Файловый менеджер

Файловый менеджер - Редактировать - /var/www/jonas-eriksen.dk/pic/private/auth.php.tar

Назад
var/www/jonas-eriksen.dk/wiki/inc/auth.php��0000644��00000113626�15233540720�0014525 0��ustar�00��<?php /** * Authentication library * * Including this file will automatically try to login * a user by calling auth_login() * * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) * @author Andreas Gohr <andi@splitbrain.org> / use dokuwiki\Extension\AuthPlugin; use dokuwiki\Extension\Event; use dokuwiki\Extension\PluginController; use dokuwiki\PassHash; use dokuwiki\Subscriptions\RegistrationSubscriptionSender; /* * Initialize the auth system. * * This function is automatically called at the end of init.php * * This used to be the main() of the auth.php * * @todo backend loading maybe should be handled by the class autoloader * @todo maybe split into multiple functions at the XXX marked positions * @triggers AUTH_LOGIN_CHECK * @return bool / function auth_setup() { global $conf; / @var AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; global $AUTH_ACL; global $lang; / @var PluginController $plugin_controller / global $plugin_controller; $AUTH_ACL = array(); if(!$conf['useacl']) return false; // try to load auth backend from plugins foreach ($plugin_controller->getList('auth') as $plugin) { if ($conf['authtype'] === $plugin) { $auth = $plugin_controller->load('auth', $plugin); break; } } if(!isset($auth) \|\| !$auth){ msg($lang['authtempfail'], -1); return false; } if ($auth->success == false) { // degrade to unauthenticated user unset($auth); auth_logoff(); msg($lang['authtempfail'], -1); return false; } // do the login either by cookie or provided credentials XXX $INPUT->set('http_credentials', false); if(!$conf['rememberme']) $INPUT->set('r', false); // handle renamed HTTP_AUTHORIZATION variable (can happen when a fix like // the one presented at // http://www.besthostratings.com/articles/http-auth-php-cgi.html is used // for enabling HTTP authentication with CGI/SuExec) if(isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['REDIRECT_HTTP_AUTHORIZATION']; // streamline HTTP auth credentials (IIS/rewrite -> mod_php) if(isset($_SERVER['HTTP_AUTHORIZATION'])) { list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6))); } // if no credentials were given try to use HTTP auth (for SSO) if(!$INPUT->str('u') && empty($_COOKIE[DOKU_COOKIE]) && !empty($_SERVER['PHP_AUTH_USER'])) { $INPUT->set('u', $_SERVER['PHP_AUTH_USER']); $INPUT->set('p', $_SERVER['PHP_AUTH_PW']); $INPUT->set('http_credentials', true); } // apply cleaning (auth specific user names, remove control chars) if (true === $auth->success) { $INPUT->set('u', $auth->cleanUser(stripctl($INPUT->str('u')))); $INPUT->set('p', stripctl($INPUT->str('p'))); } $ok = null; if (!is_null($auth) && $auth->canDo('external')) { $ok = $auth->trustExternal($INPUT->str('u'), $INPUT->str('p'), $INPUT->bool('r')); } if ($ok === null) { // external trust mechanism not in place, or returns no result, // then attempt auth_login $evdata = array( 'user' => $INPUT->str('u'), 'password' => $INPUT->str('p'), 'sticky' => $INPUT->bool('r'), 'silent' => $INPUT->bool('http_credentials') ); Event::createAndTrigger('AUTH_LOGIN_CHECK', $evdata, 'auth_login_wrapper'); } //load ACL into a global array XXX $AUTH_ACL = auth_loadACL(); return true; } /* * Loads the ACL setup and handle user wildcards * * @author Andreas Gohr <andi@splitbrain.org> * * @return array / function auth_loadACL() { global $config_cascade; global $USERINFO; / @var Input $INPUT / global $INPUT; if(!is_readable($config_cascade['acl']['default'])) return array(); $acl = file($config_cascade['acl']['default']); $out = array(); foreach($acl as $line) { $line = trim($line); if(empty($line) \|\| ($line[0] == '#')) continue; // skip blank lines & comments list($id,$rest) = preg_split('/[ \t]+/',$line,2); // substitute user wildcard first (its 1:1) if(strstr($line, '%USER%')){ // if user is not logged in, this ACL line is meaningless - skip it if (!$INPUT->server->has('REMOTE_USER')) continue; $id = str_replace('%USER%',cleanID($INPUT->server->str('REMOTE_USER')),$id); $rest = str_replace('%USER%',auth_nameencode($INPUT->server->str('REMOTE_USER')),$rest); } // substitute group wildcard (its 1:m) if(strstr($line, '%GROUP%')){ // if user is not logged in, grps is empty, no output will be added (i.e. skipped) if(isset($USERINFO['grps'])){ foreach((array) $USERINFO['grps'] as $grp){ $nid = str_replace('%GROUP%',cleanID($grp),$id); $nrest = str_replace('%GROUP%','@'.auth_nameencode($grp),$rest); $out[] = "$nid\t$nrest"; } } } else { $out[] = "$id\t$rest"; } } return $out; } /* * Event hook callback for AUTH_LOGIN_CHECK * * @param array $evdata * @return bool / function auth_login_wrapper($evdata) { return auth_login( $evdata['user'], $evdata['password'], $evdata['sticky'], $evdata['silent'] ); } /* * This tries to login the user based on the sent auth credentials * * The authentication works like this: if a username was given * a new login is assumed and user/password are checked. If they * are correct the password is encrypted with blowfish and stored * together with the username in a cookie - the same info is stored * in the session, too. Additonally a browserID is stored in the * session. * * If no username was given the cookie is checked: if the username, * crypted password and browserID match between session and cookie * no further testing is done and the user is accepted * * If a cookie was found but no session info was availabe the * blowfish encrypted password from the cookie is decrypted and * together with username rechecked by calling this function again. * * On a successful login $_SERVER[REMOTE_USER] and $USERINFO * are set. * * @author Andreas Gohr <andi@splitbrain.org> * * @param string $user Username * @param string $pass Cleartext Password * @param bool $sticky Cookie should not expire * @param bool $silent Don't show error on bad auth * @return bool true on successful auth / function auth_login($user, $pass, $sticky = false, $silent = false) { global $USERINFO; global $conf; global $lang; / @var AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; $sticky ? $sticky = true : $sticky = false; //sanity check if(!$auth) return false; if(!empty($user)) { //usual login if(!empty($pass) && $auth->checkPass($user, $pass)) { // make logininfo globally available $INPUT->server->set('REMOTE_USER', $user); $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session auth_setCookie($user, auth_encrypt($pass, $secret), $sticky); return true; } else { //invalid credentials - log off if(!