gosa-core/plugins/personal/posix/class_posixAccount.inc

   1 <?php
   2 /*
   3  * This code is part of GOsa (http://www.gosa-project.org)
   4  * Copyright (C) 2003-2008 GONICUS GmbH
   5  *
   6  * ID: $$Id$$
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  */
  22
  23 /*!
  24   \brief   posixAccount plugin
  25   \author  Cajus Pollmeier <pollmeier@gonicus.de>
  26   \version 2.00
  27   \date    24.07.2003
  28
  29   This class provides the functionality to read and write all attributes
  30   relevant for posixAccounts and shadowAccounts from/to the LDAP. It
  31   does syntax checking and displays the formulars required.
  32  */
  33
  34 class posixAccount extends plugin
  35 {
  36   /* Definitions */
  37   var $plHeadline= "UNIX";
  38   var $plDescription= "Edit users POSIX settings";
  39
  40   /* Plugin specific values */
  41   var $homeDirectory= "";
  42   var $loginShell= "/bin/bash";
  43   var $uidNumber= "";
  44   var $gidNumber= "";
  45   var $gecos= "";
  46   var $shadowMin= "0";
  47   var $shadowMax= "0";
  48   var $shadowWarning= "0";
  49   var $shadowLastChange= "0";
  50   var $shadowInactive= "0";
  51   var $shadowExpire= "";
  52   var $accessTo= array();
  53   var $trustModel= "";
  54
  55   var $glist=array();
  56   var $status= "";
  57   var $loginShellList= array();
  58   var $groupMembership= array();
  59   var $savedGroupMembership= array();
  60   var $savedUidNumber= "";
  61   var $savedGidNumber= "";
  62   var $activate_shadowMin= "0";
  63   var $activate_shadowMax= "0";
  64   var $activate_shadowWarning= "0";
  65   var $activate_shadowInactive= "0";
  66   var $activate_shadowExpire= "0";
  67   var $mustchangepassword= "0";
  68   var $force_ids= 0;
  69   var $gotoLastSystemLogin= "";
  70   var $groupSelect= FALSE;
  71   var $trustSelect= FALSE;
  72   var $secondaryGroups= array();
  73   var $primaryGroup= 0;
  74   var $was_trust_account= FALSE;
  75   var $memberGroup= array();
  76   var $grouplist= array();
  77   var $ui= array();
  78   var $ssh= null;
  79   var $sshAcl= "";
  80
  81   var $GroupRegex= "*";
  82   var $GroupUserRegex= "*";
  83   var $SubSearch= false;
  84
  85   var $view_logged= false;
  86
  87   /* attribute list for save action */
  88   var $CopyPasteVars  =
  89     array("grouplist","groupMembership","activate_shadowMin",
  90         "activate_shadowMax","activate_shadowWarning","activate_shadowInactive","activate_shadowExpire",
  91         "must_change_password","printerList","grouplist","savedGidNumber","savedUidNumber");
  92
  93   var $attributes     = array("homeDirectory", "loginShell", "uidNumber", "gidNumber", "gecos",
  94       "shadowMin", "shadowMax", "shadowWarning", "shadowInactive", "shadowLastChange",
  95       "shadowExpire", "uid","accessTo","trustModel", "gotoLastSystemLogin");
  96
  97   var $objectclasses= array("posixAccount", "shadowAccount");
  98
  99   var $uid= "";
 100   var $multiple_support = TRUE;
 101   var $groupMembership_some = array();
 102
 103   /* constructor, if 'dn' is set, the node loads the given
 104      'dn' from LDAP */
 105   function posixAccount (&$config, $dn= NULL)
 106   {
 107     global $class_mapping;
 108
 109     /* Configuration is fine, allways */
 110     $this->config= $config;
 111
 112     /* Load bases attributes */
 113     plugin::plugin($config, $dn);
 114
 115     /*  If gotoLastSystemLogin is available read it from ldap and create a readable
 116         date time string, fallback to sambaLogonTime if available.
 117      */
 118     if(isset($this->attrs['gotoLastSystemLogin'][0]) && preg_match("/^[0-9]*$/",$this->attrs['gotoLastSystemLogin'][0])){
 119       $this->gotoLastSystemLogin = date("d.m.Y H:i:s", strtotime($this->attrs['gotoLastSystemLogin'][0]));
 120     } else if(isset($this->attrs['sambaLogonTime'][0]) && preg_match("/^[0-9]*$/",$this->attrs['sambaLogonTime'][0])){
 121       $this->gotoLastSystemLogin = date("d.m.Y H:i:s", $this->attrs['sambaLogonTime'][0]);
 122     }
 123
 124     /* Setting uid to default */
 125     if(isset($this->attrs['uid'][0])){
 126       $this->uid = $this->attrs['uid'][0];
 127     }
 128
 129     $ldap= $this->config->get_ldap_link();
 130
 131     if ($dn !== NULL){
 132
 133       /* Correct is_account. shadowAccount is not required. */
 134       if (isset($this->attrs['objectClass']) &&
 135           in_array ('posixAccount', $this->attrs['objectClass'])){
 136
 137         $this->is_account= TRUE;
 138       }
 139
 140       /* Is this account a trustAccount? */
 141       if ($this->is_account && isset($this->attrs['trustModel'])){
 142         $this->trustModel= $this->attrs['trustModel'][0];
 143         $this->was_trust_account= TRUE;
 144       } else {
 145         $this->was_trust_account= FALSE;
 146         $this->trustModel= "";
 147       }
 148
 149       $this->accessTo = array();
 150       if ($this->is_account && isset($this->attrs['accessTo'])){
 151         for ($i= 0; $i<$this->attrs['accessTo']['count']; $i++){
 152           $tmp= $this->attrs['accessTo'][$i];
 153           $this->accessTo[$tmp]= $tmp;
 154         }
 155       }
 156       $this->initially_was_account= $this->is_account;
 157
 158       /* Fill group */
 159       $this->primaryGroup= $this->gidNumber;
 160
 161       /* Generate status text */
 162       $current= date("U");
 163
 164       $current= floor($current / 60 /60 / 24);
 165
 166       if (($current >= $this->shadowExpire) && $this->shadowExpire){
 167         $this->status= _("expired");
 168         if (($current - $this->shadowExpire) < $this->shadowInactive){
 169           $this->status.= ", "._("grace time active");
 170         }
 171       } elseif (($this->shadowLastChange + $this->shadowMin) >= $current){
 172         $this->status= _("active").", "._("password not changeable");
 173       } elseif (($this->shadowLastChange + $this->shadowMax) >= $current){
 174         $this->status= _("active").", "._("password expired");
 175       } else {
 176         $this->status= _("active");
 177       }
 178
 179       /* Get group membership */
 180       $ldap->cd($this->config->current['BASE']);
 181       $ldap->search("(&(objectClass=posixGroup)(memberUid=".$this->uid."))", array("cn", "description"));
 182
 183       while ($attrs= $ldap->fetch()){
 184         if (!isset($attrs["description"][0])){
 185           $entry= $attrs["cn"][0];
 186         } else {
 187           $entry= $attrs["cn"][0]." [".$attrs["description"][0]."]";
 188         }
 189         $this->groupMembership[$ldap->getDN()]= $entry;
 190       }
 191       asort($this->groupMembership);
 192       reset($this->groupMembership);
 193       $this->savedGroupMembership= $this->groupMembership;
 194       $this->savedUidNumber= $this->uidNumber;
 195       $this->savedGidNumber= $this->gidNumber;
 196
 197       // Instanciate SSH object if available
 198       if (isset($class_mapping["sshPublicKey"])){
 199         if (empty($this->acl_base)){
 200           $this->acl_base= $config->current['BASE'];
 201         }
 202
 203         $this->sshAcl= $this->getacl("sshPublicKey");
 204         $this->ssh= new sshPublicKey($this->config, $this->dn, $this->sshAcl);
 205       }
 206     }
 207
 208     /* Adjust shadow checkboxes */
