mykola/opnsense-ports
1
0
Fork 0
forked from Lainports/opnsense-ports
Code Pull requests Activity
opnsense-ports/net/phpldapadmin/files/patch-lib_ds__ldap.php
Franco Fichtner 9b6a4bce11 */*: sync with upstream 
Taken from: FreeBSD
2022-12-13 08:59:56 +01:00

490 lines
20 KiB
PHP
Raw Blame History

--- lib/ds_ldap.php.orig 2021-12-12 02:35:51 UTC
+++ lib/ds_ldap.php
@@ -206,6 +206,7 @@ class ldap extends DS {
if ($this->getValue('server','port'))
$resource = ldap_connect($this->getValue('server','host'),$this->getValue('server','port'));
+
else
$resource = ldap_connect($this->getValue('server','host'));
@@ -216,7 +217,8 @@ class ldap extends DS {
debug_log('LDAP Resource [%s], Host [%s], Port [%s]',16,0,__FILE__,__LINE__,__METHOD__,
$resource,$this->getValue('server','host'),$this->getValue('server','port'));
- if (! is_resource($resource))
+ // if (! is_resource($resource))
+ if ( !$resource )
debug_dump_backtrace('UNHANDLED, $resource is not a resource',1);
# Go with LDAP version 3 if possible (needed for renaming and Novell schema fetching)
@@ -328,7 +330,7 @@ class ldap extends DS {
}
}
- if (! $this->isAnonBindAllowed() && ! trim($userDN))
+ if (! $this->isAnonBindAllowed() && ! trim((string) $userDN))
return false;
# Temporarily set our user details
@@ -337,7 +339,7 @@ class ldap extends DS {
$connect = $this->connect($method,false,$new);
# If we didnt log in...
- if (! is_resource($connect) || $this->noconnect || ! $this->userIsAllowedLogin($userDN)) {
+ if (!$connect || $this->noconnect || ! $this->userIsAllowedLogin($userDN)) {
$this->logout($method);
return false;
@@ -565,11 +567,11 @@ class ldap extends DS {
private function fillDNTemplate($user) {
foreach($this->getLoginBaseDN() as $base)
- if(substr_compare($user, $base, -strlen($base)) === 0)
+ if(substr_compare($user, $base, -strlen((string) $base)) === 0)
return $user; // $user already passed as DN
// fill template
- return sprintf($this->getValue('login', 'bind_dn_template'), preg_replace('/([,\\\\#+<>;"=])/', '\\\\$1', $user));
+ return sprintf($this->getValue('login', 'bind_dn_template'), preg_replace('/([,\\\\#+<>;"=])/', '\\\\$1',is_null( $user)? "": $user));
}
/**
@@ -684,7 +686,7 @@ class ldap extends DS {
if (! in_array($this->getValue('login','auth_type'), array('sasl','sasl_external'))) {
// check if SASL mech uses login from other auth_types
- if (! in_array(strtolower($this->getValue('sasl', 'mech')), array('plain')))
+ if (! in_array(strtolower((string) $this->getValue('sasl', 'mech')), array('plain')))
return false;
}
@@ -722,7 +724,7 @@ class ldap extends DS {
}
# At the moment, we have only implemented GSSAPI and PLAIN
- if (! in_array(strtolower($this->getValue('sasl','mech')),array('gssapi','plain'))) {
+ if (! in_array(strtolower((string) $this->getValue('sasl','mech')),array('gssapi','plain'))) {
system_message(array(
'title'=>_('SASL Method not implemented'),
'body'=>sprintf('<b>%s</b>: %s %s',_('Error'),$this->getValue('sasl','mech'),_('has not been implemented yet')),
@@ -731,7 +733,7 @@ class ldap extends DS {
return false;
}
- if (strtolower($this->getValue('sasl','mech')) == 'plain') {
+ if (strtolower((string) $this->getValue('sasl','mech')) == 'plain') {
return @ldap_sasl_bind($resource,NULL,$pass,'PLAIN',
$this->getValue('sasl','realm'),
$login,
@@ -746,14 +748,15 @@ class ldap extends DS {
/*
# Do we need to rewrite authz_id?
if (! isset($CACHE['authz_id']))
- if (! trim($this->getValue('sasl','authz_id')) && strtolower($this->getValue('sasl','mech')) != 'gssapi') {
+ if (! trim((string) $this->getValue('sasl','authz_id')) && strtolower((string) $this->getValue('sasl','mech')) != 'gssapi') {
if (DEBUG_ENABLED)
debug_log('Rewriting bind DN [%s] -> authz_id with regex [%s] and replacement [%s].',9,0,__FILE__,__LINE__,__METHOD__,
$CACHE['login_dn'],
$this->getValue('sasl','authz_id_regex'),
$this->getValue('sasl','authz_id_replacement'));
- $CACHE['authz_id'] = @preg_replace($this->getValue('sasl','authz_id_regex'),
+ $CACHE['authz_id'] = @preg_replace($this->getValue('sasl','authz_id_regex'),is_null(
+)? "":
$this->getValue('sasl','authz_id_replacement'),$CACHE['login_dn']);