$silent) { http_status(403, 'Login failed'); msg($lang['badlogin'], -1); } auth_logoff(); return false; } } else { // read cookie information list($user, $sticky, $pass) = auth_getCookie(); if($user && $pass) { // we got a cookie - see if we can trust it // get session info $session = $_SESSION[DOKU_COOKIE]['auth']; if(isset($session) && $auth->useSessionCache($user) && ($session['time'] >= time() - $conf['auth_security_timeout']) && ($session['user'] == $user) && ($session['pass'] == sha1($pass)) && //still crypted ($session['buid'] == auth_browseruid()) ) { // he has session, cookie and browser right - let him in $INPUT->server->set('REMOTE_USER', $user); $USERINFO = $session['info']; //FIXME move all references to session return true; } // no we don't trust it yet - recheck pass but silent $secret = auth_cookiesalt(!$sticky, true); //bind non-sticky to session $pass = auth_decrypt($pass, $secret); return auth_login($user, $pass, $sticky, true); } } //just to be sure auth_logoff(true); return false; } /* * Builds a pseudo UID from browser and IP data * * This is neither unique nor unfakable - still it adds some * security. Using the first part of the IP makes sure * proxy farms like AOLs are still okay. * * @author Andreas Gohr <andi@splitbrain.org> * * @return string a MD5 sum of various browser headers / function auth_browseruid() { / @var Input $INPUT / global $INPUT; $ip = clientIP(true); $uid = ''; $uid .= $INPUT->server->str('HTTP_USER_AGENT'); $uid .= $INPUT->server->str('HTTP_ACCEPT_CHARSET'); $uid .= substr($ip, 0, strpos($ip, '.')); $uid = strtolower($uid); return md5($uid); } /* * Creates a random key to encrypt the password in cookies * * This function tries to read the password for encrypting * cookies from $conf['metadir'].'/_htcookiesalt' * if no such file is found a random key is created and * and stored in this file. * * @author Andreas Gohr <andi@splitbrain.org> * * @param bool $addsession if true, the sessionid is added to the salt * @param bool $secure if security is more important than keeping the old value * @return string / function auth_cookiesalt($addsession = false, $secure = false) { if (defined('SIMPLE_TEST')) { return 'test'; } global $conf; $file = $conf['metadir'].'/_htcookiesalt'; if ($secure \|\| !file_exists($file)) { $file = $conf['metadir'].'/_htcookiesalt2'; } $salt = io_readFile($file); if(empty($salt)) { $salt = bin2hex(auth_randombytes(64)); io_saveFile($file, $salt); } if($addsession) { $salt .= session_id(); } return $salt; } /* * Return cryptographically secure random bytes. * * @author Niklas Keller <me@kelunik.com> * * @param int $length number of bytes * @return string cryptographically secure random bytes / function auth_randombytes($length) { return random_bytes($length); } /* * Cryptographically secure random number generator. * * @author Niklas Keller <me@kelunik.com> * * @param int $min * @param int $max * @return int / function auth_random($min, $max) { return random_int($min, $max); } /* * Encrypt data using the given secret using AES * * The mode is CBC with a random initialization vector, the key is derived * using pbkdf2. * * @param string $data The data that shall be encrypted * @param string $secret The secret/password that shall be used * @return string The ciphertext / function auth_encrypt($data, $secret) { $iv = auth_randombytes(16); $cipher = new \phpseclib\Crypt\AES(); $cipher->setPassword($secret); / this uses the encrypted IV as IV as suggested in http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, Appendix C for unique but necessarily random IVs. The resulting ciphertext is compatible to ciphertext that was created using a "normal" IV. / return $cipher->encrypt($iv.$data); } /* * Decrypt the given AES ciphertext * * The mode is CBC, the key is derived using pbkdf2 * * @param string $ciphertext The encrypted data * @param string $secret The secret/password that shall be used * @return string The decrypted data / function auth_decrypt($ciphertext, $secret) { $iv = substr($ciphertext, 0, 16); $cipher = new \phpseclib\Crypt\AES(); $cipher->setPassword($secret); $cipher->setIV($iv); return $cipher->decrypt(substr($ciphertext, 16)); } /* * Log out the current user * * This clears all authentication data and thus log the user * off. It also clears session data. * * @author Andreas Gohr <andi@splitbrain.org> * * @param bool $keepbc - when true, the breadcrumb data is not cleared / function auth_logoff($keepbc = false) { global $conf; global $USERINFO; / @var AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; // make sure the session is writable (it usually is) @session_start(); if(isset($_SESSION[DOKU_COOKIE]['auth']['user'])) unset($_SESSION[DOKU_COOKIE]['auth']['user']); if(isset($_SESSION[DOKU_COOKIE]['auth']['pass'])) unset($_SESSION[DOKU_COOKIE]['auth']['pass']); if(isset($_SESSION[DOKU_COOKIE]['auth']['info'])) unset($_SESSION[DOKU_COOKIE]['auth']['info']); if(!$keepbc && isset($_SESSION[DOKU_COOKIE]['bc'])) unset($_SESSION[DOKU_COOKIE]['bc']); $INPUT->server->remove('REMOTE_USER'); $USERINFO = null; //FIXME $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir']; setcookie(DOKU_COOKIE, '', time() - 600000, $cookieDir, '', ($conf['securecookie'] && is_ssl()), true); if($auth) $auth->logOff(); } /* * Check if a user is a manager * * Should usually be called without any parameters to check the current * user. * * The info is available through $INFO['ismanager'], too * * @param string $user Username * @param array $groups List of groups the user is in * @param bool $adminonly when true checks if user is admin * @param bool $recache set to true to refresh the cache * @return bool * @see auth_isadmin * * @author Andreas Gohr <andi@splitbrain.org> / function auth_ismanager($user = null, $groups = null, $adminonly = false, $recache=false) { global $conf; global $USERINFO; / @var AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; if(!$auth) return false; if(is_null($user)) { if(!$INPUT->server->has('REMOTE_USER')) { return false; } else { $user = $INPUT->server->str('REMOTE_USER'); } } if(is_null($groups)) { $groups = $USERINFO ? (array) $USERINFO['grps'] : array(); } // prefer cached result static $cache = []; $cachekey = serialize([$user, $adminonly, $groups]); if (!isset($cache[$cachekey]) \|\| $recache) { // check superuser match $ok = auth_isMember($conf['superuser'], $user, $groups); // check managers if (!$ok && !