 209     foreach (array("shadowMin", "shadowMax", "shadowWarning", "shadowInactive",
 210           "shadowExpire") as $val){
 211
 212       if ($this->$val != 0){
 213         $oval= "activate_".$val;
 214         $this->$oval= "1";
 215       }
 216     }
 217
 218     /* Convert shadowExpire for usage */
 219     if ($this->shadowExpire == 0){
 220       $this->shadowExpire= "";
 221     } else {
 222       $this->shadowExpire= date('d.m.Y', $this->shadowExpire * 60 * 60 * 24);
 223     }
 224
 225
 226     /* Generate shell list from CONFIG_DIR./shells */
 227     if (file_exists(CONFIG_DIR.'/shells')){
 228       $shells = file (CONFIG_DIR.'/shells');
 229       foreach ($shells as $line){
 230         if (!preg_match ("/^#/", $line)){
 231           $this->loginShellList[]= trim($line);
 232         }
 233       }
 234     } else {
 235       if ($this->loginShell == ""){
 236         $this->loginShellList[]= _("unconfigured");
 237       }
 238     }
 239
 240     /* Insert possibly missing loginShell */
 241     if ($this->loginShell != "" && !in_array($this->loginShell, $this->loginShellList)){
 242       $this->loginShellList[]= $this->loginShell;
 243     }
 244
 245     /* Generate group list */
 246     $this->ui = get_userinfo();
 247     $this->secondaryGroups[]= "- "._("automatic")." -";
 248     $ldap->cd($this->config->current['BASE']);
 249     $ldap->search("(objectClass=posixGroup)", array("cn", "gidNumber"));
 250     while($attrs = $ldap->fetch()){
 251       $this->secondaryGroups[$attrs['gidNumber'][0]]= $attrs['cn'][0];
 252     }
 253     asort ($this->secondaryGroups);
 254
 255     $this->ui = get_userinfo();
 256   }
 257
 258
 259   /* execute generates the html output for this node */
 260   function execute($isCopyPaste = false)
 261   {
 262     /* Call parent execute */
 263     plugin::execute();
 264     $display= "";
 265
 266     /* Log view */
 267     if($this->is_account && !$this->view_logged){
 268       $this->view_logged = TRUE;
 269       new log("view","users/".get_class($this),$this->dn);
 270     }
 271
 272     if($this->multiple_support_active){
 273       $this->is_account = TRUE;
 274     }
 275
 276     if(!$isCopyPaste && ! $this->multiple_support_active){
 277
 278       /* Do we need to flip is_account state? */
 279       if(isset($_POST['modify_state'])){
 280         if($this->is_account && $this->acl_is_removeable()){
 281           $this->is_account= FALSE;
 282         }elseif(!$this->is_account && $this->acl_is_createable()){
 283           $this->is_account= TRUE;
 284         }
 285       }
 286
 287       /* Do we represent a valid posixAccount? */
 288       if (!$this->is_account && $this->parent === NULL ){
 289         $display= "<img alt=\"\" src=\"images/small-error.png\" align=\"middle\">&nbsp;<b>".
 290           msgPool::noValidExtension(_("POSIX"))."</b>";
 291         $display.= back_to_main();
 292         return ($display);
 293       }
 294
 295
 296       /* Show tab dialog headers */
 297       if ($this->parent !== NULL){
 298         if ($this->is_account){
 299           if (isset($this->parent->by_object['sambaAccount'])){
 300             $obj= $this->parent->by_object['sambaAccount'];
 301           }
 302           if (isset($obj) && $obj->is_account == TRUE &&
 303               ((isset($this->parent->by_object['sambaAccount']))&&($this->parent->by_object['sambaAccount']->is_account))
 304               ||(isset($this->parent->by_object['environment'] ))&&($this->parent->by_object['environment'] ->is_account)){
 305
 306             /* Samba3 dependency on posix accounts are enabled
 307                in the moment, because I need to rely on unique
 308                uidNumbers. There'll be a better solution later
 309                on. */
 310             $display= $this->show_disable_header(msgPool::removeFeaturesButton(_("POSIX")), msgPool::featuresEnabled(_("POSIX"), array(_("Samba"), _("Environment"))), TRUE);
 311           } else {
 312             $display= $this->show_disable_header(msgPool::removeFeaturesButton(_("POSIX")), msgPool::featuresEnabled(_("POSIX")));
 313           }
 314         } else {
 315           $display= $this->show_enable_header(msgPool::addFeaturesButton(_("POSIX")), msgPool::featuresDisabled(_("POSIX")));
 316           return($display);
 317         }
 318       }
 319     }
 320
 321     // Display dialog to allow selection of groups
 322     if (isset($_POST['edit_groupmembership'])){
 323       $this->groupSelect = new groupSelect($this->config,get_userinfo());
 324       $this->dialog= TRUE;
 325     }
 326
 327     // Allow to select trusted machines from a list
 328     if (isset($_POST["add_ws"])){
 329       $this->trustSelect= new trustSelect($this->config,get_userinfo());
 330       $this->dialog= TRUE;
 331     }
 332
 333     // Cancel trust and group dialog
 334     if (isset($_POST['add_groups_cancel']) || isset($_POST['add_ws_cancel'])){
 335       $this->groupSelect= NULL;
 336       $this->trustSelect= NULL;
 337       $this->dialog= FALSE;
 338     }
 339
 340     // Add groups selected in groupSelect dialog to ours.
 341     if (isset($_POST['add_groups_finish']) && $this->groupSelect){
 342       $groups = $this->groupSelect->detectPostActions();
 343       if(isset($groups['targets'])){
 344         $this->addGroup ($groups['targets']);
 345         $this->is_modified= TRUE;
 346       }
 347       $this->groupSelect= NULL;
 348       $this->dialog= FALSE;
 349     }
 350
 351     // Remove groups from currently selected groups.
 352     if (isset($_POST['delete_groupmembership']) &&
 353         isset($_POST['group_list']) && count($_POST['group_list'])){
 354
 355       $this->delGroup ($_POST['group_list']);
 356     }
 357
 358     // Add selected machines to trusted ones.
 359     if (isset($_POST["add_ws_finish"]) &&  $this->trustSelect){
 360       $trusts = $this->trustSelect->detectPostActions();
 361       if(isset($trusts['targets'])){
 362
 363         $headpage = $this->trustSelect->getHeadpage();
 364         foreach($trusts['targets'] as $id){
 365           $attrs = $headpage->getEntry($id);
 366           $this->accessTo[$attrs['cn'][0]]= $attrs['cn'][0];
 367         }
 368         ksort($this->accessTo);
 369         $this->is_modified= TRUE;
 370       }
 371       $this->trustSelect= NULL;
 372       $this->dialog= FALSE;
 373     }
 374
 375     // Remove machine from trusted ones.
 376     if (isset($_POST["delete_ws"]) && isset($_POST['workstation_list'])){
 377       foreach($_POST['workstation_list'] as $name){
 378         unset ($this->accessTo[$name]);
 379       }
 380       $this->is_modified= TRUE;
 381     }
 382
 383
 384
 385     /* Templates now! */
 386     $smarty= get_smarty();
 387     $smarty->assign("usePrototype", "true");
 388
 389     /* Show ws dialog */
 390     if ($this->trustSelect){
 391
 392       // Build up blocklist
 393       session::set('filterBlacklist', array('cn' => array_values($this->accessTo)));
 394       return($this->trustSelect->execute());
 395     }
 396
 397     /* Manage group add dialog */
 398     if ($this->groupSelect){
 399
 400       // Build up blocklist
 401       session::set('filterBlacklist', array('dn' => array_keys($this->groupMembership)));
 402       return($this->groupSelect->execute());
 403     }
 404
 405     // Handle ssh dialog?
