From 57af7c4e9c9e264dcb6f894de105b694f9ed5531 Mon Sep 17 00:00:00 2001 From: Brian Lycett Date: Tue, 12 Apr 2022 15:43:21 +0100 Subject: [PATCH] Next release (#151) * Custom email body (#51) * get email body from ENV * read subject from env * html mail * replace special string with username and password * missing ; * more str_replace * utf8 in mail * typo * docs * fix var * count accounts * fix print * Add the ability to set the server path. Get directed to the appropriate module when you log in. * Fixes to allow overriding attribute labels properly * Fix server_path in various places, update to cookies use 'samesite', include boostrap and queryjs files so LUM can run without internet access. * Add support for consuming docker / kubernetes secrets passed as _FILE environment variables (#136) * mod: condense Dockerfile * add: _FILE feature add: list of sensitive env_vars * mod: sorted env_var list * add: complete current env_var list * fix: formatting * mod: revert Dockerfile to prev. version * mod: updated comment to be more descriptive mod: rename variables to be more descriptive * rem: list of env_var; no longer needed. mod: env_file_replace function ^ search for all _FILE variables and replace ^ if the file exists and is not empty mod: env_file_replace comment Co-authored-by: pyunramura * Update the README with information on using _FILE * Change username regex variables * Named server certs, as suggested by @huzvar * Update LDAP filter method as suggested by @xgaia * Feature/http header username (#120) * Implement Remote Headers Auth * Hide Logout on Remote Sessions * Add Explanation for REMOTRE_HTTP_HEADERS_LOGIN settiing Co-authored-by: Damian Galli * Updated Readme, fixed random number generation for ARM systems, fixed JS to generate the username * Fix issues #124 and #126 * Change badges to buttons for list counts * Don't secretly set displayName * Add Group Additional (#113) * Add doku Group additional. * Read Group additional configuration. * New group add Additional objectclasses * Allow for attributes that take multiple values. * Updated README * Formatting fixes, fix parsing params from account requests, initial code for the simple interface flag. * Add attribute fields for groups and allow user-defined attributes to be displayed. Move alert banner JS to a function. * Update entries with any missing additional objectclasses when updating entries. Update README to describe changes. Initial work to allow file uploads for attributes. * Functionality to upload binary files and display them in the form it's a JPEG. Added a new page to download existing binary content. * Bugfixes for compatibility with older osixia/openldap versions. Change SIMPLE_INTERFACE to SHOW_POSIX_ATTRIBUTES. * Update version number in README. Co-authored-by: Monsieur X Co-authored-by: pyunramura <35285259+pyunramura@users.noreply.github.com> Co-authored-by: pyunramura Co-authored-by: Damian Galli Co-authored-by: Damian Galli Co-authored-by: huzvar <89766648+huzvar@users.noreply.github.com> --- README.md | 115 +++++--- entrypoint | 36 ++- www/account_manager/download.php | 41 +++ www/account_manager/groups.php | 39 +-- www/account_manager/index.php | 41 ++- www/account_manager/new_user.php | 200 ++++++++----- www/account_manager/show_group.php | 429 +++++++++++++++++++--------- www/account_manager/show_user.php | 234 ++++++++------- www/change_password/index.php | 13 +- www/includes/config.inc.php | 131 +++++---- www/includes/ldap_functions.inc.php | 358 +++++++++++++---------- www/includes/modules.inc.php | 4 +- www/includes/web_functions.inc.php | 323 +++++++++++++++++---- www/log_in/index.php | 2 +- www/request_account/index.php | 45 +-- 15 files changed, 1324 insertions(+), 687 deletions(-) create mode 100644 www/account_manager/download.php diff --git a/README.md b/README.md index 0505916..ed079ad 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ docker run \ -e "LDAP_ADMIN_BIND_PWD=secret"\ -e "LDAP_IGNORE_CERT_ERRORS=true" \ -e "EMAIL_DOMAIN=ldapusermanager.org" \ - wheelybird/ldap-user-manager:v1.7 + wheelybird/ldap-user-manager:v1.8 ``` Change the variable values to suit your environment. Now go to https://lum.example.com/setup. @@ -64,7 +64,12 @@ Change the variable values to suit your environment. Now go to https://lum.exam Configuration is via environmental variables. Please bear the following in mind: * This tool needs to bind to LDAP as a user that has the permissions to modify everything under the base DN. - * This interface is designed to work with a fresh LDAP server and should only be used against existing populated LDAP directories with caution and at your own risk. + * This interface is designed to work with a fresh LDAP server and should only be against existing, populated LDAP directories with caution and at your own risk. + +#### Containers: using files/secrets to set configuration variables + +When running the user manager as a container you can append `_FILE` to any of the configuration variables and set the value to a filepath. Then when the container starts up it will set the appropriate configuration variable with the contents of the file. +For example, if you're using Docker Swarm and you've set the LDAP bind password as a Docker secret (`echo "myLDAPadminPassword" | docker secret create ldap_admin_bind_pwd -`) then you can set `LDAP_ADMIN_BIND_PWD_FILE=/run/secrets/ldap_admin_bind_pwd`. This will result in `LDAP_ADMIN_BIND_PWD` being set with the contents of `/run/secrets/ldap_admin_bind_pwd`. ### Mandatory: @@ -87,20 +92,27 @@ Configuration is via environmental variables. Please bear the following in mind * `SERVER_HOSTNAME` (default: *ldapusername.org*): The hostname that this interface will be served from. * `SERVER_PATH` (default: */*): The path to the user manager on the webserver. Useful if running this behind a reverse proxy. - -* `SERVER_PORT` (default: *80 or 80+443*): The port the webserver inside the container will listen on. If undefined then the internal webserver will listen on ports 80 and 443 (if `NO_HTTPS` is true it's just 80) and HTTP traffic is redirected to HTTPS. When set this will disable the redirection and the internal webserver will listen for HTTPS traffic on this port (or for HTTP traffic if `NO_HTTPS` is true). This is for use when the container's Docker network mode is set to `host`. - + +* `SERVER_PORT` (default: *80 or 80 & 443*): The port the webserver inside the container will listen on. If undefined then the internal webserver will listen on ports 80 and 443 (if `NO_HTTPS` is true it's just 80) and HTTP traffic is redirected to HTTPS. When set this will disable the redirection and the internal webserver will listen for HTTPS traffic on this port (or for HTTP traffic if `NO_HTTPS` is true). This is for use when the container's Docker network mode is set to `host`. + * `NO_HTTPS` (default: *FALSE*): If you set this to *TRUE* then the server will run in HTTP mode, without any encryption. This is insecure and should only be used for testing. See [HTTPS certificates](#https-certificates) +* `SERVER_KEY_FILENAME`: (default *server.key*): The filename of the HTTPS server key file. See [HTTPS certificates](#https-certificates) + +* `SERVER_CERT_FILENAME`: (default *server.crt*): The filename of the HTTPS certficate file. See [HTTPS certificates](#https-certificates) + +* `CA_CERT_FILENAME`: (default *ca.crt*): The filename of the HTTPS server key file. See [HTTPS certificates](#https-certificates) + * `SESSION_TIMEOUT` (default: *10 minutes*): How long before an idle session will be timed out. -#### Organisation settings +#### Interface customisation * `ORGANISATION_NAME`: (default: *LDAP*): Your organisation's name. -* `SITE_NAME` (default: *{ORGANISATION_NAME} user manager*): Change this to replace the title in the menu, e.g. "My Company Account Management". - +* `SITE_NAME` (default: *`ORGANISATION_NAME` user manager*): Change this to replace the title in the menu, e.g. "My Company Account Management". + +* `SHOW_POSIX_ATTRIBUTES` (default: *FALSE*): If