db27b72e4f8a2cd48ba09c74e57423348fc6d9a7
1 <?php
2 /*!
3 \brief posixAccount plugin
4 \author Cajus Pollmeier <pollmeier@gonicus.de>
5 \version 2.00
6 \date 24.07.2003
8 This class provides the functionality to read and write all attributes
9 relevant for posixAccounts and shadowAccounts from/to the LDAP. It
10 does syntax checking and displays the formulars required.
11 */
13 class posixAccount extends plugin
14 {
15 /* Definitions */
16 var $plHeadline= "UNIX";
17 var $plDescription= "This does something";
19 /* Plugin specific values */
20 var $homeDirectory= "";
21 var $loginShell= "/bin/bash";
22 var $uidNumber= "";
23 var $gidNumber= "";
24 var $gecos= "";
25 var $shadowMin= "0";
26 var $shadowMax= "0";
27 var $shadowWarning= "0";
28 var $shadowLastChange= "0";
29 var $shadowInactive= "0";
30 var $shadowExpire= "0";
31 var $gosaDefaultPrinter= "";
32 var $gosaDefaultLanguage= "";
33 var $accessTo= array();
34 var $trustModel= "";
36 var $glist=array();
37 var $status= "";
38 var $loginShellList= array();
39 var $groupMembership= array();
40 var $savedGroupMembership= array();
41 var $savedUidNumber= "";
42 var $savedGidNumber= "";
43 var $use_shadowMin= "0";
44 var $use_shadowMax= "0";
45 var $use_shadowWarning= "0";
46 var $use_shadowInactive= "0";
47 var $use_shadowExpire= "0";
48 var $must_change_password= "0";
49 var $force_ids= 0;
50 var $group_dialog= FALSE;
51 var $show_ws_dialog= FALSE;
52 var $secondaryGroups= array();
53 var $primaryGroup= 0;
54 var $was_trust_account= FALSE;
56 var $grouplist = array();
57 var $ui = array();
59 var $GroupRegex = "*";
60 var $GroupUserRegex = "*";
61 var $SubSearch = false;
63 /* attribute list for save action */
64 var $CopyPasteVars = array("grouplist","groupMembership","use_shadowMin","use_shadowMax","use_shadowWarning","use_shadowInactive","use_shadowExpire","must_change_password","grouplist","savedGidNumber","savedUidNumber");
65 var $attributes = array("homeDirectory", "loginShell", "uidNumber", "gidNumber", "gecos",
66 "shadowMin", "shadowMax", "shadowWarning", "shadowInactive", "shadowLastChange",
67 "shadowExpire", "gosaDefaultPrinter", "gosaDefaultLanguage", "uid","accessTo","trustModel");
68 var $objectclasses= array("posixAccount", "shadowAccount");
70 var $uid ="";
72 /* constructor, if 'dn' is set, the node loads the given
73 'dn' from LDAP */
74 function posixAccount ($config, $dn= NULL, $parent= NULL)
75 {
76 /* Configuration is fine, allways */
77 $this->config= $config;
79 /* Load bases attributes */
80 plugin::plugin($config, $dn, $parent);
82 /* set user id */
83 if(isset($this->attrs['uid'])){
84 $this->uid = $this->attrs['uid'][0];
85 }
87 $ldap= $this->config->get_ldap_link();
89 if ($dn != NULL){
91 /* Correct is_account. shadowAccount is not required. */
92 if (isset($this->attrs['objectClass']) &&
93 in_array ('posixAccount', $this->attrs['objectClass'])){
95 $this->is_account= TRUE;
96 }
98 /* Is this account a trustAccount? */
99 if ($this->is_account && isset($this->attrs['trustModel'])){
100 $this->trustModel= $this->attrs['trustModel'][0];
101 $this->was_trust_account= TRUE;
102 } else {
103 $this->was_trust_account= FALSE;
104 $this->trustModel= "";
105 }
107 $this->accessTo = array();
108 if ($this->is_account && isset($this->attrs['accessTo'])){
109 for ($i= 0; $i<$this->attrs['accessTo']['count']; $i++){