 406     if ($this->ssh instanceOf sshPublicKey && preg_match('/[rw]/', $this->getacl("sshPublicKey"))) {
 407       $smarty->assign("usePrototype", "false");
 408       if ($result= $this->ssh->execute()) {
 409         $this->dialog= true;
 410         pathNavigator::registerPlugin("SSH keys");
 411         return $result;
 412       }
 413       $this->dialog= false;
 414     }
 415
 416
 417     /* Show main page */
 418     $smarty= get_smarty();
 419     $smarty->assign("usePrototype", "true");
 420
 421     $smarty->assign("sshPublicKeyACL", $this->getacl("sshPublicKey"));
 422
 423     /* Depending on pwmode, currently hardcoded because there are no other methods */
 424     if ( 1 == 1 ){
 425       $smarty->assign("pwmode", dirname(__FILE__)."/posix_shadow");
 426
 427       $shadowMinACL     =  $this->getacl("shadowMin");
 428       $smarty->assign("shadowmins", sprintf(_("Password can't be changed up to %s days after last change"),
 429             "<input type='text' name=\"shadowMin\" size=3 maxlength=4 value=\"".$this->shadowMin."\">"));
 430
 431       $shadowMaxACL     =  $this->getacl("shadowMax");
 432       $smarty->assign("shadowmaxs", sprintf(_("Password must be changed after %s days"),
 433             "<input type='text' name=\"shadowMax\" size=3 maxlength=4 value=\"".$this->shadowMax."\">"));
 434
 435       $shadowInactiveACL=  $this->getacl("shadowInactive");
 436       $smarty->assign("shadowinactives", sprintf(_("Disable account after %s days of inactivity after password expiry"),
 437             "<input type='text' name=\"shadowInactive\" size=3 maxlength=4 value=\"".$this->shadowInactive."\">"));
 438
 439       $shadowWarningACL =  $this->getacl("shadowWarning");
 440       $smarty->assign("shadowwarnings", sprintf(_("Warn user %s days before password expiry"),
 441             "<input type='text' name=\"shadowWarning\" size=3 maxlength=4 value=\"".$this->shadowWarning."\">"));
 442
 443       foreach( array("activate_shadowMin", "activate_shadowMax",
 444             "activate_shadowExpire", "activate_shadowInactive","activate_shadowWarning") as $val){
 445         if ($this->$val == 1){
 446           $smarty->assign("$val", "checked");
 447         } else {
 448           $smarty->assign("$val", "");
 449         }
 450         $smarty->assign("$val"."ACL", $this->getacl(preg_replace("/^.*_/","",$val)));
 451       }
 452
 453       $smarty->assign("mustchangepasswordACL", $this->getacl("mustchangepassword"));
 454     }
 455
 456     // Set last system login
 457     $smarty->assign("gotoLastSystemLogin",$this->gotoLastSystemLogin);
 458
 459     /* Fill arrays */
 460     $smarty->assign("shells", $this->loginShellList);
 461     $smarty->assign("secondaryGroups", $this->secondaryGroups);
 462     $smarty->assign("primaryGroup", $this->primaryGroup);
 463     if(!$this->multiple_support_active){
 464       if (!count($this->groupMembership)){
 465         $smarty->assign("groupMembership", array("&nbsp;"));
 466       } else {
 467         $smarty->assign("groupMembership", $this->groupMembership);
 468       }
 469     }else{
 470       $smarty->assign("groupMembership", $this->groupMembership);
 471       $smarty->assign("groupMembership_some", $this->groupMembership_some);
 472     }
 473     if (count($this->groupMembership) > 16){
 474       $smarty->assign("groups", "too_many_for_nfs");
 475     } else {
 476       $smarty->assign("groups", "");
 477     }
 478
 479     /* Avoid "Undefined index: forceMode" */
 480     $smarty->assign("forceMode", "");
 481
 482     /* Checkboxes */
 483     if ($this->force_ids == 1){
 484       $smarty->assign("force_ids", "checked");
 485       if (session::get('js')){
 486         $smarty->assign("forceMode", "");
 487       }
 488     } else {
 489       if (session::get('js')){
 490         $smarty->assign("forceMode", "disabled");
 491       }
 492       $smarty->assign("force_ids", "");
 493     }
 494
 495     /* Create onClick="" action string for the "Force UID/GID" option
 496      */
 497     $onClickIDS ="";
 498     if(preg_match("/w/",$this->getacl("uidNumber"))){
 499       $onClickIDS .= "changeState('uidNumber');";
 500     }
 501     if(preg_match("/w/",$this->getacl("gidNumber"))){
 502       $onClickIDS .= "changeState('gidNumber');";
 503     }
 504     $smarty->assign("onClickIDS", $onClickIDS);
 505     $smarty->assign("force_idsACL", $this->getacl("uidNumber").$this->getacl("gidNumber"));
 506
 507     foreach(array("primaryGroup","trustmode","activate_shadowWarning","activate_shadowInactive","activate_shadowMin","activate_shadowMax","activate_shadowExpire","mustchangepassword") as $val){
 508       if(in_array($val,$this->multi_boxes)){
 509         $smarty->assign("use_".$val,TRUE);
 510       }else{
 511         $smarty->assign("use_".$val,FALSE);
 512       }
 513     }
 514
 515
 516     /* Load attributes and acl's */
 517     foreach($this->attributes as $val){
 518       if(in_array($val,$this->multi_boxes)){
 519         $smarty->assign("use_".$val,TRUE);
 520       }else{
 521         $smarty->assign("use_".$val,FALSE);
 522       }
 523       $smarty->assign("$val", $this->$val);
 524     }
 525
 526     $tmp = $this->plInfo();
 527     foreach($tmp['plProvidedAcls'] as $val => $desc){
 528       $smarty->assign("$val"."ACL", $this->getacl($val));
 529     }
 530
 531     if($this->read_only){
 532       $smarty->assign("groupMembershipACL","r");
 533     }else{
 534       $smarty->assign("groupMembershipACL","rw");
 535     }
 536     $smarty->assign("status", $this->status);
 537
 538     /* Work on trust modes */
 539     $smarty->assign("trusthide", " disabled ");
 540     $smarty->assign("trustmodeACL",  $this->getacl("accessTo"));
 541     if ($this->trustModel == "fullaccess"){
 542       $trustmode= 1;
 543       // pervent double disable tag in html code, this will disturb our clean w3c html
 544       $smarty->assign("trustmode",  $this->getacl("accessTo"));
 545
 546     } elseif ($this->trustModel == "byhost"){
 547       $trustmode= 2;
 548       $smarty->assign("trusthide", "");
 549     } else {
 550       // pervent double disable tag in html code, this will disturb our clean w3c html
 551       $smarty->assign("trustmode",  $this->getacl("accessTo"));
 552       $trustmode= 0;
 553     }
 554     $smarty->assign("trustmode", $trustmode);
 555     $smarty->assign("trustmodes", array( 0 => _("disabled"), 1 => _("full access"),
 556           2 => _("allow access to these hosts")));
 557
 558
 559
 560     if((count($this->accessTo))==0)
 561       $smarty->assign("emptyArrAccess",true);
 562     else
 563       $smarty->assign("emptyArrAccess",false);
 564
 565     if($this->mustchangepassword){
 566       $smarty->assign("mustchangepassword", " checked ");
 567     } else {
 568       $smarty->assign("mustchangepassword", "");
 569     }
 570
 571     $smarty->assign("workstations", $this->accessTo);
 572
 573     // Add SSH button if available
 574     $smarty->assign("sshPublicKey", $this->ssh?1:0);
 575
 576     $smarty->assign("apply", apply_filter());
 577     $smarty->assign("multiple_support" , $this->multiple_support_active);
 578     $display.= $smarty->fetch (get_template_path('generic.tpl', TRUE, dirname(__FILE__)));
 579     return($display);
 580   }
 581
 582
 583   /* remove object from parent */
 584   function remove_from_parent()
 585   {
 586     /* Cancel if there's nothing to do here */
 587     if ((!$this->initially_was_account) || (!$this->acl_is_removeable())){
 588       return;
 589     }
 590
 591
 592     /* Remove and write to LDAP */
 593     plugin::remove_from_parent();
 594
 595     /* Zero out array */
 596     $this->attrs['gosaHostACL']= array();
 597
 598     /* Keep uid, because we need it for authentification! */
 599     unset($this->attrs['uid']);
 600     unset($this->attrs['trustModel']);
 601
 602     @DEBUG (DEBUG_LDAP, __LINE__, __FUNCTION__, __FILE__,
 603         /* include global link_info */
 604         $this->attributes, "Save");