$adminonly) { $ok = auth_isMember($conf['manager'], $user, $groups); } $cache[$cachekey] = $ok; } return $cache[$cachekey]; } /* * Check if a user is admin * * Alias to auth_ismanager with adminonly=true * * The info is available through $INFO['isadmin'], too * * @param string $user Username * @param array $groups List of groups the user is in * @param bool $recache set to true to refresh the cache * @return bool * @author Andreas Gohr <andi@splitbrain.org> * @see auth_ismanager() * / function auth_isadmin($user = null, $groups = null, $recache=false) { return auth_ismanager($user, $groups, true, $recache); } /* * Match a user and his groups against a comma separated list of * users and groups to determine membership status * * Note: all input should NOT be nameencoded. * * @param string $memberlist commaseparated list of allowed users and groups * @param string $user user to match against * @param array $groups groups the user is member of * @return bool true for membership acknowledged / function auth_isMember($memberlist, $user, array $groups) { / @var AuthPlugin $auth / global $auth; if(!$auth) return false; // clean user and groups if(!$auth->isCaseSensitive()) { $user = \dokuwiki\Utf8\PhpString::strtolower($user); $groups = array_map('utf8_strtolower', $groups); } $user = $auth->cleanUser($user); $groups = array_map(array($auth, 'cleanGroup'), $groups); // extract the memberlist $members = explode(',', $memberlist); $members = array_map('trim', $members); $members = array_unique($members); $members = array_filter($members); // compare cleaned values foreach($members as $member) { if($member == '@ALL' ) return true; if(!$auth->isCaseSensitive()) $member = \dokuwiki\Utf8\PhpString::strtolower($member); if($member[0] == '@') { $member = $auth->cleanGroup(substr($member, 1)); if(in_array($member, $groups)) return true; } else { $member = $auth->cleanUser($member); if($member == $user) return true; } } // still here? not a member! return false; } /* * Convinience function for auth_aclcheck() * * This checks the permissions for the current user * * @author Andreas Gohr <andi@splitbrain.org> * * @param string $id page ID (needs to be resolved and cleaned) * @return int permission level / function auth_quickaclcheck($id) { global $conf; global $USERINFO; / @var Input $INPUT / global $INPUT; # if no ACL is used always return upload rights if(!$conf['useacl']) return AUTH_UPLOAD; return auth_aclcheck($id, $INPUT->server->str('REMOTE_USER'), is_array($USERINFO) ? $USERINFO['grps'] : array()); } /* * Returns the maximum rights a user has for the given ID or its namespace * * @author Andreas Gohr <andi@splitbrain.org> * * @triggers AUTH_ACL_CHECK * @param string $id page ID (needs to be resolved and cleaned) * @param string $user Username * @param array\|null $groups Array of groups the user is in * @return int permission level / function auth_aclcheck($id, $user, $groups) { $data = array( 'id' => $id, 'user' => $user, 'groups' => $groups ); return Event::createAndTrigger('AUTH_ACL_CHECK', $data, 'auth_aclcheck_cb'); } /* * default ACL check method * * DO NOT CALL DIRECTLY, use auth_aclcheck() instead * * @author Andreas Gohr <andi@splitbrain.org> * * @param array $data event data * @return int permission level / function auth_aclcheck_cb($data) { $id =& $data['id']; $user =& $data['user']; $groups =& $data['groups']; global $conf; global $AUTH_ACL; / @var AuthPlugin $auth / global $auth; // if no ACL is used always return upload rights if(!$conf['useacl']) return AUTH_UPLOAD; if(!$auth) return AUTH_NONE; //make sure groups is an array if(!is_array($groups)) $groups = array(); //if user is superuser or in superusergroup return 255 (acl_admin) if(auth_isadmin($user, $groups)) { return AUTH_ADMIN; } if(!$auth->isCaseSensitive()) { $user = \dokuwiki\Utf8\PhpString::strtolower($user); $groups = array_map('utf8_strtolower', $groups); } $user = auth_nameencode($auth->cleanUser($user)); $groups = array_map(array($auth, 'cleanGroup'), (array) $groups); //prepend groups with @ and nameencode foreach($groups as &$group) { $group = '@'.auth_nameencode($group); } $ns = getNS($id); $perm = -1; //add ALL group $groups[] = '@ALL'; //add User if($user) $groups[] = $user; //check exact match first $matches = preg_grep('/^'.preg_quote($id, '/').'[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL); if(count($matches)) { foreach($matches as $match) { $match = preg_replace('/#.$/', '', $match); //ignore comments $acl = preg_split('/[ \t]+/', $match); if(!$auth->isCaseSensitive() && $acl[1] !== '@ALL') { $acl[1] = \dokuwiki\Utf8\PhpString::strtolower($acl[1]); } if(!in_array($acl[1], $groups)) { continue; } if($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL! if($acl[2] > $perm) { $perm = $acl[2]; } } if($perm > -1) { //we had a match - return it return (int) $perm; } } //still here? do the namespace checks if($ns) { $path = $ns.':'; } else { $path = ''; //root document } do { $matches = preg_grep('/^'.preg_quote($path, '/').'[ \t]+([^ \t]+)[ \t]+/', $AUTH_ACL); if(count($matches)) { foreach($matches as $match) { $match = preg_replace('/#.$/', '', $match); //ignore comments $acl = preg_split('/[ \t]+/', $match); if(!$auth->isCaseSensitive() && $acl[1] !== '@ALL') { $acl[1] = \dokuwiki\Utf8\PhpString::strtolower($acl[1]); } if(!in_array($acl[1], $groups)) { continue; } if($acl[2] > AUTH_DELETE) $acl[2] = AUTH_DELETE; //no admins in the ACL! if($acl[2] > $perm) { $perm = $acl[2]; } } //we had a match - return it if($perm != -1) { return (int) $perm; } } //get next higher namespace $ns = getNS($ns); if($path != '') { $path = $ns.':'; if($path == ':') $path = ''; } else { //we did this already //looks like there is something wrong with the ACL //break here msg('No ACL setup yet! Denying access to everyone.'); return AUTH_NONE; } } while(1); //this should never loop endless return AUTH_NONE; } /* * Encode ASCII special chars * * Some auth backends allow special chars in their user and groupnames * The special chars are encoded with this function. Only ASCII chars * are encoded UTF-8 multibyte are left as is (different from usual * urlencoding!). * * Decoding can be done with rawurldecode * * @author Andreas Gohr <gohr@cosmocode.de> * @see rawurldecode() * * @param string $name * @param bool $skip_group * @return string / function auth_nameencode($name, $skip_group = false) { global $cache_authname; $cache =& $cache_authname; $name = (string) $name; // never encode wildcard FS#1955 if($name == '%USER%') return $name; if($name == '%GROUP%') return $name; if(!isset($cache[$name][$skip_group])) { if($skip_group && $name[0] == '@') { $cache[$name][$skip_group] = '@'.preg_replace_callback( '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/', 'auth_nameencode_callback', substr($name, 1) ); } else { $cache[$name][$skip_group] = preg_replace_callback( '/([\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])/', 'auth_nameencode_callback', $name ); } } return $cache[$name][$skip_group]; } /* * callback encodes the matches * * @param array $matches first complete match, next matching subpatterms * @return string / function auth_nameencode_callback($matches) { return '%'.dechex(ord(substr($matches[1],-1))); } /* * Create a pronouncable password * * The $foruser variable might be used by plugins to run additional password * policy checks, but is not used by the default implementation * * @author Andreas Gohr <andi@splitbrain.org> * @link http://www.phpbuilder.com/annotate/message.php3?id=1014451 * @triggers AUTH_PASSWORD_GENERATE * * @param string $foruser username for which the password is generated * @return string pronouncable password / function auth_pwgen($foruser = '') { $data = array( 'password' => '', 'foruser' => $foruser ); $evt = new Event('AUTH_PASSWORD_GENERATE', $data); if($evt->advise_before(true)) { $c = 'bcdfghjklmnprstvwz'; //consonants except hard to speak ones $v = 'aeiou'; //vowels $a = $c.