110 $tmp= $this->attrs['accessTo'][$i];
111 $this->accessTo[$tmp]= $tmp;
112 }
113 }
114 $this->initially_was_account= $this->is_account;
116 /* Fill group */
117 $this->primaryGroup= $this->gidNumber;
119 /* Generate status text */
120 $current= date("U");
122 $current= floor($current / 60 /60 / 24);
124 if (($current >= $this->shadowExpire) && $this->shadowExpire){
125 $this->status= _("expired");
126 if (($current - $this->shadowExpire) < $this->shadowInactive){
127 $this->status.= ", "._("grace time active");
128 }
129 } elseif (($this->shadowLastChange + $this->shadowMin) >= $current){
130 $this->status= _("active, password not changable");
131 } elseif (($this->shadowLastChange + $this->shadowMax) >= $current){
132 $this->status= _("active, password expired");
133 } else {
134 $this->status= _("active");
135 }
137 /* Get group membership */
138 $ldap->cd($this->config->current['BASE']);
139 $ldap->search("(&(objectClass=posixGroup)(memberUid=".$this->uid."))", array("cn", "description"));
141 while ($this->attrs= $ldap->fetch()){
142 if (!isset($this->attrs["description"][0])){
143 $entry= $this->attrs["cn"][0];
144 } else {
145 $dsc= preg_replace ('/^Group of user/', _("Group of user"), $this->attrs["description"][0]);
146 $entry= $this->attrs["cn"][0]." [$dsc]";
147 }
148 $this->groupMembership[$ldap->getDN()]= $entry;
149 }
150 asort($this->groupMembership);
151 reset($this->groupMembership);
152 $this->savedGroupMembership= $this->groupMembership;
153 $this->savedUidNumber= $this->uidNumber;
154 $this->savedGidNumber= $this->gidNumber;
155 }
157 /* Adjust shadow checkboxes */
158 foreach (array("shadowMin", "shadowMax", "shadowWarning", "shadowInactive",
159 "shadowExpire") as $val){
161 if ($this->$val != 0){
162 $oval= "use_".$val;
163 $this->$oval= "1";
164 }
165 }
167 /* Convert to seconds */
168 $this->shadowExpire= $this->convertToSeconds($this->shadowExpire);
170 /* Generate shell list from CONFIG_DIR./shells */
171 if (file_exists(CONFIG_DIR.'/shells')){
172 $shells = file (CONFIG_DIR.'/shells');
173 foreach ($shells as $line){
174 if (!preg_match ("/^#/", $line)){
175 $this->loginShellList[]= trim($line);
176 }
177 }
178 } else {
179 if ($this->loginShell == ""){
180 $this->loginShellList[]= _("unconfigured");
181 }
182 }
184 /* Insert possibly missing loginShell */
185 if ($this->loginShell != "" && !in_array($this->loginShell, $this->loginShellList)){
186 $this->loginShellList[]= $this->loginShell;
187 }
189 /* Set tag attribute if we've tagging activated */
190 $filter= "(objectClass=posixGroup)";
191 $ui= get_userinfo();
192 if ($ui->gosaUnitTag != "" && isset($config->current['STRICT_UNITS']) &&
193 preg_match('/TRUE/i', $config->current['STRICT_UNITS'])){
194 $filter= "(&(objectClass=posixGroup)(gosaUnitTag=".$ui->gosaUnitTag."))";
195 }
197 /* Generate group list */
198 $ldap->cd($this->config->current['BASE']);
199 $ldap->search("$filter", array("cn", "gidNumber"));
200 $this->secondaryGroups[]= "- "._("automatic")." -";
201 while ($attrs= $ldap->fetch()){
202 $this->secondaryGroups[$attrs['gidNumber'][0]]= $attrs['cn'][0];
203 }
204 asort ($this->secondaryGroups);
206 /* Get global filter config */
207 if (!is_global("sysfilter")){
208 $ui= get_userinfo();
209 $base= get_base_from_people($ui->dn);
210 $sysfilter= array( "depselect" => $base,
211 "regex" => "*");