 605     $ldap= $this->config->get_ldap_link();
 606     $ldap->cd($this->dn);
 607     $this->cleanup();
 608     $ldap->modify ($this->attrs);
 609
 610     new log("remove","users/".get_class($this),$this->dn,array_keys($this->attrs),$ldap->get_error());
 611
 612     if (!$ldap->success()){
 613       msg_dialog::display(_("LDAP error"), msgPool::ldaperror($ldap->get_error(), $this->dn, LDAP_DEL, get_class()));
 614     }
 615
 616     /* Delete group only if cn is uid and there are no other
 617        members inside */
 618     $ldap->cd ($this->config->current['BASE']);
 619     $ldap->search ("(&(objectClass=posixGroup)(gidNumber=".$this->gidNumber."))", array("cn", "memberUid"));
 620     if ($ldap->count() != 0){
 621       $attrs= $ldap->fetch();
 622       if ($attrs['cn'][0] == $this->uid &&
 623           !isset($this->attrs['memberUid'])){
 624
 625         $ldap->rmDir($ldap->getDN());
 626       }
 627     }
 628
 629     /* Optionally execute a command after we're done */
 630     $this->handle_post_events("remove",array("uid" => $this->uid));
 631   }
 632
 633
 634   function save_object()
 635   {
 636     if (isset($_POST['posixTab'])){
 637       /* Save values to object */
 638       plugin::save_object();
 639
 640
 641       /* Save force GID checkbox */
 642       if($this->acl_is_writeable("gidNumber") || $this->acl_is_writeable("uidNumber")){
 643         if (isset ($_POST['force_ids'])){
 644           $data= 1;
 645         } else {
 646           $data= 0;
 647         }
 648         if ($this->force_ids != $data){
 649           $this->is_modified= TRUE;
 650         }
 651         $this->force_ids= $data;
 652       }
 653
 654       /*Save primary group settings */
 655       if($this->acl_is_writeable("primaryGroup") && isset($_POST['primaryGroup'])){
 656         $data= $_POST['primaryGroup'];
 657         if ($this->primaryGroup != $data){
 658           $this->is_modified= TRUE;
 659         }
 660         $this->primaryGroup= $_POST['primaryGroup'];
 661       }
 662
 663       /* Get seelcted shadow checkboxes */
 664       foreach(array("shadowMin","shadowMax","shadowExpire","shadowInactive","shadowWarning") as $var) {
 665         if($this->acl_is_writeable($var)){
 666           $activate_var = "activate_".$var;
 667           if(isset($_POST['activate_'.$var])){
 668             $this->$activate_var  = true;
 669             $this->$var      = $_POST[$var];
 670           }else{
 671             $this->$activate_var  = false;
 672             if ($var != "shadowExpire") {
 673               $this->$var      = 0;
 674             }
 675           }
 676         }
 677       }
 678
 679       /* Force change password ? */
 680       if(isset($_POST['mustchangepassword'])){
 681         $this->mustchangepassword = TRUE;
 682       }else{
 683         $this->mustchangepassword = FALSE;
 684       }
 685
 686       /* Trust mode - special handling */
 687       if($this->acl_is_writeable("accessTo")){
 688         if (isset($_POST['trustmode'])){
 689           $saved= $this->trustModel;
 690           if ($_POST['trustmode'] == "1"){
 691             $this->trustModel= "fullaccess";
 692           } elseif ($_POST['trustmode'] == "2"){
 693             $this->trustModel= "byhost";
 694           } else {
 695             $this->trustModel= "";
 696           }
 697           if ($this->trustModel != $saved){
 698             $this->is_modified= TRUE;
 699           }
 700         }
 701       }
 702     }
 703
 704     /* Get regex from alphabet */
 705     if(isset($_GET['search'])){
 706       $this->GroupRegex = $_GET['search']."*";
 707     }
 708
 709     /* Check checkboxes and regexes */
 710     if(isset($_POST["PosixGroupDialogPosted"])){
 711
 712       if(isset($_POST['SubSearch']) && ($_POST['SubSearch'])){
 713         $this->SubSearch = true;
 714       }else{
 715         $this->SubSearch = false;
 716       }
 717       if(isset($_POST['guser'])){
 718         $this->GroupUserRegex = $_POST['guser'];
 719       }
 720       if(isset($_POST['regex'])){
 721         $this->GroupRegex = $_POST['regex'];
 722       }
 723     }
 724     $this->GroupRegex = preg_replace("/\*\**/","*",$this->GroupRegex);
 725     $this->GroupUserRegex = preg_replace("/\*\**/","*",$this->GroupUserRegex);
 726   }
 727
 728
 729   /* Save data to LDAP, depending on is_account we save or delete */
 730   function save()
 731   {
 732
 733     /* Adapt shadow values */
 734     if (!$this->activate_shadowExpire){
 735       $this->shadowExpire= "0";
 736     } else {
 737       /* Transform date to days since the beginning */
 738       list($day, $month, $year)= explode('.', $this->shadowExpire, 3);
 739       $this->shadowExpire= (int)(mktime(0, 0, 0, $month, $day, $year)/ (60 * 60 * 24)) ;
 740     }
 741     if (!$this->activate_shadowMax){
 742       $this->shadowMax= "0";
 743     }
 744     if ($this->mustchangepassword){
 745       $this->shadowLastChange= (int)(date("U") / 86400) - $this->shadowMax - 1;
 746     } else {
 747       $this->shadowLastChange= (int)(date("U") / 86400);
 748     }
 749     if (!$this->activate_shadowWarning){
 750       $this->shadowWarning= "0";
 751     }
 752
 753     /* Check what to do with ID's
 754        Nothing forced, so we may have to generate our own IDs, if not done already.
 755      */
 756     if ($this->force_ids == 0){
 757
 758       /* Handle uidNumber.
 759        * - use existing number if possible
 760        * - if not, try to create a new uniqe one.
 761        * */
 762       if ($this->savedUidNumber != ""){
 763         $this->uidNumber= $this->savedUidNumber;
 764       } else {
 765
 766         /* Calculate new id's. We need to place a lock before calling get_next_id
 767            to get real unique values.
 768          */
 769         $wait= 10;
 770         while (get_lock("uidnumber") != ""){
 771           sleep (1);
 772
 773           /* Oups - timed out */
 774           if ($wait-- == 0){
 775             msg_dialog::display(_("Warning"), _("Timeout while waiting for lock. Ignoring lock!"), WARNING_DIALOG);
 776             break;
 777           }
 778         }
 779         add_lock ("uidnumber", "gosa");
 780         $this->uidNumber= get_next_id("uidNumber", $this->dn);
 781       }
 782     }
 783
 784
 785     /* Handle gidNumber
 786      * - If we do not have a primary group selected (automatic), we will check if there
 787      *    is already a group  with the same name and use this as primary.
 788      * - .. if we couldn't find a group with the same name, we will create a new one,
 789      *    using the users uid as cn and a generated uniqe gidNumber.
 790      * */
 791     if ($this->primaryGroup == 0 || $this->force_ids){
 792
 793       /* Search for existing group */
 794       $ldap = $this->config->get_ldap_link();
 795       $ldap->cd($this->config->current['BASE']);
 796
 797       /* Are we forced to use a special gidNumber? */
 798       if($this->force_ids){
 799         $ldap->search("(&(objectClass=posixGroup)(gidNumber=".$this->gidNumber."))", array("cn","gidNumber"));
 800       }else{
 801         $ldap->search("(&(objectClass=posixGroup)(gidNumber=*)(cn=".$this->uid."))", array("cn","gidNumber"));
 802       }
 803
 804       /* No primary group found, create a new one */
 805       if ($ldap->count() == 0){
 806
 807         $groupcn = $this->uid;
 808         $pri_attr = $this->config->get_cfg_value("accountPrimaryAttribute");
 809         $groupdn= preg_replace ('/^'.preg_quote($pri_attr,'/').'=[^,]+,'.preg_quote(get_people_ou(),'/').'/i',
 810             'cn='.$groupcn.','.get_groups_ou(), $this->dn);
 811
 812         /* Request a new and uniqe gidNumber, if required */
 813         if(!$this->force_ids){
 814           $this->gidNumber= get_next_id("gidNumber", $this->dn);
 815         }
 816
 817         /* If forced gidNumber could not be found, then check if the given group name already exists
 818            we do not want to modify the gidNumber of an existing group.
