diff --git a/README.md b/README.md index 97cf5f1..7c71945 100644 --- a/README.md +++ b/README.md @@ -135,10 +135,6 @@ These settings should only be changed if you're trying to make the user manager * `LDAP_GROUP_MEMBERSHIP_ATTRIBUTE` (default: *memberUID* or *uniqueMember*): The attribute used when adding a user's account to a group. When the `groupOfMembers` objectClass is detected `FORCE_RFC2307BIS` is `TRUE` it defaults to `uniqueMember`, otherwise it'll default to `memberUID`. Explicitly setting this variable will override any default. -* `LDAP_GROUP_ADDITIONAL_OBJECTCLASSES` (no default): A comma-separated list of additional objectClasses to use when creating an group. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information. - -* `LDAP_GROUP_ADDITIONAL_ATTRIBUTE` (no default): A comma-separated list of extra attributes to display when creating an group. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information. - * `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` (no default): A comma-separated list of additional objectClasses to use when creating an account. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information. * `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` (no default): A comma-separated list of extra attributes to display when creating an account. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information. @@ -317,12 +313,12 @@ If `EMAIL_DOMAIN` is set then the email address field will be automatically upda ## Extra objectClasses and attributes -If you need to use this user manager with an existing LDAP directory and your account records need additional objectClasses and attributes then you can add them via `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` and `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES`. +If you need to use this user manager with an existing LDAP directory and your account records need additional objectClasses and attributes then you can add them via `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` and `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES`. `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` is a comma-separated list of objectClasses to add when creating the account record. For example, `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES=ldappublickey,couriermailaccount`. -`LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` is a comma-separated list of attributes to be displayed as extra fields on the account management pages. -By default these fields will be empty, with the field named for the attribute, but you can set the field labels and optionally the default values by appending the attribute names with colon-separated values like so: `attribute_name:label:default_value`. +`LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` is a comma-separated list of attributes to be displayed as extra fields on the account management page. +By default these fields will be empty, with the field named for the attribute, but you can set the field labels (and optionally the default values) by appending the attribute names with colon-separated values like so: `attribute_name:label:default_value`. Multiple attributes are separated by commas, so you can define the label and default values for several attributes as follows: `attribute1:label1:default_value1,attribute2:label2:default_value2,attribute3:label3`. As an example, to set a mailbox name and quota for the `couriermailaccount` schema you can pass these variables to the container: @@ -330,10 +326,21 @@ As an example, to set a mailbox name and quota for the `couriermailaccount` sche LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES=couriermailaccount LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES="mailbox:Mailbox:domain.com,quota:Mail quota:20" ``` - -ObjectClasses often have attributes that must have a value, so you'll need to set a default for those attributes otherwise you'll get errors if you forget to fill in the fields. -This is advanced usage and the user manager doesn't attempt to validate any objectClasses, attributes, labels or default values you pass in. It's up to you to ensure that your LDAP server has the appropriate schemas and that the labels and values are sane. +_Note_: ObjectClasses often have attributes that _must_ have a value, so you should set a default value for these attributes, otherwise if you forget to add a value when filling in the form an error will be thrown on submission. + + +### Multi-value attributes + +If you have an attribute that could have several values, you can add a `+` to end of the attribute name. This will modify the form so you can add or remove extra values for that attribute. For example, if you want to have multiple email aliases when using the _PostfixBookMailAccount_ schema then you can pass these variables to the container: +``` +LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES=PostfixBookMailAccount" \ +LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES=mailAlias+:Email aliases" +``` + +### Caveat + +These settings are advanced usage and the user manager doesn't attempt to validate any objectClasses, attributes, labels or default values you