212 register_global("sysfilter", $sysfilter);
213 }
214 $this->ui = get_userinfo();
215 }
218 /* execute generates the html output for this node */
219 function execute($isCopyPaste = false)
220 {
221 /* Call parent execute */
222 plugin::execute();
223 $display= "";
225 /* Department has changed? */
226 if(isset($_POST['depselect'])){
227 $_SESSION['CurrentMainBase']= validate($_POST['depselect']);
228 }
230 if(!$isCopyPaste){
232 $required = (isset($this->parent->by_object['sambaAccount']) && $this->parent->by_object['sambaAccount']->is_account) ||
233 (isset($this->parent->by_object['environment'] ) && $this->parent->by_object['environment'] ->is_account);
235 /* Do we need to flip is_account state? */
236 if (isset($_POST['modify_state'])){
237 if($this->is_account && $this->acl == "#all#" && !$required ){
238 $this->is_account= !$this->is_account;
239 }elseif(!$this->is_account && chkacl($this->acl,"create") == ""){
240 $this->is_account= !$this->is_account;
241 }
242 }
244 /* Do we represent a valid posixAccount? */
245 if (!$this->is_account && $this->parent == NULL ){
246 $display= "<img alt=\"\" src=\"images/stop.png\" align=\"middle\"> <b>".
247 _("This account has no unix extensions.")."</b>";
248 $display.= back_to_main();
249 return ($display);
250 }
253 /* Show tab dialog headers */
254 if ($this->parent != NULL){
255 if ($this->is_account){
256 if (isset($this->parent->by_object['sambaAccount'])){
257 $obj= $this->parent->by_object['sambaAccount'];
258 }
259 if (isset($obj) && $obj->is_account == TRUE &&
260 ((isset($this->parent->by_object['sambaAccount']))&&($this->parent->by_object['sambaAccount']->is_account))
261 ||(isset($this->parent->by_object['environment'] ))&&($this->parent->by_object['environment'] ->is_account)){
263 /* Samba3 dependency on posix accounts are enabled
264 in the moment, because I need to rely on unique
265 uidNumbers. There'll be a better solution later
266 on. */
267 $display= $this->show_header(_("Remove posix account"),
268 _("This account has unix features enabled. To disable them, you'll need to remove the samba / environment account first."), TRUE);
269 } else {
270 $display= $this->show_header(_("Remove posix account"),
271 _("This account has posix features enabled. You can disable them by clicking below."));
272 }
273 } else {
274 $display= $this->show_header(_("Create posix account"),
275 _("This account has posix features disabled. You can enable them by clicking below."));
276 return($display);
277 }
278 }
279 }
280 /* Trigger group edit? */
281 if (isset($_POST['edit_groupmembership'])){
282 $this->group_dialog= TRUE;
283 $this->dialog= TRUE;
284 }
286 /* Cancel group edit? */
287 if (isset($_POST['add_groups_cancel']) ||
288 isset($_POST['add_groups_finish'])){
289 $this->group_dialog= FALSE;
290 $this->dialog= FALSE;
291 }
293 /* Add selected groups */
294 if (isset($_POST['add_groups_finish']) && isset($_POST['groups']) &&
295 count($_POST['groups'])){
297 if (chkacl ($this->acl, "memberUid") == ""){
298 $this->addGroup ($_POST['groups']);
299 $this->is_modified= TRUE;
300 }
301 }
303 /* Delete selected groups */
304 if (isset($_POST['delete_groupmembership']) &&
305 isset($_POST['group_list']) && count($_POST['group_list'])){
307 if (chkacl ($this->acl, "memberUid") == ""){
308 $this->delGroup ($_POST['group_list']);
309 $this->is_modified= TRUE;