 819          */
 820         $cnt= 0;
 821         while($ldap->dn_exists($groupdn) && ($cnt < 100)){
 822           $cnt ++;
 823           $groupcn = $this->uid."_".$cnt;
 824           $groupdn= preg_replace ('/^'.preg_quote($pri_attr,'/').'=[^,]+,'.preg_quote(get_people_ou(),'/').'/i',
 825               'cn='.$groupcn.','.get_groups_ou(), $this->dn);
 826         }
 827
 828         /* Create new primary group and enforce the new gidNumber */
 829         $g= new group($this->config, $groupdn);
 830         $g->cn= $groupcn;
 831         $g->force_gid= 1;
 832         $g->gidNumber= $this->gidNumber;
 833         $g->description= _("Group of user")." ".$this->givenName." ".$this->sn;
 834         $g->save ();
 835
 836         @DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__,
 837             sprintf("Primary group '%s' created, using gidNumber '%s'.",$groupcn,$this->gidNumber),"");
 838       }else{
 839         $attrs = $ldap->fetch();
 840         $this->gidNumber = $attrs['gidNumber'][0];
 841         @DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__,
 842             "Found and used: <i>".$attrs['dn']."</i>",
 843             sprintf("Primary group '%s' exists, gidNumber is '%s'.",$this->uid,$this->gidNumber));
 844       }
 845     }else{
 846
 847       /* Primary group was selected by user
 848        */
 849       $this->gidNumber = $this->primaryGroup;
 850       @DEBUG (DEBUG_TRACE, __LINE__, __FUNCTION__, __FILE__,
 851           sprintf("Primary group '%s' for user '%s' manually selected.",$this->gidNumber,$this->uid),"");
 852     }
 853
 854     if ($this->activate_shadowMin != "1" ) {
 855       $this->shadowMin = "";
 856     }
 857
 858     if (($this->activate_shadowMax != "1") && ($this->mustchangepassword != "1")) {
 859       $this->shadowMax = "";
 860     }
 861
 862     if ($this->activate_shadowWarning != "1" ) {
 863       $this->shadowWarning = "";
 864     }
 865
 866     if ($this->activate_shadowInactive != "1" ) {
 867       $this->shadowInactive = "";
 868     }
 869
 870     if ($this->activate_shadowExpire != "1" ) {
 871       $this->shadowExpire = "";
 872     }
 873
 874     /* Fill gecos */
 875     if (isset($this->parent) && $this->parent !== NULL){
 876       $this->gecos= rewrite($this->parent->by_object['user']->cn);
 877       if (!preg_match('/^[a-z0-9 -]+$/i', $this->gecos)){
 878         $this->gecos= "";
 879       }
 880     }
 881
 882     foreach(array("shadowMin","shadowMax","shadowWarning","shadowInactive","shadowExpire") as $attr){
 883       $this->$attr = (int) $this->$attr;
 884     }
 885     /* Call parents save to prepare $this->attrs */
 886     plugin::save();
 887
 888     /* Trust accounts */
 889     $objectclasses= array();
 890     foreach ($this->attrs['objectClass'] as $key => $class){
 891       if (preg_match('/trustAccount/i', $class)){
 892         continue;
 893       }
 894       $objectclasses[]= $this->attrs['objectClass'][$key];
 895     }
 896     $this->attrs['objectClass']= $objectclasses;
 897     if ($this->trustModel != ""){
 898       $this->attrs['objectClass'][]= "trustAccount";
 899       $this->attrs['trustModel']= $this->trustModel;
 900       $this->attrs['accessTo']= array();
 901       if ($this->trustModel == "byhost"){
 902         foreach ($this->accessTo as $host){
 903           $this->attrs['accessTo'][]= $host;
 904         }
 905       }
 906     } else {
 907       if ($this->was_trust_account){
 908         $this->attrs['accessTo']= array();
 909         $this->attrs['trustModel']= array();
 910       }
 911     }
 912
 913     /* include global link_info */
 914     $this->cleanup();
 915
 916     /* This is just a test, we have had duplicated ids
 917        in the past when copy & paste was used.
 918        Normaly this should not happen.
 919      */
 920     if(isset($this->attrs['uidNumber']) && !$this->force_ids){
 921       $used = $this->get_used_uid_numbers();
 922       if(isset($used[$this->attrs['uidNumber']]) && $used[$this->attrs['uidNumber']] != $this->dn){
 923         msg_dialog::display(_("Warning"),_("A duplicated UID number was written for this user. If this was not intended please verify all used uidNumbers!"), WARNING_DIALOG);
 924       }
 925     }
 926
 927     $ldap= $this->config->get_ldap_link();
 928     $ldap->cd($this->dn);
 929     unset($this->attrs['uid']);
 930     $ldap->modify ($this->attrs);
 931
 932     /* Log last action */
 933     if($this->initially_was_account){
 934       new log("modify","users/".get_class($this),$this->dn,array_keys($this->attrs),$ldap->get_error());
 935     }else{
 936       new log("create","users/".get_class($this),$this->dn,array_keys($this->attrs),$ldap->get_error());
 937     }
 938
 939     if (!$ldap->success()){
 940       msg_dialog::display(_("LDAP error"), msgPool::ldaperror($ldap->get_error(), $this->dn, LDAP_MOD, get_class()));
 941     }
 942
 943     /* Remove lock needed for unique id generation */
 944     del_lock ("uidnumber");
 945
 946     // Save ssh stuff if needed
 947     if ($this->ssh) {
 948       $this->ssh->setDN($this->dn);
 949       $this->ssh->save();
 950     }
 951
 952     /* Take care about groupMembership values: add to groups */
 953     foreach ($this->groupMembership as $key => $value){
 954       if (!isset($this->savedGroupMembership[$key])){
 955         $g= new grouptabs($this->config,$this->config->data['TABS']['GROUPTABS'], $key,"groups");
 956         $g->set_acl_base($key);
 957         $g->by_object['group']->addUser($this->uid);
 958         $g->save();
 959       }
 960     }
 961
 962     /* Remove groups not listed in groupMembership */
 963     foreach ($this->savedGroupMembership as $key => $value){
 964       if (!isset($this->groupMembership[$key])){
 965         $g= new grouptabs($this->config,$this->config->data['TABS']['GROUPTABS'], $key,"groups");
 966         $g->set_acl_base($key);
 967         $g->by_object['group']->removeUser ($this->uid);
 968         $g->save();
 969       }
 970     }
 971
 972     /* Optionally execute a command after we're done */
 973     if ($this->initially_was_account == $this->is_account){
 974       if ($this->is_modified){
 975         $this->handle_post_events("modify",array("uid" => $this->uid));
 976       }
 977     } else {
 978       $this->handle_post_events("add" ,array("uid"=> $this->uid));
 979     }
 980   }
 981
 982
 983   /* Check formular input */
 984   function check()
 985   {
 986     /* Include global link_info */
 987     $ldap= $this->config->get_ldap_link();
 988
 989     /* Append groups as memberGroup: to check hook
 990      */
 991     $tmp_attributes  = $this->attributes;
 992     $this->attributes[] = "memberGroup";
 993     $this->memberGroup = array();
 994     foreach($this->groupMembership as $dn => $name){
 995       $this->memberGroup[] = $name;
 996     }
 997
 998     /* Call common method to give check the hook */
 999     $message= plugin::check();
1000     $this->attributes = $tmp_attributes;
1001
1002     /* must: homeDirectory */
1003     if ($this->homeDirectory == ""){
1004       $message[]= msgPool::required(_("Home directory"));
1005     }
1006     if (!tests::is_path($this->homeDirectory)){
1007       $message[]= msgPool::invalid(_("Home directory"), "", "", "/home/yourname" );
1008     }
1009
1010     /* Check ID's if they are forced by user */
1011     if ($this->force_ids == "1"){
1012
1013       /* Valid uid/gid? */
1014       if (!tests::is_id($this->uidNumber)){
1015         $message[]= msgPool::invalid(_("UID"), $this->uidNumber, "/[0-9]/");
1016       } else {
1017         if ($this->uidNumber < $this->config->get_cfg_value("minId")){
1018           $message[]= msgPool::toosmall(_("UID"), $this->config->get_cfg_value("minId"));
1019         }
1020       }
1021       if (!tests::is_id($this->gidNumber)){
1022         $message[]= msgPool::invalid(_("GID"), $this->gidNumber, "/[0-9]/");
1023       } else {
1024         if ($this->gidNumber < $this->config->get_cfg_value("minId")){
1025           $message[]= msgPool::toosmall(_("GID"), $this->config->get_cfg_value("minId"));
1026         }
1027       }
1028     }
1029
1030     /* Check dates */
1031     if ($this->activate_shadowExpire && ($this->shadowExpire == "" || !tests::is_date($this->shadowExpire))){
1032       $message[]= msgPool::invalid("shadowExpire", $this->shadowExpire);