$v; //both $s = '!$%&?+~#-_:.;,'; // specials //use thre syllables... for($i = 0; $i < 3; $i++) { $data['password'] .= $c[auth_random(0, strlen($c) - 1)]; $data['password'] .= $v[auth_random(0, strlen($v) - 1)]; $data['password'] .= $a[auth_random(0, strlen($a) - 1)]; } //... and add a nice number and special $data['password'] .= $s[auth_random(0, strlen($s) - 1)].auth_random(10, 99); } $evt->advise_after(); return $data['password']; } /** * Sends a password to the given user * * @author Andreas Gohr <andi@splitbrain.org> * * @param string $user Login name of the user * @param string $password The new password in clear text * @return bool true on success / function auth_sendPassword($user, $password) { global $lang; / @var AuthPlugin $auth / global $auth; if(!$auth) return false; $user = $auth->cleanUser($user); $userinfo = $auth->getUserData($user, $requireGroups = false); if(!$userinfo['mail']) return false; $text = rawLocale('password'); $trep = array( 'FULLNAME' => $userinfo['name'], 'LOGIN' => $user, 'PASSWORD' => $password ); $mail = new Mailer(); $mail->to($mail->getCleanName($userinfo['name']).' <'.$userinfo['mail'].'>'); $mail->subject($lang['regpwmail']); $mail->setBody($text, $trep); return $mail->send(); } /* * Register a new user * * This registers a new user - Data is read directly from $_POST * * @author Andreas Gohr <andi@splitbrain.org> * * @return bool true on success, false on any error / function register() { global $lang; global $conf; / @var \dokuwiki\Extension\AuthPlugin $auth / global $auth; global $INPUT; if(!$INPUT->post->bool('save')) return false; if(!actionOK('register')) return false; // gather input $login = trim($auth->cleanUser($INPUT->post->str('login'))); $fullname = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('fullname'))); $email = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $INPUT->post->str('email'))); $pass = $INPUT->post->str('pass'); $passchk = $INPUT->post->str('passchk'); if(empty($login) \|\| empty($fullname) \|\| empty($email)) { msg($lang['regmissing'], -1); return false; } if($conf['autopasswd']) { $pass = auth_pwgen($login); // automatically generate password } elseif(empty($pass) \|\| empty($passchk)) { msg($lang['regmissing'], -1); // complain about missing passwords return false; } elseif($pass != $passchk) { msg($lang['regbadpass'], -1); // complain about misspelled passwords return false; } //check mail if(!mail_isvalid($email)) { msg($lang['regbadmail'], -1); return false; } //okay try to create the user if(!$auth->triggerUserMod('create', array($login, $pass, $fullname, $email))) { msg($lang['regfail'], -1); return false; } // send notification about the new user $subscription = new RegistrationSubscriptionSender(); $subscription->sendRegister($login, $fullname, $email); // are we done? if(!$conf['autopasswd']) { msg($lang['regsuccess2'], 1); return true; } // autogenerated password? then send password to user if(auth_sendPassword($login, $pass)) { msg($lang['regsuccess'], 1); return true; } else { msg($lang['regmailfail'], -1); return false; } } /* * Update user profile * * @author Christopher Smith <chris@jalakai.co.uk> / function updateprofile() { global $conf; global $lang; / @var AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; if(!$INPUT->post->bool('save')) return false; if(!checkSecurityToken()) return false; if(!actionOK('profile')) { msg($lang['profna'], -1); return false; } $changes = array(); $changes['pass'] = $INPUT->post->str('newpass'); $changes['name'] = $INPUT->post->str('fullname'); $changes['mail'] = $INPUT->post->str('email'); // check misspelled passwords if($changes['pass'] != $INPUT->post->str('passchk')) { msg($lang['regbadpass'], -1); return false; } // clean fullname and email $changes['name'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['name'])); $changes['mail'] = trim(preg_replace('/[\x00-\x1f:<>&%,;]+/', '', $changes['mail'])); // no empty name and email (except the backend doesn't support them) if((empty($changes['name']) && $auth->canDo('modName')) \|\| (empty($changes['mail']) && $auth->canDo('modMail')) ) { msg($lang['profnoempty'], -1); return false; } if(!mail_isvalid($changes['mail']) && $auth->canDo('modMail')) { msg($lang['regbadmail'], -1); return false; } $changes = array_filter($changes); // check for unavailable capabilities if(!$auth->canDo('modName')) unset($changes['name']); if(!$auth->canDo('modMail')) unset($changes['mail']); if(!$auth->canDo('modPass')) unset($changes['pass']); // anything to do? if(!count($changes)) { msg($lang['profnochange'], -1); return false; } if($conf['profileconfirm']) { if(!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) { msg($lang['badpassconfirm'], -1); return false; } } if(!$auth->triggerUserMod('modify', array($INPUT->server->str('REMOTE_USER'), &$changes))) { msg($lang['proffail'], -1); return false; } if($changes['pass']) { // update cookie and session with the changed data list( /user/, $sticky, /pass/) = auth_getCookie(); $pass = auth_encrypt($changes['pass'], auth_cookiesalt(!$sticky, true)); auth_setCookie($INPUT->server->str('REMOTE_USER'), $pass, (bool) $sticky); } else { // make sure the session is writable @session_start(); // invalidate session cache $_SESSION[DOKU_COOKIE]['auth']['time'] = 0; session_write_close(); } return true; } /* * Delete the current logged-in user * * @return bool true on success, false on any error / function auth_deleteprofile(){ global $conf; global $lang; / @var \dokuwiki\Extension\AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; if(!$INPUT->post->bool('delete')) return false; if(!checkSecurityToken()) return false; // action prevented or auth module disallows if(!actionOK('profile_delete') \|\| !$auth->canDo('delUser')) { msg($lang['profnodelete'], -1); return false; } if(!$INPUT->post->bool('confirm_delete')){ msg($lang['profconfdeletemissing'], -1); return false; } if($conf['profileconfirm']) { if(!