310 }
311 }
313 /* Add user workstation? */
314 if (isset($_POST["add_ws"]) && chkacl($this->acl,"allowedHosts") == ""){
315 $this->show_ws_dialog= TRUE;
316 $this->dialog= TRUE;
317 }
319 /* Add user workstation? */
320 if (isset($_POST["add_ws_finish"]) && isset($_POST['wslist'])){
321 foreach($_POST['wslist'] as $ws){
322 $this->accessTo[$ws]= $ws;
323 }
324 ksort($this->accessTo);
325 $this->is_modified= TRUE;
326 }
328 /* Remove user workstations? */
329 if (isset($_POST["delete_ws"]) && isset($_POST['workstation_list']) && chkacl($this->acl,"allowedHosts") == ""){
330 foreach($_POST['workstation_list'] as $name){
331 unset ($this->accessTo[$name]);
332 }
333 $this->is_modified= TRUE;
334 }
336 /* Add user workstation finished? */
337 if (isset($_POST["add_ws_finish"]) || isset($_POST["add_ws_cancel"])){
338 $this->show_ws_dialog= FALSE;
339 $this->dialog= FALSE;
340 }
342 /* Templates now! */
343 $smarty= get_smarty();
345 /* Show ws dialog */
346 if ($this->show_ws_dialog){
347 /* Save data */
348 $sysfilter= get_global("sysfilter");
349 foreach( array("depselect", "regex") as $type){
350 if (isset($_POST[$type])){
351 $sysfilter[$type]= $_POST[$type];
352 }
353 }
354 if (isset($_GET['search'])){
355 $s= mb_substr($_GET['search'], 0, 1, "UTF8")."*";
356 if ($s == "**"){
357 $s= "*";
358 }
359 $sysfilter['regex']= $s;
360 }
361 register_global("sysfilter", $sysfilter);
363 /* Get workstation list */
364 $exclude= "";
365 foreach($this->accessTo as $ws){
366 $exclude.= "(cn=$ws)";
367 }
368 if ($exclude != ""){
369 $exclude= "(!(|$exclude))";
370 }
371 $acl= array($this->config->current['BASE'] => ":all");
372 $regex= $sysfilter['regex'];
373 $filter= "(&(|(objectClass=goServer)(objectClass=gotoWorkstation)(objectClass=gotoTerminal))$exclude(cn=*)(cn=$regex))";
374 $res= get_list($filter, $acl, $sysfilter['depselect'], array("cn"), GL_SUBSEARCH | GL_SIZELIMIT);
375 $wslist= array();
376 foreach ($res as $attrs){
377 $wslist[]= preg_replace('/\$/', '', $attrs['cn'][0]);
378 }
379 asort($wslist);
380 $smarty->assign("search_image", get_template_path('images/search.png'));
381 $smarty->assign("launchimage", get_template_path('images/small_filter.png'));
382 $smarty->assign("tree_image", get_template_path('images/tree.png'));
383 $smarty->assign("deplist", $this->config->idepartments);
384 $smarty->assign("alphabet", generate_alphabet());
385 foreach( array("depselect", "regex") as $type){
386 $smarty->assign("$type", $sysfilter[$type]);
387 }
388 $smarty->assign("hint", print_sizelimit_warning());
389 $smarty->assign("wslist", $wslist);
390 $smarty->assign("apply", apply_filter());
391 $display= $smarty->fetch (get_template_path('trust_machines.tpl', TRUE, dirname(__FILE__)));
392 return ($display);
393 }
395 /* Manage group add dialog */
396 if ($this->group_dialog){
398 /* Get global filter config */
399 $this->reload();
401 /* remove already assigned groups */
402 $glist= array();
403 foreach ($this->grouplist as $key => $value){
404 if (!isset($this->groupMembership[$key])){
405 $glist[$key]= $value;
406 }
407 }
409 if($this->SubSearch){
410 $smarty->assign("SubSearchCHK"," checked ");
411 }else{
412 $smarty->assign("SubSearchCHK","");
413 }
415 $smarty->assign("regex",$this->GroupRegex);
416 $smarty->assign("guser",$this->GroupUserRegex);
417 $smarty->assign("groups", $glist);