# Invalid regex?
@@ -1212,14 +1215,14 @@ class ldap extends DS {
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',17,0,__FILE__,__LINE__,__METHOD__,$fargs);
- if (! trim($dn))
+ if (! trim((string) $dn))
return $dn;
# Check if the RDN has a comma and escape it.
while (preg_match('/([^\\\\]),(\s*[^=]*\s*),/',$dn))
- $dn = preg_replace('/([^\\\\]),(\s*[^=]*\s*),/','$1\\\\2C$2,',$dn);
+ $dn = preg_replace('/([^\\\\]),(\s*[^=]*\s*),/','$1\\\\2C$2,',is_null($dn)? "":$dn);
- $dn = preg_replace('/([^\\\\]),(\s*[^=]*\s*)([^,])$/','$1\\\\2C$2$3',$dn);
+ $dn = preg_replace('/([^\\\\]),(\s*[^=]*\s*)([^,])$/','$1\\\\2C$2$3',is_null($dn)? "":$dn);
if (DEBUG_ENABLED)
debug_log('Returning (%s)',17,0,__FILE__,__LINE__,__METHOD__,$dn);
@@ -1237,12 +1240,12 @@ class ldap extends DS {
if (is_array($dn)) {
$a = array();
foreach ($dn as $key => $rdn) {
- $a[$key] = preg_replace_callback('/\\\([0-9A-Fa-f]{2})/', function($m) { return chr(hexdec($m[1])); }, $rdn);
+ $a[$key] = preg_replace_callback('/\\\([0-9A-Fa-f]{2})/', function($m) { return chr(hexdec($m[1])); },is_null( $rdn)? "": $rdn);
}
return $a;
} else {
- return preg_replace_callback('/\\\([0-9A-Fa-f]{2})/', function($m) { return chr(hexdec($m[1])); }, $dn);
+ return preg_replace_callback('/\\\([0-9A-Fa-f]{2})/', function($m) { return chr(hexdec($m[1])); },is_null( $dn)? "": $dn);
}
}
@@ -1388,7 +1391,7 @@ class ldap extends DS {
return false;
# error checking
- $schema_to_fetch = strtolower($schema_to_fetch);
+ $schema_to_fetch = strtolower((string) $schema_to_fetch);
if (! is_null($this->_schema_entries) && isset($this->_schema_entries[$schema_to_fetch])) {
$schema = $this->_schema_entries[$schema_to_fetch];
@@ -1408,7 +1411,7 @@ class ldap extends DS {
$schema_dn = $this->getSchemaDN($method,$dn);
# Do we need to try again with the Root DSE?
- if (! $schema_dn && trim($dn))
+ if (! $schema_dn && trim((string) $dn))
$schema_dn = $this->getSchemaDN($method,'');
# Store the eventual schema retrieval in $schema_search
@@ -1609,7 +1612,7 @@ class ldap extends DS {
foreach ($entry[$olc_schema] as $schema_definition)
/* Schema definitions in child nodes prefix the schema entries with "{n}"
the preg_replace call strips out this prefix. */
- $schema[] = preg_replace('/^\{\d*\}\(/','(',$schema_definition);
+ $schema[] = preg_replace('/^\{\d*\}\(/','(',is_null($schema_definition)? "":$schema_definition);
}
}
@@ -1672,7 +1675,7 @@ class ldap extends DS {
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',25,0,__FILE__,__LINE__,__METHOD__,$fargs);
- $oclass_name = strtolower($oclass_name);
+ $oclass_name = strtolower((string) $oclass_name);
$socs = $this->SchemaObjectClasses($method,$dn);
# Default return value
@@ -1703,7 +1706,7 @@ class ldap extends DS {
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',25,0,__FILE__,__LINE__,__METHOD__,$fargs);
- $attr_name = strtolower($attr_name);
+ $attr_name = strtolower((string) $attr_name);
$sattrs = $this->SchemaAttributes($method,$dn);
# Default return value
@@ -1752,7 +1755,7 @@ class ldap extends DS {
$return = array();