set to `TRUE` this show extra attributes for **posixAccount** and **posixGroup** in the account and group forms. Leave this set to `FALSE` if you don't use LDAP accounts to log into servers etc., as it makes the interface much simpler. The Posix values are still set in the background using the default values. This setting doesn't hide any Posix attributes set via `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` or `LDAP_GROUP_ADDITIONAL_ATTRIBUTES`. #### LDAP settings @@ -112,20 +124,26 @@ Configuration is via environmental variables. Please bear the following in mind * `LDAP_IGNORE_CERT_ERRORS` (default: *FALSE*): If *TRUE* then problems with the certificate presented by the LDAP server will be ignored (for example FQDN mismatches). Use this if your LDAP server is using a self-signed certificate and you don't have a CA certificate for it or you're connecting to a pool of different servers via round-robin DNS. -* `LDAP_TLS_CACERT` (no default): If you need to use a specific CA certificate for TLS connections to the LDAP server (when `LDAP_REQUIRE_STARTTLS` is set) then assign the contents of the CA certificate to this variable. e.g. `-e LDAP_TLS_CACERT="$(/opt/ca.crt - mkdir -p /etc/ldap - echo "TLS_CACERT /opt/ca.crt/" > /etc/ldap/ldap.conf + mkdir -p /etc/ldap + sed -i "s/TLS_CACERT.*/TLS_CACERT \/opt\/ca.crt/" /etc/ldap/ldap.conf fi if [ "${NO_HTTPS,,}" == "true" ]; then @@ -47,15 +58,15 @@ else ######################## #If there aren't any SSL certs then create a CA and then CA-signed certificate - if [ ! -f "${ssl_dir}/server.key" ] && [ ! -f "${ssl_dir}/server.crt" ]; then + if [ ! -f "${ssl_dir}/${SERVER_CERT_FILENAME:-server.crt}" ] && [ ! -f "${ssl_dir}/${SERVER_KEY_FILENAME:-server.key}" ]; then mkdir -p $ssl_dir confout="${ssl_dir}/conf" keyout="${ssl_dir}/server.key" certout="${ssl_dir}/server.crt" - cakey="${ssl_dir}/ca.key" - cacert="${ssl_dir}/ca.crt" - serialfile="${ssl_dir}/serial" + cakey="${ssl_dir}/.ca.key" + cacert="${ssl_dir}/.ca.crt" + serialfile="${ssl_dir}/.serial" echo "Generating CA key" openssl genrsa -out $cakey 2048 @@ -75,7 +86,7 @@ else echo "Generating openssl configuration" - cat <$confout + cat <$confout subjectAltName = DNS:${SERVER_HOSTNAME},IP:127.0.0.1 extendedKeyUsage = serverAuth EoCertConf @@ -113,7 +124,7 @@ EoCertConf ######################## #Create Apache config - if [ -f "${ssl_dir}/chain.pem" ]; then ssl_chain="SSLCertificateChainFile ${ssl_dir}/chain.pem"; fi + if [ -f "${ssl_dir}/${CA_CERT_FILENAME}" ]; then ssl_chain="SSLCertificateChainFile ${ssl_dir}/${CA_CERT_FILENAME}"; fi echo > /etc/apache2/sites-enabled/lum.conf echo > /etc/apache2/ports.conf @@ -152,8 +163,8 @@ EoHTTPrd SSLEngine On - SSLCertificateFile /opt/ssl/server.crt - SSLCertificateKeyFile /opt/ssl/server.key + SSLCertificateFile ${ssl_dir}/${SERVER_CERT_FILENAME:-server.crt} + SSLCertificateKeyFile ${ssl_dir}/${SERVER_KEY_FILENAME:-server.key} $ssl_chain @@ -161,13 +172,16 @@ EoHTTPSC fi +######################## +#If _FILE is set, read and export env_var from the referenced file's contents +env_file_replace ######################## #Run Apache # first arg is `-f` or `--some-option` if [ "${1#-}" != "$1" ]; then - set -- apache2-foreground "$@" + set -- apache2-foreground "$@" fi exec "$@" diff --git a/www/account_manager/download.php b/www/account_manager/download.php new file mode 100644 index 0000000..04734b4 --- /dev/null +++ b/www/account_manager/download.php @@ -0,0 +1,41 @@ + diff --git a/www/account_manager/groups.php b/www/account_manager/groups.php index 99a5d70..b6d865d 100644 --- a/www/account_manager/groups.php +++ b/www/account_manager/groups.php @@ -14,37 +14,18 @@ $ldap_connection = open_ldap_connection(); if (isset($_POST['delete_group'])) { - ?> - - - - $this_group was deleted."); } else { - ?> - - $this_group wasn't deleted. See the logs for more information.","danger",15000); } - } $groups = ldap_get_group_list($ldap_connection); @@ -72,18 +53,28 @@ render_js_username_check();