418 $smarty->assign("search_image", get_template_path('images/search.png'));
419 $smarty->assign("launchimage", get_template_path('images/small_filter.png'));
420 $smarty->assign("tree_image", get_template_path('images/tree.png'));
421 $smarty->assign("deplist", $this->config->idepartments);
422 $smarty->assign("alphabet", generate_alphabet());
423 $smarty->assign("depselect",$_SESSION['CurrentMainBase']);
424 $smarty->assign("hint", print_sizelimit_warning());
426 $smarty->assign("apply", apply_filter());
427 $display.= $smarty->fetch (get_template_path('posix_groups.tpl', TRUE, dirname(__FILE__)));
428 return ($display);
429 }
431 /* Show main page */
432 $smarty= get_smarty();
434 /* Depending on pwmode, currently hardcoded because there are no other methods */
435 if ( 1 == 1 ){
436 $smarty->assign("pwmode", dirname(__FILE__)."/posix_shadow");
437 $shadowMinACL= chkacl($this->acl, "shadowMin");
438 $smarty->assign("shadowmins", sprintf(_("Password can't be changed up to %s days after last change"), "<input name=\"shadowMin\" size=3 maxlength=4 $shadowMinACL value=\"".$this->shadowMin."\">"));
439 $shadowMaxACL= chkacl($this->acl, "shadowMax");
440 $smarty->assign("shadowmaxs", sprintf(_("Password must be changed after %s days"), "<input name=\"shadowMax\" size=3 maxlength=4 $shadowMaxACL value=\"".$this->shadowMax."\">"));
441 $shadowInactiveACL= chkacl($this->acl, "shadowInactive");
442 $smarty->assign("shadowinactives", sprintf(_("Disable account after %s days of inactivity after password expiery"), "<input name=\"shadowInactive\" size=3 maxlength=4 $shadowInactiveACL value=\"".$this->shadowInactive."\">"));
443 $shadowWarningACL= chkacl($this->acl, "shadowWarning");
444 $smarty->assign("shadowwarnings", sprintf(_("Warn user %s days before password expiery"), "<input name=\"shadowWarning\" size=3 maxlength=4 $shadowWarningACL value=\"".$this->shadowWarning."\">"));
445 foreach( array("must_change_password", "use_shadowMin", "use_shadowMax",
446 "use_shadowExpire", "use_shadowInactive",
447 "use_shadowWarning") as $val){
448 if ($this->$val == 1){
449 $smarty->assign("$val", "checked");
450 } else {
451 $smarty->assign("$val", "");
452 }
453 $smarty->assign("$val"."ACL", chkacl($this->acl, $val));
454 }
455 }
457 /* Fill calendar */
459 /* If this $this->shadowExpire is empty
460 use current date as base for calculating selectbox values.
461 (This attribute is empty if this is a new user )*/
462 if(empty($this->shadowExpire)){
463 $date= getdate(time());
464 }else{
465 $date= getdate($this->shadowExpire);
466 }
468 $days= array();
469 for($d= 1; $d<32; $d++){
470 $days[$d]= $d;
471 }
472 $years= array();
473 for($y= $date['year']-10; $y<$date['year']+10; $y++){
474 $years[]= $y;
475 }
476 $months= array(_("January"), _("February"), _("March"), _("April"),
477 _("May"), _("June"), _("July"), _("August"), _("September"),
478 _("October"), _("November"), _("December"));
479 $smarty->assign("day", $date["mday"]);
480 $smarty->assign("days", $days);
481 $smarty->assign("months", $months);
482 $smarty->assign("month", $date["mon"]-1);
483 $smarty->assign("years", $years);
484 $smarty->assign("year", $date["year"]);
486 /* Fill arrays */
487 $smarty->assign("shells", $this->loginShellList);
488 $smarty->assign("secondaryGroups", $this->secondaryGroups);
489 $smarty->assign("primaryGroup", $this->primaryGroup);
