lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Si il n'y a pas de lastpwd dfini il ne faut pas faire de test dessus.

Browse Source 
Fix: Si on ne renseigne pas de compte admin, on se contente d'un test de connection simple
Fix: On supprime le code ancien qui cre pb.
This commit is contained in:
Laurent Destailleur 2008-01-25 22:13:25 +00:00
parent 7c5f1c1b66
commit 02c9a57be4
5 changed files with 125 additions and 103 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
htdocs/includes/login/functions_ldap.php
View File

@ -41,8 +41,6 @@ function check_user_password_ldap($usertotest,$passwordtotest)
global $dolibarr_main_auth_ldap_admin_login,$dolibarr_main_auth_ldap_admin_pass; global $dolibarr_main_auth_ldap_admin_login,$dolibarr_main_auth_ldap_admin_pass;
global $dolibarr_main_auth_ldap_debug; global $dolibarr_main_auth_ldap_debug;
dolibarr_syslog("functions_ldap::check_user_password_ldap usertotest=".$usertotest);
if (! function_exists("ldap_connect")) if (! function_exists("ldap_connect"))
{ {
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko failed to connect to LDAP. LDAP functions are disabled on this PHP"); dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko failed to connect to LDAP. LDAP functions are disabled on this PHP");
@ -73,7 +71,9 @@ function check_user_password_ldap($usertotest,$passwordtotest)
if ($ldapdebug) print "DEBUG: Logging LDAP steps<br>\n"; if ($ldapdebug) print "DEBUG: Logging LDAP steps<br>\n";
// Debut code pour compatibilite (prend info depuis config en base) // Debut code pour compatibilite (prend info depuis config en base)
// Ne plus utiliser. La config LDAP de connexion doit etre dans le fichier conf.php // Ne plus utiliser.
// La config LDAP de connexion doit etre dans le fichier conf.php
/*
if (! $ldapuserattr && $conf->ldap->enabled) if (! $ldapuserattr && $conf->ldap->enabled)
{ {
if ($conf->global->LDAP_SERVER_TYPE == "activedirectory") if ($conf->global->LDAP_SERVER_TYPE == "activedirectory")
@ -92,8 +92,11 @@ function check_user_password_ldap($usertotest,$passwordtotest)
if (! $ldapdn) $ldapdn=$conf->global->LDAP_SERVER_DN; if (! $ldapdn) $ldapdn=$conf->global->LDAP_SERVER_DN;
if (! $ldapadminlogin) $ldapadminlogin=$conf->global->LDAP_ADMIN_DN; if (! $ldapadminlogin) $ldapadminlogin=$conf->global->LDAP_ADMIN_DN;
if (! $ldapadminpass) $ldapadminpass=$conf->global->LDAP_ADMIN_PASS; if (! $ldapadminpass) $ldapadminpass=$conf->global->LDAP_ADMIN_PASS;
*/
// Fin code pour compatiblite // Fin code pour compatiblite
dolibarr_syslog("functions_ldap::check_user_password_ldap usertotest=".$usertotest." admin_login=".$ldapadminlogin);
require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php"); require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
$ldap=new Ldap(); $ldap=new Ldap();
$ldap->server=array($ldaphost); $ldap->server=array($ldaphost);
@ -103,9 +106,14 @@ function check_user_password_ldap($usertotest,$passwordtotest)
$ldap->searchUser=$ldapadminlogin; $ldap->searchUser=$ldapadminlogin;
$ldap->searchPassword=$ldapadminpass; $ldap->searchPassword=$ldapadminpass;
if ($ldapdebug) dolibarr_syslog("Authentification LDAP --> Server:".join(',',$ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType.", Admin:".$ldap->searchUser.", Pass:".$ldap->searchPassword); if ($ldapdebug) dolibarr_syslog("functions_ldap::check_user_password_ldap Server:".join(',',$ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType.", Admin:".$ldap->searchUser.", Pass:".$ldap->searchPassword);
// Code to get user in LDAP (may differ from Dolibarr user) $resultCheckUserDN=false;
// If admin login provided
// Code to get user in LDAP from an admin connection (may differ from Dolibarr user)
if ($ldapadminlogin)
{
$result=$ldap->connect_bind(); $result=$ldap->connect_bind();
if ($result) if ($result)
{ {
@ -113,13 +121,13 @@ function check_user_password_ldap($usertotest,$passwordtotest)
// On stop si le mot de passe ldap doit etre modifie sur le domaine // On stop si le mot de passe ldap doit etre modifie sur le domaine
if ($resultFetchLdapUser == 1 && $ldap->pwdlastset == 0) if ($resultFetchLdapUser == 1 && $ldap->pwdlastset == 0)
{ {
dolibarr_syslog('functions_ldap::User '.$login.' must change password next logon'); dolibarr_syslog('functions_ldap::check_user_password_ldap '.$_POST["username"].' must change password next logon');
if ($ldapdebug) print "DEBUG: User ".$login." must change password<br>\n"; if ($ldapdebug) print "DEBUG: User ".$_POST["username"]." must change password<br>\n";
$ldap->close(); $ldap->close();
sleep(1); sleep(1);
$langs->load('ldap'); $langs->load('ldap');
$_SESSION["dol_loginmesg"]=$langs->trans("YouMustChangePassNextLogon",$ldap->domainFQDN); $_SESSION["dol_loginmesg"]=$langs->trans("YouMustChangePassNextLogon",$_POST["username"],$ldap->domainFQDN);
return $login; return '';
} }
else else
{ {
@ -127,12 +135,16 @@ function check_user_password_ldap($usertotest,$passwordtotest)
} }
} }
$ldap->close(); $ldap->close();
}
$ldap->searchUser=$usertotest; // Forge LDAP user and password to test from config setup
if ($resultCheckUserDN) $ldap->searchUser = $ldap->ldapUserDN; $ldap->searchUser=$ldapuserattr."=".$usertotest.",".$ldapdn;
$ldap->searchPassword=$passwordtotest; $ldap->searchPassword=$passwordtotest;
$result=$ldap->connect_bind(); // Test with this->seachUser and this->searchPassword if ($resultCheckUserDN) $ldap->searchUser = $ldap->ldapUserDN;
// Test with this->seachUser and this->searchPassword
$result=$ldap->connect_bind();
if ($result > 0) if ($result > 0)
{ {
if ($result == 2) if ($result == 2)
@ -172,7 +184,7 @@ function check_user_password_ldap($usertotest,$passwordtotest)
} }
if ($result == 1) if ($result == 1)
{ {
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko bad user/password pour '".$_POST["username"]."'"); dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko bad user/password for '".$_POST["username"]."'");
sleep(1); sleep(1);
$langs->load('main'); $langs->load('main');
$langs->load('other'); $langs->load('other');
@ -181,7 +193,7 @@ function check_user_password_ldap($usertotest,$passwordtotest)
} }
else else
{ {
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko failed to connect to LDAP pour '".$_POST["username"]."'"); dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko failed to connect to LDAP for '".$_POST["username"]."'");
sleep(1); sleep(1);
$langs->load('main'); $langs->load('main');
$langs->load('other'); $langs->load('other');