pass in. It's up to you to ensure that your LDAP server has the appropriate schemas and that the labels and values are sane. *** diff --git a/www/account_manager/new_user.php b/www/account_manager/new_user.php index 0a6e961..c604e79 100644 --- a/www/account_manager/new_user.php +++ b/www/account_manager/new_user.php @@ -39,45 +39,72 @@ $invalid_email = FALSE; $disabled_email_tickbox = TRUE; $invalid_cn = FALSE; $invalid_account_identifier = FALSE; +$account_attribute = $LDAP['account_attribute']; $new_account_r = array(); foreach ($attribute_map as $attribute => $attr_r) { - if (isset($_POST[$attribute])) { - $$attribute = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); - } - elseif (isset($attr_r['default'])) { - $$attribute = $attr_r['default']; - } - if (isset($$attribute)) { $new_account_r[$attribute] = $$attribute; } + + if (isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute])) { + $this_attribute['count'] = count($_POST[$attribute]); + foreach($_POST[$attribute] as $key => $value) { + $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + } + else { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + + $$attribute = $this_attribute; + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + if (isset($$attribute)) { + $new_account_r[$attribute] = $$attribute; + unset($new_account_r[$attribute]['count']); + } + } ## if (isset($_GET['account_request'])) { - $givenname=filter_var($_GET['first_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $givenname[0]=filter_var($_GET['first_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); $new_account_r['givenname'] = $givenname; + $givenname['count'] = 1; - $sn=filter_var($_GET['last_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); - $new_account_r['sn'] = $sn; + $sn[0]=filter_var($_GET['last_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $new_account_r['sn'][0] = $sn; + $sn['count'] = 1; - $uid = generate_username($givenname,$sn); - $new_account_r['uid'] = $uid; + $uid[0] = generate_username($givenname,$sn); + $new_account_r['uid'][0] = $uid; + $uid['count'] = 1; if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) { - $cn = "$givenname$sn"; + $cn[0] = "$givenname$sn"; } else { - $cn = "$givenname $sn"; + $cn[0] = "$givenname $sn"; } - $new_account_r['cn'] = $cn; + $cn['count'] = 1; - $mail=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); - if ($mail == "") { + $mail[0]=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); + if ($mail[0] == "") { if (isset($EMAIL_DOMAIN)) { - $mail = $uid . "@" . $EMAIL_DOMAIN; + $mail[0] = $uid . "@" . $EMAIL_DOMAIN; $disabled_email_tickbox = FALSE; } } @@ -85,27 +112,34 @@ if (isset($_GET['account_request'])) { $disabled_email_tickbox = FALSE; } $new_account_r['mail'] = $mail; + $mail['count'] = 1; } if (isset($_POST['create_account'])) { $password = $_POST['password']; - $new_account_r['password'] = $password; - $account_identifier = $new_account_r[$LDAP["account_attribute"]]; + $new_account_r['password'][0] = $password; + $account_identifier = $new_account_r[$account_attribute][0]; - if (!isset($cn) or $cn == "") { $invalid_cn = TRUE; } + $this_cn=$cn[0]; + $this_mail=$mail[0]; + $this_givenname=$givenname[0]; + $this_sn=$sn[0]; + $this_password=$password[0]; + + if (!isset($this_cn) or $this_cn == "") { $invalid_cn = TRUE; } if ((!isset($account_identifier) or $account_identifier == "") and $invalid_cn != TRUE) { $invalid_account_identifier = TRUE; } if ((!is_numeric($_POST['pass_score']) or $_POST['pass_score'] < 3) and $ACCEPT_WEAK_PASSWORDS != TRUE) { $weak_password = TRUE; } - if (isset($mail) and !is_valid_email($mail)) { $invalid_email = TRUE; } + if (isset($this_mail) and !is_valid_email($this_mail)) { $invalid_email = TRUE; } if (preg_match("/\"|'/",$password)) { $invalid_password = TRUE; } if ($password != $_POST['password_match']) { $mismatched_passwords = TRUE; } if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE and !preg_match("/$USERNAME_REGEX/",$account_identifier)) { $invalid_account_identifier = TRUE; } if (isset($_POST['send_email']) and isset($mail) and $EMAIL_SENDING_ENABLED == TRUE) { $send_user_email = TRUE; } - if ( isset($givenname) - and isset($sn) - and isset($password) + if ( isset($this_givenname) + and isset($this_sn) + and isset($this_password) and !$mismatched_passwords and !$weak_password and !$invalid_password @@ -124,13 +158,13 @@ if (isset($_POST['create_account'])) { include_once "mail_functions.inc.php"; - $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $givenname, $sn); - $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $givenname, $sn); + $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $this_givenname, $this_sn); + $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $this_givenname, $this_sn); - $sent_email = send_email($mail,"$givenname $sn",$mail_subject,$mail_body); + $sent_email = send_email($this_mail,"$this_givenname $this_sn",$mail_subject,$mail_body); $creation_message = "The account was created"; if ($sent_email) { - $creation_message .= " and an email sent to $mail."; + $creation_message .= " and an email sent to $this_mail."; } else { $creation_message .= " but unfortunately the email wasn't sent.