/show_group.php" method="post"> - group   +  
- + - + + \n \n \n"; diff --git a/www/account_manager/index.php b/www/account_manager/index.php index 72bc478..c6d5e28 100644 --- a/www/account_manager/index.php +++ b/www/account_manager/index.php @@ -14,46 +14,29 @@ $ldap_connection = open_ldap_connection(); if (isset($_POST['delete_user'])) { - ?> - - - - $this_user was deleted."); } else { - ?> - - $this_user wasn't deleted. See the logs for more information.","danger",15000); } } -#' + $people = ldap_get_user_list($ldap_connection); ?>
- account   - +   + +
Group name
$group
@@ -64,7 +47,17 @@ $people = ldap_get_user_list($ldap_connection); - + + $attribs){ diff --git a/www/account_manager/new_user.php b/www/account_manager/new_user.php index bbaa1ac..7a8e4eb 100644 --- a/www/account_manager/new_user.php +++ b/www/account_manager/new_user.php @@ -6,29 +6,37 @@ include_once "web_functions.inc.php"; include_once "ldap_functions.inc.php"; include_once "module_functions.inc.php"; -$attribute_map = ldap_complete_account_attribute_array(); +$attribute_map = $LDAP['default_attribute_map']; +if (isset($LDAP['account_additional_attributes'])) { $attribute_map = ldap_complete_attribute_array($attribute_map,$LDAP['account_additional_attributes']); } +unset($attribute_map['uidnumber']); +unset($attribute_map['gidnumber']); + +if (! array_key_exists($LDAP['account_attribute'], $attribute_map)) { + $attribute_r = array_merge($attribute_map, array($LDAP['account_attribute'] => array("label" => "Account UID"))); +} if ( isset($_POST['setup_admin_account']) ) { - $admin_setup = TRUE; - validate_setup_cookie(); - set_page_access("setup"); + $admin_setup = TRUE; - $completed_action="${SERVER_PATH}log_in"; - $page_title="New administrator account"; + validate_setup_cookie(); + set_page_access("setup"); - render_header("$ORGANISATION_NAME account manager - setup administrator account", FALSE); + $completed_action="${SERVER_PATH}log_in"; + $page_title="New administrator account"; + + render_header("$ORGANISATION_NAME account manager - setup administrator account", FALSE); } else { - set_page_access("admin"); + set_page_access("admin"); - $completed_action="${THIS_MODULE_PATH}/"; - $page_title="New account"; - $admin_setup = FALSE; + $completed_action="${THIS_MODULE_PATH}/"; + $page_title="New account"; + $admin_setup = FALSE; - render_header("$ORGANISATION_NAME account manager"); - render_submenu(); + render_header("$ORGANISATION_NAME account manager"); + render_submenu(); } $invalid_password = FALSE; @@ -39,45 +47,72 @@ $invalid_email = FALSE; $disabled_email_tickbox = TRUE; $invalid_cn = FALSE; $invalid_account_identifier = FALSE; +$account_attribute = $LDAP['account_attribute']; $new_account_r = array(); foreach ($attribute_map as $attribute => $attr_r) { - if (isset($_POST[$attribute])) { - $$attribute = filter_var($_POST[$attribute], FILTER_SANITIZE_STRING); - } - elseif (isset($attr_r['default'])) { - $$attribute = $attr_r['default']; - } - if (isset($$attribute)) { $new_account_r[$attribute] = $$attribute; } + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $new_account_r[$attribute] = $this_attribute; + unset($new_account_r[$attribute]['count']); + + } + + if (isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute]) and count($_POST[$attribute]) > 0) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + if (count($this_attribute) > 0) { + $this_attribute['count'] = count($this_attribute); + $$attribute = $this_attribute; + } + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $$attribute = $this_attribute; + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + if (isset($$attribute)) { + $new_account_r[$attribute] = $$attribute; + unset($new_account_r[$attribute]['count']); + } + } ## if (isset($_GET['account_request'])) { - $givenname=filter_var($_GET['first_name'], FILTER_SANITIZE_STRING); + $givenname[0]=filter_var($_GET['first_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); $new_account_r['givenname'] = $givenname; + unset($new_account_r['givenname']['count']); - $sn=filter_var($_GET['last_name'], FILTER_SANITIZE_STRING); + $sn[0]=filter_var($_GET['last_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); $new_account_r['sn'] = $sn; + unset($new_account_r['sn']['count']); - $uid = generate_username($givenname,$sn); - $new_account_r['uid'] = $uid; - - if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) { - $cn = "$givenname$sn"; - } - else { - $cn = "$givenname $sn"; - } - - $new_account_r['cn'] = $cn; - - $mail=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); - if ($mail == "") { + $mail[0]=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); + if ($mail[0] == "") { if (isset($EMAIL_DOMAIN)) { - $mail = $uid . "@" . $EMAIL_DOMAIN; + $mail[0] = $uid . "@" . $EMAIL_DOMAIN; $disabled_email_tickbox = FALSE; } } @@ -85,27 +120,56 @@ if (isset($_GET['account_request'])) { $disabled_email_tickbox = FALSE; } $new_account_r['mail'] = $mail; + unset($new_account_r['mail']['count']); } + +if (isset($_GET['account_request']) or isset($_POST['create_account'])) { + + if (!isset($uid[0])) { + $uid[0] = generate_username($givenname[0],$sn[0]); + $new_account_r['uid'] = $uid; + unset($new_account_r['uid']['count']); + } + + if (!isset($cn[0])) { + if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) { + $cn[0] = $givenname[0] . $sn[0]; + } + else { + $cn[0] = $givenname[0] . " " . $sn[0]; + } + $new_account_r['cn'] = $cn; + unset($new_account_r['cn']['count']); + } + +} + + if (isset($_POST['create_account'])) { $password = $_POST['password']; - $new_account_r['password'] = $password; - $account_identifier = $new_account_r[$LDAP["account_attribute"]]; + $new_account_r['password'][0] = $password; + $account_identifier = $new_account_r[$account_attribute][0]; + $this_cn=$cn[0]; + $this_mail=$mail[0]; + $this_givenname=$givenname[0]; + $this_sn=$sn[0]; + $this_password=$password[0]; - if (!isset($cn) or $cn == "") { $invalid_cn = TRUE; } + if (!isset($this_cn) or $this_cn == "") { $invalid_cn = TRUE; } if ((!isset($account_identifier) or $account_identifier == "") and $invalid_cn != TRUE) { $invalid_account_identifier = TRUE; } if ((!is_numeric($_POST['pass_score']) or $_POST['pass_score'] < 3) and $ACCEPT_WEAK_PASSWORDS != TRUE) { $weak_password = TRUE; } - if (isset($mail) and !is_valid_email($mail)) { $invalid_email = TRUE; } + if (isset($this_mail) and !is_valid_email($this_mail)) { $invalid_email = TRUE; } if (preg_match("/\"|'/",$password)) { $invalid_password = TRUE; } if ($password != $_POST['password_match']) { $mismatched_passwords = TRUE; } - if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE and !preg_match("/$POSIX_REGEX/",$account_identifier)) { $invalid_account_identifier = TRUE; } + if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE and !preg_match("/$USERNAME_REGEX/",$account_identifier)) { $invalid_account_identifier = TRUE; } if (isset($_POST['send_email']) and isset($mail) and $EMAIL_SENDING_ENABLED == TRUE) { $send_user_email = TRUE; } - if ( isset($givenname) - and isset($sn) - and isset($password) + if ( isset($this_givenname) + and isset($this_sn) + and isset($this_password) and !$mismatched_passwords and !$weak_password and !$invalid_password @@ -124,13 +188,13 @@ if (isset($_POST['create_account'])) { include_once "mail_functions.inc.php"; - $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $givenname, $sn); - $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $givenname, $sn); + $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $this_givenname, $this_sn); + $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $this_givenname, $this_sn); - $sent_email = send_email($mail,"$givenname $sn",$mail_subject,$mail_body); + $sent_email = send_email($this_mail,"$this_givenname $this_sn",$mail_subject,$mail_body); $creation_message = "The account was created"; if ($sent_email) { - $creation_message .= " and an email sent to $mail."; + $creation_message .= " and an email sent to $this_mail."; } else { $creation_message .= " but unfortunately the email wasn't sent.