2
htdocs/langs/en_US/ldap.lang
View File

@ -1,6 +1,6 @@
# Dolibarr language file - en_US - ldap # Dolibarr language file - en_US - ldap
DomainPassword=Password for domain DomainPassword=Password for domain
YouMustChangePassNextLogon=You must change your password on the domain %s YouMustChangePassNextLogon=Password for user <b>%s</b> on the domain <b>%s</b> must be changed.
UserMustChangePassNextLogon=User must change password on the domain %s UserMustChangePassNextLogon=User must change password on the domain %s
LdapUacf_NORMAL_ACCOUNT=User account LdapUacf_NORMAL_ACCOUNT=User account
LdapUacf_DONT_EXPIRE_PASSWORD=Password never expires LdapUacf_DONT_EXPIRE_PASSWORD=Password never expires

2
htdocs/langs/fr_FR/ldap.lang
View File

@ -1,6 +1,6 @@
# Dolibarr language file - fr_FR - ldap # Dolibarr language file - fr_FR - ldap
DomainPassword=Mot de passe du domaine DomainPassword=Mot de passe du domaine
YouMustChangePassNextLogon=Vous devez modifier votre mot de passe sur le domaine %s YouMustChangePassNextLogon=Le mot de passe de <b>%s</b> sur le domaine <b>%s</b> doit etre modifié.
UserMustChangePassNextLogon=L'utilisateur doit modifier son mot de passe sur le domaine %s UserMustChangePassNextLogon=L'utilisateur doit modifier son mot de passe sur le domaine %s
LdapUacf_NORMAL_ACCOUNT=Compte utilisateur LdapUacf_NORMAL_ACCOUNT=Compte utilisateur
LdapUacf_DONT_EXPIRE_PASSWORD=Le mot de passe n'expire jamais LdapUacf_DONT_EXPIRE_PASSWORD=Le mot de passe n'expire jamais