$auth->checkPass($INPUT->server->str('REMOTE_USER'), $INPUT->post->str('oldpass'))) { msg($lang['badpassconfirm'], -1); return false; } } $deleted = array(); $deleted[] = $INPUT->server->str('REMOTE_USER'); if($auth->triggerUserMod('delete', array($deleted))) { // force and immediate logout including removing the sticky cookie auth_logoff(); return true; } return false; } /* * Send a new password * * This function handles both phases of the password reset: * * - handling the first request of password reset * - validating the password reset auth token * * @author Benoit Chesneau <benoit@bchesneau.info> * @author Chris Smith <chris@jalakai.co.uk> * @author Andreas Gohr <andi@splitbrain.org> * * @return bool true on success, false on any error / function act_resendpwd() { global $lang; global $conf; / @var AuthPlugin $auth / global $auth; / @var Input $INPUT / global $INPUT; if(!actionOK('resendpwd')) { msg($lang['resendna'], -1); return false; } $token = preg_replace('/[^a-f0-9]+/', '', $INPUT->str('pwauth')); if($token) { // we're in token phase - get user info from token $tfile = $conf['cachedir'].'/'.$token[0].'/'.$token.'.pwauth'; if(!file_exists($tfile)) { msg($lang['resendpwdbadauth'], -1); $INPUT->remove('pwauth'); return false; } // token is only valid for 3 days if((time() - filemtime($tfile)) > (3 60 * 60 * 24)) { msg($lang['resendpwdbadauth'], -1); $INPUT->remove('pwauth'); @unlink($tfile); return false; } $user = io_readfile($tfile); $userinfo = $auth->getUserData($user, $requireGroups = false); if(!$userinfo['mail']) { msg($lang['resendpwdnouser'], -1); return false; } if(!$conf['autopasswd']) { // we let the user choose a password $pass = $INPUT->str('pass'); // password given correctly? if(!$pass) return false; if($pass != $INPUT->str('passchk')) { msg($lang['regbadpass'], -1); return false; } // change it if(!$auth->triggerUserMod('modify', array($user, array('pass' => $pass)))) { msg($lang['proffail'], -1); return false; } } else { // autogenerate the password and send by mail $pass = auth_pwgen($user); if(!$auth->triggerUserMod('modify', array($user, array('pass' => $pass)))) { msg($lang['proffail'], -1); return false; } if(auth_sendPassword($user, $pass)) { msg($lang['resendpwdsuccess'], 1); } else { msg($lang['regmailfail'], -1); } } @unlink($tfile); return true; } else { // we're in request phase if(!$INPUT->post->bool('save')) return false; if(!$INPUT->post->str('login')) { msg($lang['resendpwdmissing'], -1); return false; } else { $user = trim($auth->cleanUser($INPUT->post->str('login'))); } $userinfo = $auth->getUserData($user, $requireGroups = false); if(!$userinfo['mail']) { msg($lang['resendpwdnouser'], -1); return false; } // generate auth token $token = md5(auth_randombytes(16)); // random secret $tfile = $conf['cachedir'].'/'.$token[0].'/'.$token.'.pwauth'; $url = wl('', array('do'=> 'resendpwd', 'pwauth'=> $token), true, '&'); io_saveFile($tfile, $user); $text = rawLocale('pwconfirm'); $trep = array( 'FULLNAME' => $userinfo['name'], 'LOGIN' => $user, 'CONFIRM' => $url ); $mail = new Mailer(); $mail->to($userinfo['name'].' <'.$userinfo['mail'].'>'); $mail->subject($lang['regpwmail']); $mail->setBody($text, $trep); if($mail->send()) { msg($lang['resendpwdconfirm'], 1); } else { msg($lang['regmailfail'], -1); } return true; } // never reached } /** * Encrypts a password using the given method and salt * * If the selected method needs a salt and none was given, a random one * is chosen. * * @author Andreas Gohr <andi@splitbrain.org> * * @param string $clear The clear text password * @param string $method The hashing method * @param string $salt A salt, null for random * @return string The crypted password / function auth_cryptPassword($clear, $method = '', $salt = null) { global $conf; if(empty($method)) $method = $conf['passcrypt']; $pass = new PassHash(); $call = 'hash_'.$method; if(!method_exists($pass, $call)) { msg("Unsupported crypt method $method", -1); return false; } return $pass->$call($clear, $salt); } /* * Verifies a cleartext password against a crypted hash * * @author Andreas Gohr <andi@splitbrain.org> * * @param string $clear The clear text password * @param string $crypt The hash to compare with * @return bool true if both match / function auth_verifyPassword($clear, $crypt) { $pass = new PassHash(); return $pass->verify_hash($clear, $crypt); } /* * Set the authentication cookie and add user identification data to the session * * @param string $user username * @param string $pass encrypted password * @param bool $sticky whether or not the cookie will last beyond the session * @return bool / function auth_setCookie($user, $pass, $sticky) { global $conf; / @var AuthPlugin $auth / global $auth; global $USERINFO; if(!$auth) return false; $USERINFO = $auth->getUserData($user); // set cookie $cookie = base64_encode($user).'\|'.((int) $sticky).'\|'.base64_encode($pass); $cookieDir = empty($conf['cookiedir']) ? DOKU_REL : $conf['cookiedir']; $time = $sticky ? (time() + 60 60 * 24 * 365) : 0; //one year setcookie(DOKU_COOKIE, $cookie, $time, $cookieDir, '', ($conf['securecookie'] && is_ssl()), true); // set session $_SESSION[DOKU_COOKIE]['auth']['user'] = $user; $_SESSION[DOKU_COOKIE]['auth']['pass'] = sha1($pass); $_SESSION[DOKU_COOKIE]['auth']['buid'] = auth_browseruid(); $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO; $_SESSION[DOKU_COOKIE]['auth']['time'] = time(); return true; } /** * Returns the user, (encrypted) password and sticky bit from cookie * * @returns array / function auth_getCookie() { if(!isset($_COOKIE[DOKU_COOKIE])) { return array(null, null, null); } list($user, $sticky, $pass) = explode('\|', $_COOKIE[DOKU_COOKIE], 3); $sticky = (bool) $sticky; $pass = base64_decode($pass); $user = base64_decode($user); return array($user, $sticky, $pass); } //Setup VIM: ex: et ts=2 : ��var/www/jonas-eriksen.dk/wiki/lib/plugins/authad/auth.php��0000644��00000064705�15233616671�0017465 0��ustar�00��<?php /* * Active Directory authentication backend for DokuWiki * * This makes authentication with a Active Directory server much easier * than when using the normal LDAP backend by utilizing the adLDAP library * * Usage: * Set DokuWiki's local.protected.php auth setting to read * * $conf['authtype'] = 'authad'; * * $conf['plugin']['authad']['account_suffix'] = '@my.domain.org'; * $conf['plugin']['authad']['base_dn'] = 'DC=my,DC=domain,DC=org'; * $conf['plugin']['authad']['domain_controllers'] = 'srv1.domain.org,srv2.domain.org'; * * //optional: * $conf['plugin']['authad']['sso'] = 1; * $conf['plugin']['authad']['admin_username'] = 'root'; * $conf['plugin']['authad']['admin_password'] = 'pass'; * $conf['plugin']['authad']['real_primarygroup'] = 