foreach ($raw as $line) {
- if (is_null($line) || ! strlen($line))
+ if (is_null($line) || ! strlen((string) $line))
continue;
$object_class = new ObjectClass($line,$this);
@@ -1762,13 +1765,13 @@ class ldap extends DS {
# Now go through and reference the parent/child relationships
foreach ($return as $oclass)
foreach ($oclass->getSupClasses() as $parent_name)
- if (isset($return[strtolower($parent_name)]))
- $return[strtolower($parent_name)]->addChildObjectClass($oclass->getName(false));
+ if (isset($return[strtolower((string) $parent_name)]))
+ $return[strtolower((string) $parent_name)]->addChildObjectClass($oclass->getName(false));
ksort($return);
# cache the schema to prevent multiple schema fetches from LDAP server
- set_cached_item($this->index,'schema','objectclasses',$return);
+ set_cached_item($this->index,$return,'schema','objectclasses');
}
if (DEBUG_ENABLED)
@@ -1816,7 +1819,7 @@ class ldap extends DS {
*/
$attrs_oid = array();
foreach ($raw as $line) {
- if (is_null($line) || ! strlen($line))
+ if (is_null($line) || ! strlen((string) $line))
continue;
$attr = new AttributeType($line);
@@ -1847,7 +1850,7 @@ class ldap extends DS {
$new_attr->setName($alias_attr_name);
$new_attr->addAlias($attr->getName(false));
$new_attr->removeAlias($alias_attr_name);
- $new_attr_key = strtolower($alias_attr_name);
+ $new_attr_key = strtolower((string) $alias_attr_name);
$attrs[$new_attr_key] = $new_attr;
}
}
@@ -1858,7 +1861,7 @@ class ldap extends DS {
$sup_attr_name = $attr->getSupAttribute();
$sup_attr = null;
- if (trim($sup_attr_name)) {
+ if (trim((string) $sup_attr_name)) {
/* This loop really should traverse infinite levels of inheritance (SUP) for attributeTypes,
* but just in case we get carried away, stop at 100. This shouldn't happen, but for
@@ -1871,17 +1874,17 @@ class ldap extends DS {
$sup_attr_name = $attr->getSupAttribute();
}
- if (! isset($attrs[strtolower($sup_attr_name)])){
+ if (! isset($attrs[strtolower((string) $sup_attr_name)])){
error(sprintf('Schema error: attributeType "%s" inherits from "%s", but attributeType "%s" does not exist.',
$attr->getName(),$sup_attr_name,$sup_attr_name),'error','index.php');
return;
}
- $sup_attr = $attrs[strtolower($sup_attr_name)];
+ $sup_attr = $attrs[strtolower((string) $sup_attr_name)];
$sup_attr_name = $sup_attr->getSupAttribute();
# Does this superior attributeType not have a superior attributeType?
- if (is_null($sup_attr_name) || strlen(trim($sup_attr_name)) == 0) {
+ if (is_null($sup_attr_name) || strlen((string) trim((string) $sup_attr_name)) == 0) {
/* Since this attribute's superior attribute does not have another superior
* attribute, clone its properties for this attribute. Then, replace
@@ -1936,24 +1939,24 @@ class ldap extends DS {
# Add Used In.
foreach ($oclass_attrs as $attr_name)
- if (isset($attrs[strtolower($attr_name)]))
- $attrs[strtolower($attr_name)]->addUsedInObjectClass($object_class->getName(false));
+ if (isset($attrs[strtolower((string) $attr_name)]))
+ $attrs[strtolower((string) $attr_name)]->addUsedInObjectClass($object_class->getName(false));