More information will be available in the logs."; @@ -189,7 +223,7 @@ if (isset($_POST['create_account'])) { $errors=""; if ($invalid_cn) { $errors.="
  • The Common Name is required
    • \n"; } -if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$LDAP['account_attribute']]['label'] . ") is invalid.
    • \n"; } +if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$account_attribute]['label'] . ") is invalid.
    • \n"; } if ($weak_password) { $errors.="
  • The password is too weak
    • \n"; } if ($invalid_password) { $errors.="
  • The password contained invalid characters
    • \n"; } if ($invalid_email) { $errors.="
  • The email address is invalid
    • \n"; } @@ -273,6 +307,8 @@ $tabindex=1; + +
    @@ -288,21 +324,14 @@ $tabindex=1; $attr_r) { - $label = $attr_r['label']; - $onkeyup = $attr_r['onkeyup']; + $label = $attr_r['label']; + if (isset($attr_r['onkeyup'])) { $onkeyup = $attr_r['onkeyup']; } else { $onkeyup = ""; } if ($attribute == $LDAP['account_attribute']) { $label = "$label*"; } - ?> -
    - -
    - > -
    -
    - diff --git a/www/account_manager/show_user.php b/www/account_manager/show_user.php index 4c1d925..1ab9cf0 100644 --- a/www/account_manager/show_user.php +++ b/www/account_manager/show_user.php @@ -20,8 +20,6 @@ if ($SMTP['host'] != "") { $can_send_email = TRUE; } else { $can_send_email = FA $LDAP['default_attribute_map']["uidnumber"] = array("label" => "UID"); $LDAP['default_attribute_map']["gidnumber"] = array("label" => "GID"); -$LDAP['default_attribute_map']["loginshell"] = array("label" => "Login shell"); -$LDAP['default_attribute_map']["homedirectory"] = array("label" => "Home directory"); $LDAP['default_attribute_map']["mail"] = array("label" => "Email", "onkeyup" => "check_if_we_should_enable_sending_email();"); $attribute_map = ldap_complete_account_attribute_array(); @@ -44,25 +42,64 @@ $ldap_connection = open_ldap_connection(); $ldap_search_query="(${LDAP['account_attribute']}=". ldap_escape($account_identifier, "", LDAP_ESCAPE_FILTER) . ")"; $ldap_search = ldap_search( $ldap_connection, $LDAP['user_dn'], $ldap_search_query); + +######################### if ($ldap_search) { $user = ldap_get_entries($ldap_connection, $ldap_search); - foreach ($attribute_map as $attribute => $attr_r) { + if ($user["count"] > 0) { - $$attribute = $user[0][$attribute][0]; + foreach ($attribute_map as $attribute => $attr_r) { - if (isset($_POST['update_account']) and isset($_POST[$attribute]) and $_POST[$attribute] != $$attribute) { - $$attribute = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); - $to_update[$attribute] = $$attribute; - } - elseif (isset($attr_r['default'])) { - $$attribute = $attr_r['default']; - } + if (isset($user[0][$attribute]) and $user[0][$attribute]['count'] > 0) { + $$attribute = $user[0][$attribute]; + } + else { + $$attribute = array(); + } + + if (isset($_POST['update_account']) and isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute])) { + $this_attribute['count'] = count($_POST[$attribute]); + foreach($_POST[$attribute] as $key => $value) { + $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + } + else { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + } + + if ($this_attribute != $$attribute) { + $$attribute = $this_attribute; + $to_update[$attribute] = $this_attribute; + unset($to_update[$attribute]['count']); + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + } + $dn = $user[0]['dn']; } - $dn = $user[0]['dn']; - + else { + ?> +
    +

    This account doesn't exist.

    +
    + + + +