More information will be available in the logs."; @@ -189,7 +253,7 @@ if (isset($_POST['create_account'])) { $errors=""; if ($invalid_cn) { $errors.="
  • The Common Name is required
    • \n"; } -if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$LDAP['account_attribute']]['label'] . ") is invalid.
    • \n"; } +if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$account_attribute]['label'] . ") is invalid.
    • \n"; } if ($weak_password) { $errors.="
  • The password is too weak
    • \n"; } if ($invalid_password) { $errors.="
  • The password contained invalid characters
    • \n"; } if ($invalid_email) { $errors.="
  • The email address is invalid
    • \n"; } @@ -212,6 +276,7 @@ render_js_username_check(); render_js_username_generator('givenname','sn','uid','uid_div'); render_js_cn_generator('givenname','sn','cn','cn_div'); render_js_email_generator('uid','mail'); +render_js_homedir_generator('uid','homedirectory'); $tabindex=1; @@ -273,37 +338,32 @@ $tabindex=1; + +
    -
    +
    -
    + - - $attr_r) { - $label = $attr_r['label']; - if ($attribute == $LDAP['account_attribute']) { $label = "$label*"; } - ?> -
    - -
    - > -
    -
    - + $attr_r) { + $label = $attr_r['label']; + if (isset($attr_r['onkeyup'])) { $onkeyup = $attr_r['onkeyup']; } else { $onkeyup = ""; } + if ($attribute == $LDAP['account_attribute']) { $label = "$label*"; } + if (isset($$attribute)) { $these_values=$$attribute; } else { $these_values = array(); } + if (isset($attr_r['inputtype'])) { $inputtype = $attr_r['inputtype']; } else { $inputtype = ""; } + render_attribute_fields($attribute,$label,$these_values,"",$onkeyup,$inputtype,$tabindex); + $tabindex++; + } + ?>
    diff --git a/www/account_manager/show_group.php b/www/account_manager/show_group.php index 86cfdab..08a05f4 100644 --- a/www/account_manager/show_group.php +++ b/www/account_manager/show_group.php @@ -12,114 +12,225 @@ render_submenu(); $ldap_connection = open_ldap_connection(); - if (!isset($_POST['group_name']) and !isset($_GET['group_name'])) { ?>

    The group name is missing.

    The group name is invalid.

    $attr_r) { + + if (isset($this_group[0][$attribute]) and $this_group[0][$attribute]['count'] > 0) { + $$attribute = $this_group[0][$attribute]; + } + else { + $$attribute = array(); + } + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + + } + + if (isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute])) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + $this_attribute['count'] = count($this_attribute); + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + + if ($this_attribute != $$attribute) { + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + +} + +if (!isset($gidnumber[0]) or !is_numeric($gidnumber[0])) { + $gidnumber[0]=ldap_get_highest_id($ldap_connection,$type="gid"); + $gidnumber['count']=1; +} + +###################################################################################### $all_accounts = ldap_get_user_list($ldap_connection); $all_people = array(); foreach ($all_accounts as $this_person => $attrs) { - array_push($all_people, $this_person); + array_push($all_people, $this_person); } $non_members = array_diff($all_people,$current_members); if (isset($_POST["update_members"])) { - $updated_membership = array(); + $updated_membership = array(); - foreach ($_POST as $index => $member) { - - if (is_numeric($index)) { - array_push($updated_membership,$member); + foreach ($_POST['membership'] as $index => $member) { + if (is_numeric($index)) { + array_push($updated_membership,filter_var($member, FILTER_SANITIZE_FULL_SPECIAL_CHARS)); + } } - } - if ($group_cn == $LDAP['admins_group'] and !array_search($USER_ID, $updated_membership)){ - array_push($updated_membership,$USER_ID); - } + if ($group_cn == $LDAP['admins_group'] and !array_search($USER_ID, $updated_membership)){ + array_push($updated_membership,$USER_ID); + } - $members_to_del = array_diff($current_members,$updated_membership); - $members_to_add = array_diff($updated_membership,$current_members); + $members_to_del = array_diff($current_members,$updated_membership); + $members_to_add = array_diff($updated_membership,$current_members); - if ($initialise_group == TRUE) { - $initial_member = array_shift($members_to_add); - $group_add = ldap_new_group($ldap_connection,$group_cn,$initial_member); - } - foreach ($members_to_add as $this_member) { - ldap_add_member_to_group($ldap_connection,$group_cn,$this_member); - } + if ($initialise_group == TRUE) { - foreach ($members_to_del as $this_member) { - ldap_delete_member_from_group($ldap_connection,$group_cn,$this_member); - } + $initial_member = array_shift($members_to_add); + $group_add = ldap_new_group($ldap_connection,$group_cn,$initial_member,$to_update); + if (!$group_add) { + render_alert_banner("There was a problem creating the group. See the logs for more information.","danger",10000); + $group_exists = FALSE; + $new_group = TRUE; + } + else { + $group_exists = TRUE; + $new_group = FALSE; + } - $non_members = array_diff($all_people,$updated_membership); - $group_members = $updated_membership; + } - ?> - - + if ($group_exists == TRUE) { - 0) { + + if (isset($this_group[0]['objectclass'])) { + $existing_objectclasses = $this_group[0]['objectclass']; + unset($existing_objectclasses['count']); + if ($existing_objectclasses != $LDAP['group_objectclasses']) { $to_update['objectclass'] = $LDAP['group_objectclasses']; } + } + + $updated_attr = ldap_update_group_attributes($ldap_connection,$group_cn,$to_update); + + if ($updated_attr) { + render_alert_banner("The group attributes have been updated."); + } + else { + render_alert_banner("There was a problem updating the group attributes. See the logs for more information.","danger",15000); + } + + } + + foreach ($members_to_add as $this_member) { + ldap_add_member_to_group($ldap_connection,$group_cn,$this_member); + } + + foreach ($members_to_del as $this_member) { + ldap_delete_member_from_group($ldap_connection,$group_cn,$this_member); + } + + $non_members = array_diff($all_people,$updated_membership); + $group_members = $updated_membership; + + $rfc2307bis_available = ldap_detect_rfc2307bis($ldap_connection); + if ($rfc2307bis_available == TRUE and count($group_members) == 0) { + + $group_members = ldap_get_group_members($ldap_connection,$group_cn); + $non_members = array_diff($all_people,$group_members); + render_alert_banner("Groups can't be empty, so the final member hasn't been removed. You could try deleting the group","danger",15000); + } + else { + render_alert_banner("The group has been ${has_been}."); + } + + } + else { + + $group_members = array(); + $non_members = $all_people; + + } } else { - $group_members = $current_members; + + $group_members = $current_members; + } ldap_close($ldap_connection); @@ -147,7 +258,7 @@ ldap_close($ldap_connection); for (var i = 0; i < member_list.length; ++i) { var hidden = document.createElement("input"); hidden.type = "hidden"; - hidden.name = i; + hidden.name = 'membership[]'; hidden.value = member_list[i]['textContent']; members_form.appendChild(hidden); @@ -175,7 +286,10 @@ ldap_close($ldap_connection); $('.list-right ul li.active').removeClass('active'); actives.remove(); } - $("#submit_members").prop("disabled", false); + if ($("#membership_list").length > 0) { + $("#submit_members").prop("disabled", false); + $("#submit_attributes").prop("disabled", false); + } }); $('.dual-list .selector').click(function () { var $checkBox = $(this); @@ -226,99 +340,130 @@ ldap_close($ldap_connection); -
    +
    +
    +
    -
    -
    -

    (admin group)" ; } ?>

    - - /groups.php" method="post"> -
    -
      -
      • - -
      +
      +

      (admin group)" ; } ?>

      + +
      /groups.php" method="post" enctype="multipart/form-data"> +
      -
      +
        +
        • + -
        - Members -
        +
        -
        -
        - - +
        + Members +
        +
        +
        +
        + + +
        +
        +
        +
        + +
        +
        +
        +
          + $member
        \n"; + } + else { + print "
      • $member
        • \n"; + } + } + ?> +
      +
      -