490 if (!count($this->groupMembership)){
491 $smarty->assign("groupMembership", array(" "));
492 } else {
493 $smarty->assign("groupMembership", $this->groupMembership);
494 }
495 if (count($this->groupMembership) > 16){
496 $smarty->assign("groups", "too_many_for_nfs");
497 } else {
498 $smarty->assign("groups", "");
499 }
500 $smarty->assign("languages", $this->config->data['MAIN']['LANGUAGES']);
502 /* Avoid "Undefined index: forceMode" */
503 $smarty->assign("forceMode", "");
505 /* Checkboxes */
506 if ($this->force_ids == 1){
507 $smarty->assign("force_ids", "checked");
508 if ($_SESSION['js']){
509 $smarty->assign("forceMode", "");
510 }
511 } else {
512 if ($_SESSION['js']){
513 if($this->acl != "#none#")
514 $smarty->assign("forceMode", "disabled");
515 }
516 $smarty->assign("force_ids", "");
517 }
518 $smarty->assign("force_idsACL", chkacl($this->acl, "force_ids"));
520 /* Load attributes and acl's */
521 foreach($this->attributes as $val){
522 if((chkacl($this->acl,$val)=="")&&(($_SESSION["js"])&&(($val=="uidNumber")||($val=="gidNumber"))))
523 {
524 $smarty->assign("$val"."ACL","");
525 $smarty->assign("$val", $this->$val);
526 continue;
527 }
528 $smarty->assign("$val", $this->$val);
529 $smarty->assign("$val"."ACL", chkacl($this->acl,$val));
530 }
531 $smarty->assign("groupMembershipACL", chkacl($this->acl, "groupMembership"));
532 $smarty->assign("status", $this->status);
534 /* Work on trust modes */
535 $smarty->assign("trustmodeACL", chkacl($this->acl, "trustmode"));
536 if ($this->trustModel == "fullaccess"){
537 $trustmode= 1;
538 // pervent double disable tag in html code, this will disturb our clean w3c html
540 if(chkacl($this->acl, "trustmode")==""){
541 $smarty->assign("trusthide", "disabled");
542 }else{
543 $smarty->assign("trusthide", "");
544 }
546 } elseif ($this->trustModel == "byhost"){
547 $trustmode= 2;
548 $smarty->assign("trusthide", "");
549 } else {
550 // pervent double disable tag in html code, this will disturb our clean w3c html
551 if(chkacl($this->acl, "trustmode")==""){
552 $smarty->assign("trusthide", "disabled");
553 }else{
554 $smarty->assign("trusthide", "");
555 }
556 $trustmode= 0;
557 }
558 $smarty->assign("trustmode", $trustmode);
559 $smarty->assign("trustmodes", array( 0 => _("disabled"), 1 => _("full access"),
560 2 => _("allow access to these hosts")));
564 if((count($this->accessTo))==0)
565 $smarty->assign("emptyArrAccess",true);
566 else
567 $smarty->assign("emptyArrAccess",false);
571 $smarty->assign("workstations", $this->accessTo);
573 $smarty->assign("apply", apply_filter());
574 $display.= $smarty->fetch (get_template_path('generic.tpl', TRUE, dirname(__FILE__)));
575 return($display);
576 }
579 /* remove object from parent */
580 function remove_from_parent()
581 {
582 /* Cancel if there's nothing to do here */
583 if (!$this->initially_was_account){
584 return;
585 }
587 /* include global link_info */
588 $ldap= $this->config->get_ldap_link();
590 /* Remove and write to LDAP */
591 plugin::remove_from_parent();
593 /* Zero out array */
594 $this->attrs['gosaHostACL']= array();
596 /* Keep uid, because we need it for authentification! */
597 unset($this->attrs['uid']);
598 unset($this->attrs['trustModel']);
600 @DEBUG (DEBUG_LDAP, __LINE__, __FUNCTION__, __FILE__,
601 $this->attributes, "Save");
602 $ldap->cd($this->dn);