1; * $conf['plugin']['authad']['use_ssl'] = 1; * $conf['plugin']['authad']['use_tls'] = 1; * $conf['plugin']['authad']['debug'] = 1; * // warn user about expiring password this many days in advance: * $conf['plugin']['authad']['expirywarn'] = 5; * * // get additional information to the userinfo array * // add a list of comma separated ldap contact fields. * $conf['plugin']['authad']['additional'] = 'field1,field2'; * * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) * @author James Van Lommel <jamesvl@gmail.com> * @link http://www.nosq.com/blog/2005/08/ldap-activedirectory-and-dokuwiki/ * @author Andreas Gohr <andi@splitbrain.org> * @author Jan Schumann <js@schumann-it.com> / class auth_plugin_authad extends DokuWiki_Auth_Plugin { /* * @var array hold connection data for a specific AD domain / protected $opts = array(); /* * @var array open connections for each AD domain, as adLDAP objects / protected $adldap = array(); /* * @var bool message state / protected $msgshown = false; /* * @var array user listing cache / protected $users = array(); /* * @var array filter patterns for listing users / protected $pattern = array(); protected $grpsusers = array(); /* * Constructor / public function __construct() { global $INPUT; parent::__construct(); require_once(DOKU_PLUGIN.'authad/adLDAP/adLDAP.php'); require_once(DOKU_PLUGIN.'authad/adLDAP/classes/adLDAPUtils.php'); // we load the config early to modify it a bit here $this->loadConfig(); // additional information fields if (isset($this->conf['additional'])) { $this->conf['additional'] = str_replace(' ', '', $this->conf['additional']); $this->conf['additional'] = explode(',', $this->conf['additional']); } else $this->conf['additional'] = array(); // ldap extension is needed if (!function_exists('ldap_connect')) { if ($this->conf['debug']) msg("AD Auth: PHP LDAP extension not found.", -1); $this->success = false; return; } // Prepare SSO if (!empty($_SERVER['REMOTE_USER'])) { // make sure the right encoding is used if ($this->getConf('sso_charset')) { $_SERVER['REMOTE_USER'] = iconv($this->getConf('sso_charset'), 'UTF-8', $_SERVER['REMOTE_USER']); } elseif (!\dokuwiki\Utf8\Clean::isUtf8($_SERVER['REMOTE_USER'])) { $_SERVER['REMOTE_USER'] = utf8_encode($_SERVER['REMOTE_USER']); } // trust the incoming user if ($this->conf['sso']) { $_SERVER['REMOTE_USER'] = $this->cleanUser($_SERVER['REMOTE_USER']); // we need to simulate a login if (empty($_COOKIE[DOKU_COOKIE])) { $INPUT->set('u', $_SERVER['REMOTE_USER']); $INPUT->set('p', 'sso_only'); } } } // other can do's are changed in $this->_loadServerConfig() base on domain setup $this->cando['modName'] = (bool)$this->conf['update_name']; $this->cando['modMail'] = (bool)$this->conf['update_mail']; $this->cando['getUserCount'] = true; } /* * Load domain config on capability check * * @param string $cap * @return bool / public function canDo($cap) { //capabilities depend on config, which may change depending on domain $domain = $this->getUserDomain($_SERVER['REMOTE_USER']); $this->loadServerConfig($domain); return parent::canDo($cap); } /* * Check user+password [required auth function] * * Checks if the given user exists and the given * plaintext password is correct by trying to bind * to the LDAP server * * @author James Van Lommel <james@nosq.com> * @param string $user * @param string $pass * @return bool / public function checkPass($user, $pass) { if ($_SERVER['REMOTE_USER'] && $_SERVER['REMOTE_USER'] == $user && $this->conf['sso'] ) return true; $adldap = $this->initAdLdap($this->getUserDomain($user)); if (!$adldap) return false; try { return $adldap->authenticate($this->getUserName($user), $pass); } catch (adLDAPException $e) { // shouldn't really happen return false; } } /* * Return user info [required auth function] * * Returns info about the given user needs to contain * at least these fields: * * name string full name of the user * mail string email address of the user * grps array list of groups the user is in * * This AD specific function returns the following * addional fields: * * dn string distinguished name (DN) * uid string samaccountname * lastpwd int timestamp of the date when the password was set * expires true if the password expires * expiresin int seconds until the password expires * any fields specified in the 'additional' config option * * @author James Van Lommel <james@nosq.com> * @param string $user * @param bool $requireGroups (optional) - ignored, groups are always supplied by this plugin * @return array / public function getUserData($user, $requireGroups = true) { global $conf; global $lang; global $ID; $adldap = $this->initAdLdap($this->getUserDomain($user)); if (!$adldap) return array(); if ($user == '') return array(); $fields = array('mail', 'displayname', 'samaccountname', 'lastpwd', 'pwdlastset', 'useraccountcontrol'); // add additional fields to read $fields = array_merge($fields, $this->conf['additional']); $fields = array_unique($fields); $fields = array_filter($fields); //get info for given user $result = $adldap->user()->info($this->getUserName($user), $fields); if ($result == false) { return array(); } //general user info $info = array(); $info['name'] = $result[0]['displayname'][0]; $info['mail'] = $result[0]['mail'][0]; $info['uid'] = $result[0]['samaccountname'][0]; $info['dn'] = $result[0]['dn']; //last password set (Windows counts from January 1st 1601) $info['lastpwd'] = $result[0]['pwdlastset'][0] / 10000000 - 11644473600; //will it expire? $info['expires'] = !($result[0]['useraccountcontrol'][0] & 0x10000); //ADS_UF_DONT_EXPIRE_PASSWD // additional information foreach ($this->conf['additional'] as $field) { if (isset($result[0][strtolower($field)])) { $info[$field] = $result[0][strtolower($field)][0]; } } // handle ActiveDirectory memberOf $info['grps'] = $adldap->user()->groups($this->getUserName($user), (bool) $this->opts['recursive_groups']); if (is_array($info['grps'])) { foreach ($info['grps'] as $ndx => $group) { $info['grps'][$ndx] = $this->cleanGroup($group); } } // always add the default group to the list of groups if (!is_array($info['grps']) \|\| !in_array($conf['defaultgroup'], $info['grps'])) { $info['grps'][] = $conf['defaultgroup']; } // add the user's domain to the groups $domain = $this->getUserDomain($user); if ($domain && !in_array("domain-$domain", (array) $info['grps'])) { $info['grps'][] = $this->cleanGroup("domain-$domain"); } // check expiry time if ($info['expires'] && $this->conf['expirywarn']) { try { $expiry = $adldap->user()->passwordExpiry($user); if (is_array($expiry)) { $info['expiresat'] = $expiry['expiryts']; $info['expiresin'] = round(($info['expiresat'] - time())/(246060)); // if this is the current user, warn him (once per request only) if (($_SERVER['REMOTE_USER'] == $user) && ($info['expiresin'] <= $this->conf['expirywarn']) && !