    -
    -
    - +
    + + +
    + + + + +
    + +
    + Available accounts +
    +
    +
    +
    + +
    +
    +
    +
    + + +
    +
    +
    +
      + $nonmember\n"; + } + ?> +
    +
    -
    -
      - $member
    \n"; - } - else { - print "
  • $member
    • \n"; - } - } - ?> - -
    - -
    - - - /show_group.php" method="post"> - - - - - -
    - -
    - Available accounts -
    -
    -
    -
    - -
    -
    -
    -
    - - -
    -
    -
    -
      - $nonmember\n"; - } - ?> -
    -
    -
    - -
    -
    - - - +
    + +if (count($attribute_map) > 0) { ?> +
    +
    +

    Group attributes

    +
    +
    +
    + $attr_r) { + $label = $attr_r['label']; + if (isset($$attribute)) { $these_values=$$attribute; } else { $these_values = array(); } + print "
    "; + $dl_identifider = ($full_dn != $create_group_message) ? $full_dn : ""; + if (isset($attr_r['inputtype'])) { $inputtype = $attr_r['inputtype']; } else { $inputtype=""; } + render_attribute_fields($attribute,$label,$these_values,$dl_identifider,"",$inputtype,$tabindex); + print "
    "; + $tabindex++; + } + ?> +
    +
    +
    + +
    +
    +
    +
    +
    +
    + + +
    +
    +
    + diff --git a/www/account_manager/show_user.php b/www/account_manager/show_user.php index c062008..8ea59d2 100644 --- a/www/account_manager/show_user.php +++ b/www/account_manager/show_user.php @@ -18,13 +18,13 @@ $to_update = array(); if ($SMTP['host'] != "") { $can_send_email = TRUE; } else { $can_send_email = FALSE; } -$LDAP['default_attribute_map']["uidnumber"] = array("label" => "UID"); -$LDAP['default_attribute_map']["gidnumber"] = array("label" => "GID"); -$LDAP['default_attribute_map']["loginshell"] = array("label" => "Login shell"); -$LDAP['default_attribute_map']["homedirectory"] = array("label" => "Home directory"); $LDAP['default_attribute_map']["mail"] = array("label" => "Email", "onkeyup" => "check_if_we_should_enable_sending_email();"); -$attribute_map = ldap_complete_account_attribute_array(); +$attribute_map = $LDAP['default_attribute_map']; +if (isset($LDAP['account_additional_attributes'])) { $attribute_map = ldap_complete_attribute_array($attribute_map,$LDAP['account_additional_attributes']); } +if (! array_key_exists($LDAP['account_attribute'], $attribute_map)) { + $attribute_r = array_merge($attribute_map, array($LDAP['account_attribute'] => array("label" => "Account UID"))); +} if (!isset($_POST['account_identifier']) and !isset($_GET['account_identifier'])) { ?> @@ -44,30 +44,98 @@ $ldap_connection = open_ldap_connection(); $ldap_search_query="(${LDAP['account_attribute']}=". ldap_escape($account_identifier, "", LDAP_ESCAPE_FILTER) . ")"; $ldap_search = ldap_search( $ldap_connection, $LDAP['user_dn'], $ldap_search_query); + +######################### + if ($ldap_search) { $user = ldap_get_entries($ldap_connection, $ldap_search); - foreach ($attribute_map as $attribute => $attr_r) { + if ($user["count"] > 0) { - $$attribute = $user[0][$attribute][0]; + foreach ($attribute_map as $attribute => $attr_r) { - if (isset($_POST['update_account']) and isset($_POST[$attribute]) and $_POST[$attribute] != $$attribute) { - $$attribute = filter_var($_POST[$attribute], FILTER_SANITIZE_STRING); - $to_update[$attribute] = $$attribute; - } - elseif (isset($attr_r['default'])) { - $$attribute = $attr_r['default']; - } + if (isset($user[0][$attribute]) and $user[0][$attribute]['count'] > 0) { + $$attribute = $user[0][$attribute]; + } + else { + $$attribute = array(); + } + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + + } + + if (isset($_POST['update_account']) and isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute])) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + $this_attribute['count'] = count($this_attribute); + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + + if ($this_attribute != $$attribute) { + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + } + $dn = $user[0]['dn']; } - $dn = $user[0]['dn']; - + else { + ?> +
    +

    This account doesn't exist.

    +
    + - - - - - - - - - - + + +
    Member of