18
htdocs/lib/ldap.class.php
View File

@ -435,9 +435,12 @@ class Ldap
/** /**
* Checks a username and password - does this by logging on to the * \brief Checks a username and password - does this by logging on to the
* server as a user - specified in the DN. There are several reasons why * server as a user - specified in the DN. There are several reasons why
* this login could fail - these are listed below. * this login could fail - these are listed below.
* \return uname Username to check
* \return pass Password to check
* \return boolean true=check pass ok, falses=check pass failed
*/ */
function checkPass($uname,$pass) function checkPass($uname,$pass)
{ {
@ -450,7 +453,7 @@ class Ldap
$domain = eregi_replace(',','.',$domain); $domain = eregi_replace(',','.',$domain);
$checkDn = "$uname@$domain"; $checkDn = "$uname@$domain";
} else { } else {
$checkDn = $this->getUserIdentifier() . "=$uname, " . $this->setDn(true); $checkDn = $this->getUserIdentifier()."=".$uname.", ".$this->setDn(true);
} }
// Try and connect... // Try and connect...
$this->result = @ldap_bind( $this->connection,$checkDn,$pass); $this->result = @ldap_bind( $this->connection,$checkDn,$pass);
@ -866,6 +869,7 @@ class Ldap
/** /**
* \brief Récupère les attributs de l'utilisateur * \brief Récupère les attributs de l'utilisateur
* \param $user Utilisateur ldap à lire * \param $user Utilisateur ldap à lire
* \return int >0 if ok, <0 if ko
*/ */
function fetch($user) function fetch($user)
{ {
@ -890,7 +894,8 @@ class Ldap
if ($this->result) if ($this->result)
{ {
$result = @ldap_get_entries( $this->connection, $this->result); $result = @ldap_get_entries($this->connection, $this->result);
//var_dump($result);
} }
else else
{ {
@ -927,7 +932,14 @@ class Ldap
$this->mobile = $this->ldap_utf8_decode($result[0][$this->attr_mobile][0]); $this->mobile = $this->ldap_utf8_decode($result[0][$this->attr_mobile][0]);
$this->uacf = $this->parseUACF($this->ldap_utf8_decode($result[0]["useraccountcontrol"][0])); $this->uacf = $this->parseUACF($this->ldap_utf8_decode($result[0]["useraccountcontrol"][0]));
if (isset($result[0]["pwdlastset"][0])) // If expiration on password exists
{
$this->pwdlastset = ($result[0]["pwdlastset"][0] != 0)?$this->convert_time($this->ldap_utf8_decode($result[0]["pwdlastset"][0])):0; $this->pwdlastset = ($result[0]["pwdlastset"][0] != 0)?$this->convert_time($this->ldap_utf8_decode($result[0]["pwdlastset"][0])):0;
}
else
{
$this->pwdlastset = -1;
}
if (!$this->name && !$this->login) $this->pwdlastset = -1; if (!$this->name && !$this->login) $this->pwdlastset = -1;
$this->badpwdtime = $this->convert_time($this->ldap_utf8_decode($result[0]["badpasswordtime"][0])); $this->badpwdtime = $this->convert_time($this->ldap_utf8_decode($result[0]["badpasswordtime"][0]));

2
htdocs/user/perms.php
View File

@ -202,8 +202,6 @@ print '<tr><td width="25%" valign="top">'.$langs->trans("Firstname").'</td>';
print '<td colspan="2">'.$fuser->prenom.'</td>'; print '<td colspan="2">'.$fuser->prenom.'</td>';
print "</tr>\n"; print "</tr>\n";
print info_admin($langs->trans("WarningOnlyPermissionOfActivatedModules"));
print '</table><br>'; print '</table><br>';
print info_admin($langs->trans("WarningOnlyPermissionOfActivatedModules")); print info_admin($langs->trans("WarningOnlyPermissionOfActivatedModules"));