1033     }
1034
1035     /* Check shadow settings, well I like spaghetties... */
1036     if ($this->activate_shadowMin){
1037       if (!tests::is_id($this->shadowMin)){
1038         $message[]= msgPool::invalid(_("shadowMin"), $this->shadowMin, "/[0-9]/");
1039       }
1040     }
1041     if ($this->activate_shadowMax){
1042       if (!tests::is_id($this->shadowMax)){
1043         $message[]= msgPool::invalid(_("shadowMax"), $this->shadowMax, "/[0-9]/");
1044       }
1045     }
1046     if ($this->activate_shadowWarning){
1047       if (!tests::is_id($this->shadowWarning)){
1048         $message[]= msgPool::invalid(_("shadowWarning"), $this->shadowWarning, "/[0-9]/");
1049       }
1050       if (!$this->activate_shadowMax){
1051         $message[]= msgPool::depends("shadowWarning", "shadowMax");
1052       }
1053       if ($this->shadowWarning > $this->shadowMax){
1054         $message[]= msgPool::toobig("shadowWarning", "shadowMax");
1055       }
1056       if ($this->activate_shadowMin && $this->shadowWarning < $this->shadowMin){
1057         $message[]= msgPool::toosmall("shadowWarning", "shadowMin");
1058       }
1059     }
1060     if ($this->activate_shadowInactive){
1061       if (!tests::is_id($this->shadowInactive)){
1062         $message[]= msgPool::invalid(_("shadowInactive"), $this->shadowInactive, "/[0-9]/");
1063       }
1064       if (!$this->activate_shadowMax){
1065         $message[]= msgPool::depends("shadowInactive", "shadowMax");
1066       }
1067     }
1068     if ($this->activate_shadowMin && $this->activate_shadowMax){
1069       if ($this->shadowMin > $this->shadowMax){
1070         $message[]= msgPool::toobig("shadowMin", "shadowMax");
1071       }
1072     }
1073
1074     return ($message);
1075   }
1076
1077
1078   function multiple_check()
1079   {
1080     $message = plugin::multiple_check();
1081     if ($this->homeDirectory == "" && in_array("homeDirectory",$this->multi_boxes)){
1082       $message[]= msgPool::required(_("Home directory"));
1083     }
1084     if (!tests::is_path($this->homeDirectory) && in_array("homeDirectory",$this->multi_boxes)){
1085       $message[]= msgPool::invalid(_("Home directory"), "", "", "/home/yourname" );
1086     }
1087
1088     /* Check shadow settings, well I like spaghetties... */
1089     if ($this->activate_shadowMin && in_array("activate_shadowMin",$this->multi_boxes)){
1090       if (!tests::is_id($this->shadowMin)){
1091         $message[]= msgPool::invalid(_("shadowMin"), $this->shadowMin, "/[0-9]/");
1092       }
1093     }
1094     if ($this->activate_shadowMax && in_array("activate_shadowMax",$this->multi_boxes)){
1095       if (!tests::is_id($this->shadowMax)){
1096         $message[]= msgPool::invalid(_("shadowMax"), $this->shadowMax, "/[0-9]/");
1097       }
1098     }
1099     if ($this->activate_shadowWarning && in_array("activate_shadowWarning",$this->multi_boxes)){
1100       if (!tests::is_id($this->shadowWarning)){
1101         $message[]= msgPool::invalid(_("shadowWarning"), $this->shadowWarning, "/[0-9]/");
1102       }
1103       if (!$this->activate_shadowMax && in_array("activate_shadowMax",$this->multi_boxes)){
1104         $message[]= msgPool::depends("shadowWarning", "shadowMax");
1105       }
1106       if ($this->shadowWarning > $this->shadowMax && in_array("activate_shadowWarning",$this->multi_boxes)){
1107         $message[]= msgPool::toobig("shadowWarning", "shadowMax");
1108       }
1109       if ($this->activate_shadowMin && $this->shadowWarning < $this->shadowMin && in_array("activate_shadowMin",$this->multi_boxes)){
1110         $message[]= msgPool::tosmall("shadowWarning", "shadowMin");
1111       }
1112     }
1113     if ($this->activate_shadowInactive && in_array("activate_shadowInactive",$this->multi_boxes)){
1114       if (!tests::is_id($this->shadowInactive)){
1115         $message[]= msgPool::invalid(_("shadowInactive"), $this->shadowInactive, "/[0-9]/");
1116       }
1117       if (!$this->activate_shadowMax && in_array("activate_shadowMax",$this->multi_boxes)){
1118         $message[]= msgPool::depends("shadowInactive", "shadowMax");
1119       }
1120     }
1121     if ($this->activate_shadowMin && $this->activate_shadowMax && in_array("activate_shadowMin",$this->multi_boxes)){
1122       if ($this->shadowMin > $this->shadowMax){
1123         $message[]= msgPool::toobig("shadowMin", "shadowMax");
1124       }
1125     }
1126
1127     return($message);
1128   }
1129
1130
1131   function addGroup ($groups)
1132   {
1133     /* include global link_info */
1134     $ldap= $this->config->get_ldap_link();
1135
1136     /* Walk through groups and add the descriptive entry if not exists */
1137     foreach ($groups as $value){
1138
1139       if (!array_key_exists($value, $this->groupMembership)){
1140         $ldap->cat($value, array('cn', 'description', 'dn'));
1141         $attrs= $ldap->fetch();
1142         error_reporting (0);
1143         if (!isset($attrs['description'][0])){
1144           $entry= $attrs["cn"][0];
1145         } else {
1146           $dsc= preg_replace ('/^Group of user/', _("Group of user"), $attrs["description"][0]);
1147           $entry= $attrs["cn"][0]." [$dsc]";
1148         }
1149         error_reporting (E_ALL | E_STRICT);
1150
1151         if(obj_is_writable($attrs['dn'],"groups/group","memberUid")){
1152           $this->groupMembership[$attrs['dn']]= $entry;
1153           if($this->multiple_support_active && isset($this->groupMembership_some[$attrs['dn']])){
1154             unset($this->groupMembership_some[$attrs['dn']]);
1155           }
1156         }
1157       }
1158     }
1159
1160     /* Sort groups */
1161     asort ($this->groupMembership);
1162     reset ($this->groupMembership);
1163   }
1164
1165
1166   /* Del posix user from some groups */
1167   function delGroup ($groups)
1168   {
1169     $dest= array();
1170     foreach($groups as $dn_to_del){
1171       if(isset($this->groupMembership[$dn_to_del]) && obj_is_writable($dn_to_del,"groups/group","memberUid")){
1172         unset($this->groupMembership[$dn_to_del]);
1173       }
1174       if($this->multiple_support_active){
1175         if(isset($this->groupMembership_some[$dn_to_del]) && obj_is_writable($dn_to_del,"groups/group","memberUid")){
1176           unset($this->groupMembership_some[$dn_to_del]);
1177         }
1178       }
1179     }
1180   }
1181
1182
1183   /* Adapt from template, using 'dn' */
1184   function adapt_from_template($dn, $skip= array())
1185   {
1186     /* Include global link_info */
1187     $ldap= $this->config->get_ldap_link();
1188
1189     plugin::adapt_from_template($dn, $skip);
1190     $template= $this->attrs['uid'][0];
1191
1192     /* Adapt group membership */
1193     $ldap->cd($this->config->current['BASE']);
1194     $ldap->search("(&(objectClass=posixGroup)(memberUid=".$this->attrs["uid"][0]."))", array("description", "cn"));
1195
1196     while ($this->attrs= $ldap->fetch()){
1197       if (!isset($this->attrs["description"][0])){
1198         $entry= $this->attrs["cn"][0];
1199       } else {
1200         $entry= $this->attrs["cn"][0]." [".$this->attrs["description"][0]."]";
1201       }
1202       $this->groupMembership[$ldap->getDN()]= $entry;
1203     }
1204
1205     /* Fix primary group settings */
1206     $ldap->cd($this->config->current['BASE']);
1207     $ldap->search("(&(objectClass=posixGroup)(cn=$template)(gidNumber=".$this->gidNumber."))", array("cn"));
1208     if ($ldap->count() != 1){
1209       $this->primaryGroup= $this->gidNumber;
1210     }
1211
1212     $ldap->cd($this->config->current['BASE']);
1213     $ldap->search("(&(objectClass=gosaUserTemplate)(uid=".$template.")(accessTo=*))", array("cn","accessTo"));
1214     while($attr = $ldap->fetch()){
1215       $tmp = $attr['accessTo'];
1216       unset ($tmp['count']);
1217       $this->accessTo = $tmp;
1218     }
1219
1220     /* Adjust shadow checkboxes */
1221     foreach (array("shadowMin", "shadowMax", "shadowWarning", "shadowInactive") as $val){
1222       if ($this->$val != 0){
1223         $oval= "activate_".$val;
1224         $this->$oval= "1";
1225       }
1226     }
1227
1228     /* FIXME: NEED review of this section */
1229     /* Need to check shadowExpire separately */
1230
1231     /*
1232      * If shadowExpire is not enabled in the template, it's a UNIX timestamp - so don't convert it to seconds.