$this->msgshown ) { $msg = sprintf($this->getLang('authpwdexpire'), $info['expiresin']); if ($this->canDo('modPass')) { $url = wl($ID, array('do'=> 'profile')); $msg .= ' <a href="'.$url.'">'.$lang['btn_profile'].'</a>'; } msg($msg); $this->msgshown = true; } } } catch (adLDAPException $e) { // ignore. should usually not happen } } return $info; } /* * Make AD group names usable by DokuWiki. * * Removes backslashes ('\'), pound signs ('#'), and converts spaces to underscores. * * @author James Van Lommel (jamesvl@gmail.com) * @param string $group * @return string / public function cleanGroup($group) { $group = str_replace('\\', '', $group); $group = str_replace('#', '', $group); $group = preg_replace('[\s]', '_', $group); $group = \dokuwiki\Utf8\PhpString::strtolower(trim($group)); return $group; } /* * Sanitize user names * * Normalizes domain parts, does not modify the user name itself (unlike cleanGroup) * * @author Andreas Gohr <gohr@cosmocode.de> * @param string $user * @return string / public function cleanUser($user) { $domain = ''; // get NTLM or Kerberos domain part list($dom, $user) = explode('\\', $user, 2); if (!$user) $user = $dom; if ($dom) $domain = $dom; list($user, $dom) = explode('@', $user, 2); if ($dom) $domain = $dom; // clean up both $domain = \dokuwiki\Utf8\PhpString::strtolower(trim($domain)); $user = \dokuwiki\Utf8\PhpString::strtolower(trim($user)); // is this a known, valid domain or do we work without account suffix? if not discard if (!is_array($this->conf[$domain]) && $this->conf['account_suffix'] !== '') { $domain = ''; } // reattach domain if ($domain) $user = "$user@$domain"; return $user; } /* * Most values in LDAP are case-insensitive * * @return bool / public function isCaseSensitive() { return false; } /* * Create a Search-String useable by adLDAPUsers::all($includeDescription = false, $search = "", $sorted = true) * @param array $filter * @return string / protected function constructSearchString($filter) { if (!$filter) { return ''; } $adldapUtils = new adLDAPUtils($this->initAdLdap(null)); $result = ''; if (isset($filter['name'])) { $result .= ')(displayname=' . $adldapUtils->ldapSlashes($filter['name']) . ''; unset($filter['name']); } if (isset($filter['user'])) { $result .= ')(samAccountName=' . $adldapUtils->ldapSlashes($filter['user']) . ''; unset($filter['user']); } if (isset($filter['mail'])) { $result .= ')(mail=' . $adldapUtils->ldapSlashes($filter['mail']) . ''; unset($filter['mail']); } return $result; } /* * Return a count of the number of user which meet $filter criteria * * @param array $filter $filter array of field/pattern pairs, empty array for no filter * @return int number of users / public function getUserCount($filter = array()) { $adldap = $this->initAdLdap(null); if (!$adldap) { dbglog("authad/auth.php getUserCount(): _adldap not set."); return -1; } if ($filter == array()) { $result = $adldap->user()->all(); } else { $searchString = $this->constructSearchString($filter); $result = $adldap->user()->all(false, $searchString); if (isset($filter['grps'])) { $this->users = array_fill_keys($result, false); /* @var admin_plugin_usermanager $usermanager / $usermanager = plugin_load("admin", "usermanager", false); $usermanager->setLastdisabled(true); if (!isset($this->grpsusers[$this->filterToString($filter)])) { $this->fillGroupUserArray($filter, $usermanager->getStart() + 3$usermanager->getPagesize()); } elseif (count($this->grpsusers[$this->filterToString($filter)]) < $usermanager->getStart() + 3$usermanager->getPagesize() ) { $this->fillGroupUserArray( $filter, $usermanager->getStart() + 3$usermanager->getPagesize() - count($this->grpsusers[$this->filterToString($filter)]) ); } $result = $this->grpsusers[$this->filterToString($filter)]; } else { /** @var admin_plugin_usermanager $usermanager / $usermanager = plugin_load("admin", "usermanager", false); $usermanager->setLastdisabled(false); } } if (!$result) { return 0; } return count($result); } /* * * create a unique string for each filter used with a group * * @param array $filter * @return string / protected function filterToString($filter) { $result = ''; if (isset($filter['user'])) { $result .= 'user-' . $filter['user']; } if (isset($filter['name'])) { $result .= 'name-' . $filter['name']; } if (isset($filter['mail'])) { $result .= 'mail-' . $filter['mail']; } if (isset($filter['grps'])) { $result .= 'grps-' . $filter['grps']; } return $result; } /* * Create an array of $numberOfAdds users passing a certain $filter, including belonging * to a certain group and save them to a object-wide array. If the array * already exists try to add $numberOfAdds further users to it. * * @param array $filter * @param int $numberOfAdds additional number of users requested * @return int number of Users actually add to Array / protected function fillGroupUserArray($filter, $numberOfAdds) { if (isset($this->grpsusers[$this->filterToString($filter)])) { $actualstart = count($this->grpsusers[$this->filterToString($filter)]); } else { $this->grpsusers[$this->filterToString($filter)] = []; $actualstart = 0; } $i=0; $count = 0; $this->constructPattern($filter); foreach ($this->users as $user => &$info) { if ($i++ < $actualstart) { continue; } if ($info === false) { $info = $this->getUserData($user); } if ($this->filter($user, $info)) { $this->grpsusers[$this->filterToString($filter)][$user] = $info; if (($numberOfAdds > 0) && (++$count >= $numberOfAdds)) break; } } return $count; } /* * Bulk retrieval of user data * * @author Dominik Eckelmann <dokuwiki@cosmocode.de> * * @param int $start index of first user to be returned * @param int $limit max number of users to be returned * @param array $filter array of field/pattern pairs, null for no filter * @return array userinfo (refer getUserData for internal userinfo details) / public function retrieveUsers($start = 0, $limit = 0, $filter = array()) { $adldap = $this->initAdLdap(null); if (!$adldap) return array(); //if (!$this->users) { //get info for given user $result = $adldap->user()->all(false, $this->constructSearchString($filter)); if (!