# Add Required By.
foreach ($must_attrs as $attr_name)
- if (isset($attrs[strtolower($attr_name)]))
- $attrs[strtolower($attr_name)]->addRequiredByObjectClass($object_class->getName(false));
+ if (isset($attrs[strtolower((string) $attr_name)]))
+ $attrs[strtolower((string) $attr_name)]->addRequiredByObjectClass($object_class->getName(false));
# Force May
foreach ($object_class->getForceMayAttrs() as $attr_name)
- if (isset($attrs[strtolower($attr_name->name)]))
- $attrs[strtolower($attr_name->name)]->setForceMay();
+ if (isset($attrs[strtolower((string) $attr_name->name)]))
+ $attrs[strtolower((string) $attr_name->name)]->setForceMay();
}
$return = $attrs;
# cache the schema to prevent multiple schema fetches from LDAP server
- set_cached_item($this->index,'schema','attributes',$return);
+ set_cached_item($this->index,$return,'schema','attributes');
}
if (DEBUG_ENABLED)
@@ -1987,7 +1990,7 @@ class ldap extends DS {
$rules = array();
foreach ($raw as $line) {
- if (is_null($line) || ! strlen($line))
+ if (is_null($line) || ! strlen((string) $line))
continue;
$rule = new MatchingRule($line);
@@ -2003,7 +2006,7 @@ class ldap extends DS {
if ($raw != false) {
foreach ($raw as $line) {
- if (is_null($line) || ! strlen($line))
+ if (is_null($line) || ! strlen((string) $line))
continue;
$rule_use = new MatchingRuleUse($line);
@@ -2019,7 +2022,7 @@ class ldap extends DS {
$sattrs = $this->SchemaAttributes($method,$dn);
if (is_array($sattrs))
foreach ($sattrs as $attr) {
- $rule_key = strtolower($attr->getEquality());
+ $rule_key = strtolower((string) $attr->getEquality());
if (isset($rules[$rule_key]))
$rules[$rule_key]->addUsedByAttr($attr->getName(false));
@@ -2029,7 +2032,7 @@ class ldap extends DS {
$return = $rules;
# cache the schema to prevent multiple schema fetches from LDAP server
- set_cached_item($this->index,'schema','matchingrules',$return);
+ set_cached_item($this->index,$return,'schema','matchingrules');
}
if (DEBUG_ENABLED)
@@ -2063,11 +2066,11 @@ class ldap extends DS {
$return = array();
foreach ($raw as $line) {
- if (is_null($line) || ! strlen($line))
+ if (is_null($line) || ! strlen((string) $line))
continue;
$syntax = new Syntax($line);
- $key = strtolower(trim($syntax->getOID()));
+ $key = strtolower((string) trim((string) $syntax->getOID()));
if (! $key)
continue;
@@ -2078,7 +2081,7 @@ class ldap extends DS {
ksort($return);
# cache the schema to prevent multiple schema fetches from LDAP server
- set_cached_item($this->index,'schema','syntaxes',$return);
+ set_cached_item($this->index,$return,'schema','syntaxes');
}
if (DEBUG_ENABLED)
@@ -2097,7 +2100,7 @@ class ldap extends DS {
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',17,0,__FILE__,__LINE__,__METHOD__,$fargs);
- return in_array($attr_name,unserialize(strtolower(serialize($this->getValue('server','force_may')))));
+ return in_array($attr_name,unserialize(strtolower((string) serialize($this->getValue('server','force_may')))));
}
/**
@@ -2133,7 +2136,7 @@ class ldap extends DS {
debug_log('Entered (%%)',17,0,__FILE__,__LINE__,__METHOD__,$fargs);
# Ensure our attr is in lowercase
- $attr = strtolower($attr);
+ $attr = strtolower((string) $attr);
$values = $this->getDNAttrValues($dn,$method,$deref);
@@ -2247,7 +2250,7 @@ class ldap extends DS {
# Simple test first
$dn_attrs = array('aliasedObjectName');
foreach ($dn_attrs as $dn_attr)
- if (strcasecmp($attr_name,$dn_attr) == 0)
+ if (strcasecmp((string) $attr_name,(string) $dn_attr) == 0)
return true;
# Now look at the schema OID
@@ -2266,7 +2269,7 @@ class ldap extends DS {
return false;
$syntax_desc = $syntaxes[ $syntax_oid ]->getDescription();
- if (strpos(strtolower($syntax_desc),'distinguished name'))
+ if (strpos(strtolower((string) $syntax_desc),'distinguished name'))
return true;
return false;
@@ -2286,7 +2289,7 @@ class ldap extends DS {
debug_log('Entered (%%)',17,0,__FILE__,__LINE__,__METHOD__,$fargs);
# easy quick check
- if (! strcasecmp($attr_name,'jpegPhoto') || ! strcasecmp($attr_name,'photo'))
+ if (! strcasecmp((string) $attr_name,'jpegPhoto') || ! strcasecmp((string) $attr_name,'photo'))
return true;
# go to the schema and get the Syntax OID
@@ -2297,7 +2300,7 @@ class ldap extends DS {
$oid = $sattr->getSyntaxOID();
$type = $sattr->getType();
- if (! strcasecmp($type,'JPEG') || ($oid == '1.3.6.1.4.1.1466.115.121.1.28'))
+ if (! strcasecmp((string) $type,'JPEG') || ((string) $oid == '1.3.6.1.4.1.1466.115.121.1.28'))
return true;
return false;
@@ -2318,9 +2321,9 @@ class ldap extends DS {
$type = ($sattr = $this->getSchemaAttribute($attr_name)) ? $sattr->getType() : null;
- if (! strcasecmp('boolean',$type) ||
- ! strcasecmp('isCriticalSystemObject',$attr_name) ||
- ! strcasecmp('showInAdvancedViewOnly',$attr_name))
+ if (! strcasecmp('boolean',(string) $type) ||
+ ! strcasecmp('isCriticalSystemObject',(string) $attr_name) ||
+ ! strcasecmp('showInAdvancedViewOnly',(string) $attr_name))
return true;
else
@@ -2359,7 +2362,7 @@ class ldap extends DS {
static $attr_cache;
- $attr_name = strtolower($attr_name);
+ $attr_name = strtolower((string) $attr_name);
if (isset($attr_cache[$this->index][$attr_name]))
return $attr_cache[$this->index][$attr_name];
