + if ($("#membership_list").length > 0) { + $("#submit_members").prop("disabled", false); + $("#submit_attributes").prop("disabled", false); + } }); $('.dual-list .selector').click(function () { var $checkBox = $(this); @@ -226,99 +340,130 @@ ldap_close($ldap_connection); -
    +
    +
    +
    -
    -
    -

    (admin group)" ; } ?>

    - - /groups.php" method="post"> -
    -
      -
      • - -
      +
      +

      (admin group)" ; } ?>

      + +
      /groups.php" method="post" enctype="multipart/form-data"> +
      -
      +
        +
        • + -
        - Members -
        +
        -
        -
        - - +
        + Members +
        +
        +
        +
        + + +
        +
        +
        +
        + +
        +
        +
        +
          + $member
        \n"; + } + else { + print "
      • $member
        • \n"; + } + } + ?> +
      +
      -
    -
    -
    - +
    + + +
    + + + + +
    + +
    + Available accounts +
    +
    +
    +
    + +
    +
    +
    +
    + + +
    +
    +
    +
      + $nonmember\n"; + } + ?> +
    +
    -
    -
      - $member
    \n"; - } - else { - print "
  • $member
    • \n"; - } - } - ?> - -
    - -
    - - - /show_group.php" method="post"> - - - - - -
    - -
    - Available accounts -
    -
    -
    -
    - -
    -
    -
    -
    - - -
    -
    -
    -
      - $nonmember\n"; - } - ?> -
    -
    -
    - -
    -
    - - - +
    + +if (count($attribute_map) > 0) { ?> +
    +
    +

    Group attributes

    +
    +
    +
    + $attr_r) { + $label = $attr_r['label']; + if (isset($$attribute)) { $these_values=$$attribute; } else { $these_values = array(); } + print "
    "; + $dl_identifider = ($full_dn != $create_group_message) ? $full_dn : ""; + if (isset($attr_r['inputtype'])) { $inputtype = $attr_r['inputtype']; } else { $inputtype=""; } + render_attribute_fields($attribute,$label,$these_values,$dl_identifider,"",$inputtype,$tabindex); + print "
    "; + $tabindex++; + } + ?> +
    +
    +
    + +
    +
    +
    +
    +
    +
    + + +
    +
    +
    + diff --git a/www/account_manager/show_user.php b/www/account_manager/show_user.php index c062008..8ea59d2 100644 --- a/www/account_manager/show_user.php +++ b/www/account_manager/show_user.php @@ -18,13 +18,13 @@ $to_update = array(); if ($SMTP['host'] != "") { $can_send_email = TRUE; } else { $can_send_email = FALSE; } -$LDAP['default_attribute_map']["uidnumber"] = array("label" => "UID"); -$LDAP['default_attribute_map']["gidnumber"] = array("label" => "GID"); -$LDAP['default_attribute_map']["loginshell"] = array("label" => "Login shell"); -$LDAP['default_attribute_map']["homedirectory"] = array("label" => "Home directory"); $LDAP['default_attribute_map']["mail"] = array("label" => "Email", "onkeyup" => "check_if_we_should_enable_sending_email();"); -$attribute_map = ldap_complete_account_attribute_array(); +$attribute_map = $LDAP['default_attribute_map']; +if (isset($LDAP['account_additional_attributes'])) { $attribute_map = ldap_complete_attribute_array($attribute_map,$LDAP['account_additional_attributes']); } +if (! array_key_exists($LDAP['account_attribute'], $attribute_map)) { + $attribute_r = array_merge($attribute_map, array($LDAP['account_attribute'] => array("label" => "Account UID"))); +} if (!isset($_POST['account_identifier']) and !isset($_GET['account_identifier'])) { ?> @@ -44,30 +44,98 @@ $ldap_connection = open_ldap_connection(); $ldap_search_query="(${LDAP['account_attribute']}=". ldap_escape($account_identifier, "", LDAP_ESCAPE_FILTER) . ")"; $ldap_search = ldap_search( $ldap_connection, $LDAP['user_dn'], $ldap_search_query); + +######################### + if ($ldap_search) { $user = ldap_get_entries($ldap_connection, $ldap_search); - foreach ($attribute_map as $attribute => $attr_r) { + if ($user["count"] > 0) { - $$attribute = $user[0][$attribute][0]; + foreach ($attribute_map as $attribute => $attr_r) { - if (isset($_POST['update_account']) and isset($_POST[$attribute]) and $_POST[$attribute] != $$attribute) { - $$attribute = filter_var($_POST[$attribute], FILTER_SANITIZE_STRING); - $to_update[$attribute] = $$attribute; - } - elseif (isset($attr_r['default'])) { - $$attribute = $attr_r['default']; - } + if (isset($user[0][$attribute]) and $user[0][$attribute]['count'] > 0) { + $$attribute = $user[0][$attribute]; + } + else { + $$attribute = array(); + } + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + + } + + if (isset($_POST['update_account']) and isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute])) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + $this_attribute['count'] = count($this_attribute); + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + + if ($this_attribute != $$attribute) { + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + } + $dn = $user[0]['dn']; } - $dn = $user[0]['dn']; - + else { + ?> +
    +

    This account doesn't exist.

    +
    + - - - - - - - - - - + + +
    Member of