603 $this->cleanup();
604 $ldap->modify ($this->attrs);
606 show_ldap_error($ldap->get_error(), _("Removing UNIX account failed"));
608 /* Delete group only if cn is uid and there are no other
609 members inside */
610 $ldap->cd ($this->config->current['BASE']);
611 $ldap->search ("(&(objectClass=posixGroup)(gidNumber=".$this->gidNumber."))", array("cn", "memberUid"));
612 if ($ldap->count() != 0){
613 $attrs= $ldap->fetch();
614 if ($attrs['cn'][0] == $this->uid &&
615 !isset($this->attrs['memberUid'])){
617 $ldap->rmDir($ldap->getDN());
618 }
619 }
621 /* Optionally execute a command after we're done */
622 $this->handle_post_events("remove", array("uid" => $this->uid));
623 }
626 function save_object()
627 {
628 if (isset($_POST['posixTab'])){
629 /* Save values to object */
630 plugin::save_object();
632 /* Save force GID attribute */
633 if (chkacl ($this->acl, "force_ids") == ""){
634 if (isset ($_POST['force_ids'])){
635 $data= 1;
636 } else {
637 $data= 0;
638 }
639 if ($this->force_ids != $data){
640 $this->is_modified= TRUE;
641 }
642 $this->force_ids= $data;
644 $data= $_POST['primaryGroup'];
645 if ($this->primaryGroup != $data){
646 $this->is_modified= TRUE;
647 }
648 $this->primaryGroup= $_POST['primaryGroup'];
649 }
651 /* Save pwmode dependent attributes, curently hardcoded because there're
652 no alternatives */
653 if (1 == 1){
654 foreach( array("must_change_password", "use_shadowMin", "use_shadowMax",
655 "use_shadowExpire", "use_shadowInactive",
656 "use_shadowWarning") as $val){
657 if (chkacl($this->acl, "$val") == ""){
658 if (isset ($_POST[$val])){
659 $data= 1;
660 } else {
661 $data= 0;
662 }
663 if ($data != $this->$val){
664 $this->is_modified= TRUE;
665 }
666 $this->$val= $data;
667 }
668 }
669 }
671 /* Trust mode - special handling */
672 if (isset($_POST['trustmode']) && chkacl($this->acl,"allowedHosts") == ""){
673 $saved= $this->trustModel;
674 if ($_POST['trustmode'] == "1"){
675 $this->trustModel= "fullaccess";
676 } elseif ($_POST['trustmode'] == "2"){
677 $this->trustModel= "byhost";
678 } else {
679 $this->trustModel= "";
680 }
681 if ($this->trustModel != $saved){
682 $this->is_modified= TRUE;
683 }
684 }
685 }
687 /* Get regex from alphabet */
688 if(isset($_GET['search'])){
689 $this->GroupRegex = $_GET['search']."*";
690 }
692 /* Check checkboxes and regexes */
693 if(isset($_POST["PosixGroupDialogPosted"])){
694 if(isset($_POST['SubSearch']) && ($_POST['SubSearch'])){
695 $this->SubSearch = true;
696 }else{
697 $this->SubSearch = false;
698 }
700 if(isset($_POST['guser'])){
701 $this->GroupUserRegex = $_POST['guser'];
702 }
703 if(isset($_POST['regex'])){
704 $this->GroupRegex = $_POST['regex'];
705 }
706 }
707 $this->GroupRegex = preg_replace("/\*\**/","*",$this->GroupRegex);
708 $this->GroupUserRegex = preg_replace("/\*\**/","*",$this->GroupUserRegex);
709 }
712 /* Save data to LDAP, depending on is_account we save or delete */
713 function save()
714 {
716 /* include global link_info */
717 $ldap= $this->config->get_ldap_link();
719 /* Adapt shadow values */
720 if (!$this->use_shadowExpire){
721 $this->shadowExpire= "0";
722 } else {
723 /* Transform seconds to days here */
724 $this->shadowExpire= (int)($this->shadowExpire / (60 * 60 * 24)) ;
725 }
726 if (!$this->use_shadowMax){
727 $this->shadowMax= "0";
728 }
729 if ($this->must_change_password){