@@ -2370,7 +2373,7 @@ class ldap extends DS {
}
# Quick check: If the attr name ends in ";binary", then it's binary.
- if (strcasecmp(substr($attr_name,strlen($attr_name) - 7),';binary') == 0) {
+ if (strcasecmp(substr((string) $attr_name,strlen((string) (string) $attr_name) - 7),';binary') == 0) {
$attr_cache[$this->index][$attr_name] = true;
return true;
}
@@ -2389,17 +2392,17 @@ class ldap extends DS {
$syntax = $sattr->getSyntaxOID();
}
- if (strcasecmp($type,'Certificate') == 0 ||
- strcasecmp($type,'Binary') == 0 ||
- strcasecmp($attr_name,'usercertificate') == 0 ||
- strcasecmp($attr_name,'usersmimecertificate') == 0 ||
- strcasecmp($attr_name,'networkaddress') == 0 ||
- strcasecmp($attr_name,'objectGUID') == 0 ||
- strcasecmp($attr_name,'objectSID') == 0 ||
- strcasecmp($attr_name,'auditingPolicy') == 0 ||
- strcasecmp($attr_name,'jpegPhoto') == 0 ||
- strcasecmp($attr_name,'krbExtraData') == 0 ||
- strcasecmp($attr_name,'krbPrincipalKey') == 0 ||
+ if (strcasecmp((string) $type,'Certificate') == 0 ||
+ strcasecmp((string) $type,'Binary') == 0 ||
+ strcasecmp((string) $attr_name,'usercertificate') == 0 ||
+ strcasecmp((string) $attr_name,'usersmimecertificate') == 0 ||
+ strcasecmp((string) $attr_name,'networkaddress') == 0 ||
+ strcasecmp((string) $attr_name,'objectGUID') == 0 ||
+ strcasecmp((string) $attr_name,'objectSID') == 0 ||
+ strcasecmp((string) $attr_name,'auditingPolicy') == 0 ||
+ strcasecmp((string) $attr_name,'jpegPhoto') == 0 ||
+ strcasecmp((string) $attr_name,'krbExtraData') == 0 ||
+ strcasecmp((string) $attr_name,'krbPrincipalKey') == 0 ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.10' ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.28' ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.5' ||
@@ -2428,7 +2431,7 @@ class ldap extends DS {
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',17,0,__FILE__,__LINE__,__METHOD__,$fargs);
- $user = strtolower($user);
+ $user = strtolower((string) $user);
$group = $this->getDNAttrValues($group);
# If you are using groupOfNames objectClass
@@ -2459,7 +2462,7 @@ class ldap extends DS {
if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS'))
debug_log('Entered (%%)',17,0,__FILE__,__LINE__,__METHOD__,$fargs);
- $dn = trim(strtolower($dn));
+ $dn = trim((string) strtolower((string) $dn));
if (! $this->getValue('login','allowed_dns'))
return true;
@@ -2498,7 +2501,7 @@ class ldap extends DS {
debug_log('Comparing with [%s]',80,0,__FILE__,__LINE__,__METHOD__,$result_dn);
# Check if $result_dn is a user DN
- if (strcasecmp($dn,trim(strtolower($result_dn))) == 0)
+ if (strcasecmp((string) $dn,trim((string) strtolower((string) (string) $result_dn))) == 0)
return true;
# Check if $result_dn is a group DN
@@ -2510,7 +2513,7 @@ class ldap extends DS {
}
# Check if $login_allowed_dn is a user DN
- if (strcasecmp($dn,trim(strtolower($login_allowed_dn))) == 0)
+ if (strcasecmp((string) $dn,trim((string) strtolower((string) (string) $login_allowed_dn))) == 0)
return true;
# Check if $login_allowed_dn is a group DN
View git blame Copy permalink