1233      * The check is a hack - if difference between timestamp generated above and here is max 1 day.
1234      */
1235     if(abs($this->shadowExpire - time())>86400) {
1236       $this->shadowExpire= $this->convertToSeconds($this->shadowExpire);
1237     }
1238
1239     /* Only enable checkbox, if shadowExpire is in the future */
1240     if($this->shadowExpire > time()) {
1241       $this->activate_shadowExpire= "1";
1242     }
1243   }
1244
1245   function convertToSeconds($val)
1246   {
1247     if ($val != 0){
1248       $val*= 60 * 60 * 24;
1249     } else {
1250       $date= getdate();
1251       $val= floor($date[0] / (60*60*24)) * 60 * 60 * 24;
1252     }
1253     return($val);
1254   }
1255
1256
1257   function get_used_uid_numbers()
1258   {
1259     $ids= array();
1260     $ldap= $this->config->get_ldap_link();
1261
1262     $ldap->cd ($this->config->current['BASE']);
1263     $ldap->search ("(&(objectClass=posixAccount)(uidNumber=*))", array("uidNumber"));
1264
1265     /* Get list of ids */
1266     while ($attrs= $ldap->fetch()){
1267       $ids[$attrs['uidNumber'][0]] = $attrs['dn'];
1268     }
1269     return($ids);
1270   }
1271
1272
1273   /* Get posts from copy & paste dialog */
1274   function saveCopyDialog()
1275   {
1276     if(isset($_POST['homeDirectory'])){
1277       $this->homeDirectory = $_POST['homeDirectory'];
1278       if (isset ($_POST['force_ids'])){
1279         $data= 1;
1280         $this->gidNumber = $_POST['gidNumber'];
1281         $this->uidNumber = $_POST['uidNumber'];
1282       } else {
1283         $data= 0;
1284       }
1285       if ($this->force_ids != $data){
1286         $this->is_modified= TRUE;
1287       }
1288       $this->force_ids= $data;
1289       $data= $_POST['primaryGroup'];
1290       if ($this->primaryGroup != $data){
1291         $this->is_modified= TRUE;
1292       }
1293       $this->primaryGroup= $_POST['primaryGroup'];
1294     }
1295   }
1296
1297
1298   /* Create the posix dialog part for copy & paste */
1299   function getCopyDialog()
1300   {
1301     /* Skip dialog creation if this is not a valid account*/
1302     if(!$this->is_account) return("");
1303     if ($this->force_ids == 1){
1304       $force_ids = "checked";
1305       if (session::get('js')){
1306         $forceMode = "";
1307       }
1308     } else {
1309       if (session::get('js')){
1310         if($this->acl != "#none#")
1311           $forceMode ="disabled";
1312       }
1313       $force_ids = "";
1314     }
1315
1316     $sta = "";
1317
1318     /* Open group add dialog */
1319     if(isset($_POST['edit_groupmembership'])){
1320       $this->groupSelect = new groupSelect($this->config,get_userinfo());
1321       $sta = "SubDialog";
1322     }
1323
1324     /* If the group-add dialog is closed, call execute
1325        to ensure that the membership is updatd */
1326     if(isset($_POST['add_groups_finish']) || isset($_POST['add_groups_cancel'])){
1327       $this->execute();
1328       $this->groupSelect =NULL;
1329     }
1330
1331     if($this->groupSelect){
1332       $str = $this->execute(true);
1333       $ret = array();
1334       $ret['string'] = $str;
1335       $ret['status'] = $sta;
1336       return($ret);
1337     }
1338
1339     /* If a group member should be deleted, simply call execute */
1340     if(isset($_POST['delete_groupmembership'])){
1341       $this->execute();
1342     }
1343
1344     /* Assigned informations to smarty */
1345     $smarty = get_smarty();
1346     $smarty->assign("homeDirectory",$this->homeDirectory);
1347     $smarty->assign("secondaryGroups",$this->secondaryGroups);
1348     $smarty->assign("primaryGroup",$this->primaryGroup);
1349
1350     $smarty->assign("uidNumber",$this->uidNumber);
1351     $smarty->assign("gidNumber",$this->gidNumber);
1352     $smarty->assign("forceMode",$forceMode);
1353     $smarty->assign("force_ids",$force_ids);
1354     if (!count($this->groupMembership)){
1355       $smarty->assign("groupMembership", array("&nbsp;"));
1356     } else {
1357       $smarty->assign("groupMembership", $this->groupMembership);
1358     }
1359
1360     /* Display wars message if there are more than 16 group members */
1361     if (count($this->groupMembership) > 16){
1362       $smarty->assign("groups", "too_many_for_nfs");
1363     } else {
1364       $smarty->assign("groups", "");
1365     }
1366     $str = $smarty->fetch(get_template_path("paste_generic.tpl",TRUE,dirname(__FILE__)));
1367
1368     $ret = array();
1369     $ret['string'] = $str;
1370     $ret['status'] = $sta;
1371     return($ret);
1372   }
1373
1374
1375   function PrepareForCopyPaste($source)
1376   {
1377     plugin::PrepareForCopyPaste($source);
1378
1379     /* Avoid using the same gid/uid number as source user
1380        empty numbers to enforce new ones. */
1381     $this->savedUidNumber = "";
1382     $this->savedGidNumber = "";
1383
1384     /* Get group membership */
1385     $ldap = $this->config->get_ldap_link();
1386     $ldap->cd($this->config->current['BASE']);
1387     $ldap->search("(&(objectClass=posixGroup)(memberUid=".$source['uid'][0]."))", array("cn", "description"));
1388
1389     while ($attrs= $ldap->fetch()){
1390       if (!isset($attrs["description"][0])){
1391         $entry= $attrs["cn"][0];
1392       } else {
1393         $entry= $attrs["cn"][0]." [".$attrs["description"][0]."]";
1394       }
1395       $this->groupMembership[$ldap->getDN()]= $entry;
1396     }
1397     asort($this->groupMembership);
1398     reset($this->groupMembership);
1399
1400     /* Fill group */
1401     if(isset($source['gidNumber'][0])){
1402       $this->primaryGroup= $source['gidNumber'][0];
1403     }
1404
1405   }
1406
1407
1408   function multiple_execute()
1409   {
1410     return($this->execute());
1411   }
1412
1413
1414   static function plInfo()
1415   {
1416     return (array(
1417           "plDescription"     => _("POSIX account"),
1418           "plSelfModify"      => TRUE,
1419           "plDepends"         => array("user"),
1420           "plPriority"        => 2,
1421           "plSection"         => array("personal" => _("My account")),
1422           "plCategory"        => array("users"),
1423           "plOptions"         => array(),
1424
1425           "plProvidedAcls"  => array(
1426
1427             "homeDirectory"       =>  _("Home directory"),
1428             "primaryGroup"        =>  _("Primary group"),
1429             "loginShell"          =>  _("Shell"),
1430             "uidNumber"           =>  _("User ID"),
1431             "gidNumber"           =>  _("Group ID"),
1432
1433             "shadowLastChange"    =>  _("Shadow last changed"),
1434             "gotoLastSystemLogin"    =>  _("Last login"),
1435
1436             "mustchangepassword"=>  _("Force password change on login"),
1437             "shadowMin"           =>  _("Shadow min"),
1438             "shadowMax"           =>  _("Shadow max"),
1439             "shadowWarning"       =>  _("Shadow warning"),
1440             "shadowInactive"      =>  _("Shadow inactive"),
1441             "shadowExpire"        =>  _("Shadow expire"),
1442             "sshPublicKey"        =>  _("Public SSH key"),
1443             "accessTo"            =>  _("System trust model")))
1444               );
1445   }
1446
1447
1448   /* Return selected values for multiple edit */
1449   function get_multi_edit_values()
1450   {
1451     $ret = plugin::get_multi_edit_values();
1452     $ret['groupMembership']     = $this->groupMembership;