$result) return array(); $this->users = array_fill_keys($result, false); //} $i = 0; $count = 0; $result = array(); if (!isset($filter['grps'])) { /* @var admin_plugin_usermanager $usermanager / $usermanager = plugin_load("admin", "usermanager", false); $usermanager->setLastdisabled(false); $this->constructPattern($filter); foreach ($this->users as $user => &$info) { if ($i++ < $start) { continue; } if ($info === false) { $info = $this->getUserData($user); } $result[$user] = $info; if (($limit > 0) && (++$count >= $limit)) break; } } else { /* @var admin_plugin_usermanager $usermanager / $usermanager = plugin_load("admin", "usermanager", false); $usermanager->setLastdisabled(true); if (!isset($this->grpsusers[$this->filterToString($filter)]) \|\| count($this->grpsusers[$this->filterToString($filter)]) < ($start+$limit) ) { if(!isset($this->grpsusers[$this->filterToString($filter)])) { $this->grpsusers[$this->filterToString($filter)] = []; } $this->fillGroupUserArray( $filter, $start+$limit - count($this->grpsusers[$this->filterToString($filter)]) +1 ); } if (!$this->grpsusers[$this->filterToString($filter)]) return array(); foreach ($this->grpsusers[$this->filterToString($filter)] as $user => &$info) { if ($i++ < $start) { continue; } $result[$user] = $info; if (($limit > 0) && (++$count >= $limit)) break; } } return $result; } /* * Modify user data * * @param string $user nick of the user to be changed * @param array $changes array of field/value pairs to be changed * @return bool / public function modifyUser($user, $changes) { $return = true; $adldap = $this->initAdLdap($this->getUserDomain($user)); if (!$adldap) { msg($this->getLang('connectfail'), -1); return false; } // password changing if (isset($changes['pass'])) { try { $return = $adldap->user()->password($this->getUserName($user), $changes['pass']); } catch (adLDAPException $e) { if ($this->conf['debug']) msg('AD Auth: '.$e->getMessage(), -1); $return = false; } if (!$return) msg($this->getLang('passchangefail'), -1); } // changing user data $adchanges = array(); if (isset($changes['name'])) { // get first and last name $parts = explode(' ', $changes['name']); $adchanges['surname'] = array_pop($parts); $adchanges['firstname'] = join(' ', $parts); $adchanges['display_name'] = $changes['name']; } if (isset($changes['mail'])) { $adchanges['email'] = $changes['mail']; } if (count($adchanges)) { try { $return = $return & $adldap->user()->modify($this->getUserName($user), $adchanges); } catch (adLDAPException $e) { if ($this->conf['debug']) msg('AD Auth: '.$e->getMessage(), -1); $return = false; } if (!$return) msg($this->getLang('userchangefail'), -1); } return $return; } /* * Initialize the AdLDAP library and connect to the server * * When you pass null as domain, it will reuse any existing domain. * Eg. the one of the logged in user. It falls back to the default * domain if no current one is available. * * @param string\|null $domain The AD domain to use * @return adLDAP\|bool true if a connection was established / protected function initAdLdap($domain) { if (is_null($domain) && is_array($this->opts)) { $domain = $this->opts['domain']; } $this->opts = $this->loadServerConfig((string) $domain); if (isset($this->adldap[$domain])) return $this->adldap[$domain]; // connect try { $this->adldap[$domain] = new adLDAP($this->opts); return $this->adldap[$domain]; } catch (Exception $e) { if ($this->conf['debug']) { msg('AD Auth: '.$e->getMessage(), -1); } $this->success = false; $this->adldap[$domain] = null; } return false; } /* * Get the domain part from a user * * @param string $user * @return string / public function getUserDomain($user) { list(, $domain) = explode('@', $user, 2); return $domain; } /* * Get the user part from a user * * When an account suffix is set, we strip the domain part from the user * * @param string $user * @return string / public function getUserName($user) { if ($this->conf['account_suffix'] !== '') { list($user) = explode('@', $user, 2); } return $user; } /* * Fetch the configuration for the given AD domain * * @param string $domain current AD domain * @return array / protected function loadServerConfig($domain) { // prepare adLDAP standard configuration $opts = $this->conf; $opts['domain'] = $domain; // add possible domain specific configuration if ($domain && is_array($this->conf[$domain])) foreach ($this->conf[$domain] as $key => $val) { $opts[$key] = $val; } // handle multiple AD servers $opts['domain_controllers'] = explode(',', $opts['domain_controllers']); $opts['domain_controllers'] = array_map('trim', $opts['domain_controllers']); $opts['domain_controllers'] = array_filter($opts['domain_controllers']); // compatibility with old option name if (empty($opts['admin_username']) && !empty($opts['ad_username'])) { $opts['admin_username'] = $opts['ad_username']; } if (empty($opts['admin_password']) && !empty($opts['ad_password'])) { $opts['admin_password'] = $opts['ad_password']; } $opts['admin_password'] = conf_decodeString($opts['admin_password']); // deobfuscate // we can change the password if SSL is set if ($opts['use_ssl'] \|\| $opts['use_tls']) { $this->cando['modPass'] = true; } else { $this->cando['modPass'] = false; } // adLDAP expects empty user/pass as NULL, we're less strict FS#2781 if (empty($opts['admin_username'])) $opts['admin_username'] = null; if (empty($opts['admin_password'])) $opts['admin_password'] = null; // user listing needs admin priviledges if (!empty($opts['admin_username']) && !empty($opts['admin_password'])) { $this->cando['getUsers'] = true; } else { $this->cando['getUsers'] = false; } return $opts; } /* * Returns a list of configured domains * * The default domain has an empty string as key * * @return array associative array(key => domain) / public function getConfiguredDomains() { $domains = array(); if (empty($this->conf['account_suffix'])) return $domains; // not configured yet // add default domain, using the name from account suffix $domains[''] = ltrim($this->conf['account_suffix'], '@'); // find additional domains foreach ($this->conf as $key => $val) { if (is_array($val) && isset($val['account_suffix'])) { $domains[$key] = ltrim($val['account_suffix'], '@'); } } ksort($domains); return $domains; } /* * Check provided user and userinfo for matching patterns * * The patterns are set up with $this->_constructPattern() * * @author Chris Smith <chris@jalakai.co.uk> * * @param string $user * @param array $info * @return bool / protected function filter($user, $info) { foreach ($this->pattern as $item => $pattern) { if ($item == 'user') { if (!preg_match($pattern, $user)) return false; } elseif ($item == 'grps') { if (!count(preg_grep($pattern, $info['grps']))) return false; } else { if (!preg_match($pattern, $info[$item])) return false; } } return true; } /* * Create a pattern for $this->_filter() * * @author Chris Smith <chris@jalakai.co.uk> * * @param array $filter */ protected function constructPattern($filter) { $this->pattern = array(); foreach ($filter as $item => $pattern) { $this->pattern[$item] = '/'.str_replace('/', '\/', $pattern).'/i'; // allow regex characters } } } ��

| ver. 1.4 | Github | . | PHP 7.4.33 | Генерация страницы: 0.02 | proxy | phpinfo | Настройка