1453     $ret['groupMembership_some']= $this->groupMembership_some;
1454
1455     if(in_array("primaryGroup",$this->multi_boxes)){
1456       $ret['primaryGroup'] = $this->primaryGroup;
1457     }
1458     if(in_array("trustmode",$this->multi_boxes)){
1459       $ret['trustModel'] = $this->trustModel;
1460       $ret['accessTo'] = $this->accessTo;
1461     }
1462     foreach(array("shadowWarning","shadowInactive","shadowMin","shadowMax", "shadowExpire") as $entry){
1463       $active = "activate_".$entry;
1464       if(in_array($active,$this->multi_boxes)){
1465         $ret[$entry] = $this->$entry;
1466         $ret[$active] = $this->$active;
1467       }
1468     }
1469     if(in_array("mustchangepassword",$this->multi_boxes)){
1470       $ret['mustchangepassword'] = $this->mustchangepassword;
1471     }
1472     return($ret);
1473   }
1474
1475
1476   /* Save posts for multiple edit
1477    */
1478   function multiple_save_object()
1479   {
1480     if(isset($_POST['posix_mulitple_edit'])){
1481
1482       /* Backup expire value */
1483       $expire_tmp = $this->shadowExpire;
1484
1485       /* Update all values */
1486       plugin::multiple_save_object();
1487
1488       /* Get selected checkboxes */
1489       foreach(array("primaryGroup","trustmode","mustchangepassword","activate_shadowWarning","activate_shadowInactive","activate_shadowMin", "activate_shadowMax","activate_shadowExpire") as $val){
1490         if(isset($_POST["use_".$val])){
1491           $this->multi_boxes[] = $val;
1492         }
1493       }
1494
1495       /* Update special values, checkboxes for posixShadow */
1496       foreach(array("shadowMin","shadowMax","shadowExpire","shadowInactive","shadowWarning") as $var) {
1497         if($this->acl_is_writeable($var)){
1498           $activate_var = "activate_".$var;
1499           if(in_array($activate_var, $this->multi_boxes)){
1500             if(isset($_POST['activate_'.$var])){
1501               $this->$activate_var  = true;
1502               $this->$var      = $_POST[$var];
1503             }else{
1504               $this->$activate_var  = false;
1505               $this->$var      = 0;
1506             }
1507           }
1508         }
1509       }
1510
1511       /* Restore shadow value, if the shadow attribute isn't used */
1512       if(!in_array("activate_shadowExpire",$this->multi_boxes)){
1513         $this->shadowExpire = $expire_tmp;
1514       }
1515
1516       /* Force change password ? */
1517       if(isset($_POST['mustchangepassword'])){
1518         $this->mustchangepassword = TRUE;
1519       }else{
1520         $this->mustchangepassword = FALSE;
1521       }
1522
1523       /* Trust mode - special handling */
1524       if($this->acl_is_writeable("accessTo")){
1525         if (isset($_POST['trustmode'])){
1526           $saved= $this->trustModel;
1527           if ($_POST['trustmode'] == "1"){
1528             $this->trustModel= "fullaccess";
1529           } elseif ($_POST['trustmode'] == "2"){
1530             $this->trustModel= "byhost";
1531           } else {
1532             $this->trustModel= "";
1533           }
1534           if ($this->trustModel != $saved){
1535             $this->is_modified= TRUE;
1536           }
1537         }
1538       }
1539
1540       /* Save primary group settings */
1541       if($this->acl_is_writeable("primaryGroup") && isset($_POST['primaryGroup'])){
1542         $data= $_POST['primaryGroup'];
1543         if ($this->primaryGroup != $data){
1544           $this->is_modified= TRUE;
1545         }
1546         $this->primaryGroup= $_POST['primaryGroup'];
1547       }
1548     }
1549   }
1550
1551
1552   /* Initialize plugin with given atribute arrays
1553    */
1554   function init_multiple_support($attrs,$all)
1555   {
1556     plugin::init_multiple_support($attrs,$all);
1557
1558     /* Some dummy values */
1559     $groups_some = array();
1560     $groups_all  = array();
1561     $groups_uid  = array();
1562     $uids        = array();
1563     $first       = TRUE;
1564
1565     /* Get all groups used by currently edited users */
1566     $uid_filter="";
1567     for($i =0; $i < $this->multi_attrs_all['uid']['count'] ; $i ++){
1568       $uid = $this->multi_attrs_all['uid'][$i];
1569       $uids[] = $uid;
1570       $uid_filter.= "(memberUid=".$uid.")";
1571     }
1572     $uid_filter = "(&(objectClass=posixGroup)(|".$uid_filter."))";
1573     $ldap = $this->config->get_ldap_link();
1574     $ldap->cd($this->config->current['BASE']);
1575     $ldap->search($uid_filter,array("dn","cn","memberUid"));
1576     while($group = $ldap->fetch()){
1577       $groups_some[$group['dn']] = $group['cn'][0];
1578       for($i = 0 ; $i < $group['memberUid']['count'] ; $i++){
1579         $groups_uid[$group['dn']][] = $group['memberUid'][$i];
1580       }
1581     }
1582
1583     /* Create an array, containing all used groups */
1584     $groups_all = $groups_some;
1585     foreach($groups_all as $id => $group){
1586       foreach($uids as $uid){
1587         if(!in_array($uid,$groups_uid[$id])){
1588           unset($groups_all[$id]);
1589           break;
1590         }
1591       }
1592     }
1593
1594     /* Assign group array */
1595     $this->groupMembership = $groups_all;
1596
1597     /* Create an array of all grouops used by all users */
1598     foreach( $groups_all as $dn => $cn){
1599       if(isset($groups_some[$dn])){
1600         unset($groups_some[$dn]);
1601       }
1602     }
1603     $this->groupMembership_some = $groups_some;
1604     $this->primaryGroup = $this->gidNumber;
1605
1606     /* Is this account a trustAccount? */
1607     if (isset($this->multi_attrs['trustModel'])){
1608       $this->trustModel= $this->multi_attrs['trustModel'][0];
1609       $this->was_trust_account= TRUE;
1610       $this->multi_boxes[] = "trustmode";
1611     } else {
1612       $this->was_trust_account= FALSE;
1613       $this->trustModel= "";
1614     }
1615
1616     /* Create access informations */
1617     $this->accessTo = array();
1618     if (isset($this->multi_attrs['accessTo'])){
1619       for ($i= 0; $i<$this->multi_attrs['accessTo']['count']; $i++){
1620         $tmp= $this->multi_attrs['accessTo'][$i];
1621         $this->accessTo[$tmp]= $tmp;
1622       }
1623     }
1624
1625     /* Adjust shadow checkboxes */
1626     foreach (array("shadowMin", "shadowMax", "shadowWarning", "shadowInactive",
1627           "shadowExpire") as $val){
1628       if ($this->$val != 0){
1629         $oval= "activate_".$val;
1630         $this->$oval= "1";
1631       }
1632     }
1633
1634     /* Convert to seconds */
1635     if(isset($this->multi_attrs['shadowExpire'])){
1636       $this->shadowExpire = $this->convertToSeconds($this->multi_attrs['shadowExpire'][0]);
1637     }else{
1638       $this->activate_shadowExpire = FALSE;
1639     }
1640   }
1641
1642
1643   function set_multi_edit_values($attrs)
1644   {
1645     $groups = array();
1646
1647     /* Update groupMembership, keep optinal group */
1648     foreach($attrs['groupMembership_some'] as $dn => $cn){
1649       if(isset($this->groupMembership[$dn])){
1650         $groups[$dn] = $cn;
1651       }
1652     }
1653     /* Update groupMembership, add forced groups */
1654     foreach($attrs['groupMembership'] as $dn => $cn){
1655       $groups[$dn] = $cn;
1656     }
1657     plugin::set_multi_edit_values($attrs);
1658     $this->groupMembership = $groups;
1659   }
1660 }
1661
1662 // vim:tabstop=2:expandtab:shiftwidth=2:filetype=php:syntax:ruler:
1663 ?>