730 $this->shadowLastChange= (int)(date("U") / 86400) - $this->shadowMax - 1;
731 } else {
732 $this->shadowLastChange= (int)(date("U") / 86400);
733 }
734 if (!$this->use_shadowWarning){
735 $this->shadowWarning= "0";
736 }
738 /* Check what to do with ID's */
739 if ($this->force_ids == 0){
741 /* Use id's that are already set */
742 if ($this->savedUidNumber != ""){
743 $this->uidNumber= $this->savedUidNumber;
744 $this->gidNumber= $this->savedGidNumber;
745 } else {
747 /* Calculate new id's. We need to place a lock before calling get_next_id
748 to get real unique values. */
749 $wait= 10;
750 while (get_lock("uidnumber") != ""){
751 sleep (1);
753 /* Oups - timed out */
754 if ($wait-- == 0){
755 print_red (_("Failed: overriding lock"));
756 break;
757 }
758 }
760 add_lock ("uidnumber", "gosa");
761 $this->uidNumber= $this->get_next_id("uidNumber", $this->dn);
762 if ($this->savedGidNumber != ""){
763 $this->gidNumber= $this->savedGidNumber;
764 } else {
765 $this->gidNumber= $this->get_next_id("gidNumber", $this->dn);
766 }
767 }
769 if ($this->primaryGroup != 0){
770 $this->gidNumber= $this->primaryGroup;
771 }
772 }
774 if ($this->use_shadowMin != "1" ) {
775 $this->shadowMin = "";
776 }
778 if (($this->use_shadowMax != "1") && ($this->must_change_password != "1")) {
779 $this->shadowMax = "";
780 }
782 if ($this->use_shadowWarning != "1" ) {
783 $this->shadowWarning = "";
784 }
786 if ($this->use_shadowInactive != "1" ) {
787 $this->shadowInactive = "";
788 }
790 if ($this->use_shadowExpire != "1" ) {
791 $this->shadowExpire = "";
792 }
794 /* Fill gecos */
795 if (isset($this->parent) && $this->parent != NULL){
796 $this->gecos= rewrite($this->parent->by_object['user']->cn);
797 if (!preg_match('/^[a-z0-9 -]+$/i', $this->gecos)){
798 $this->gecos= "";
799 }
800 }
802 foreach(array("shadowMin","shadowMax","shadowWarning","shadowInactive","shadowExpire") as $attr){
803 $this->$attr = (int) $this->$attr;
804 }
805 /* Call parents save to prepare $this->attrs */
806 plugin::save();
808 /* Trust accounts */
809 $objectclasses= array();
810 foreach ($this->attrs['objectClass'] as $key => $class){
811 if (preg_match('/trustAccount/i', $class)){
812 continue;
813 }
814 $objectclasses[]= $this->attrs['objectClass'][$key];
815 }
816 $this->attrs['objectClass']= $objectclasses;
817 if ($this->trustModel != ""){
818 $this->attrs['objectClass'][]= "trustAccount";
819 $this->attrs['trustModel']= $this->trustModel;
820 $this->attrs['accessTo']= array();
821 if ($this->trustModel == "byhost"){
822 foreach ($this->accessTo as $host){
823 $this->attrs['accessTo'][]= $host;
824 }
825 }
826 } else {
827 if ($this->was_trust_account){
828 $this->attrs['accessTo']= array();
829 $this->attrs['trustModel']= array();
830 }
831 }
833 if(empty($this->attrs['gosaDefaultPrinter'])){
834 $thid->attrs['gosaDefaultPrinter']=array();
835 }
838 /* Save data to LDAP */
839 $ldap->cd($this->dn);
840 $this->cleanup();
841 unset($this->attrs['uid']);
842 $ldap->modify ($this->attrs);
844 show_ldap_error($ldap->get_error(), _("Saving UNIX account failed"));
846 /* Remove lock needed for unique id generation */
847 del_lock ("uidnumber");
850 /* Posix accounts have group interrelationship,
851 take care about these here if this is a new user without forced gidNumber. */
852 if ($this->force_ids == 0 && $this->primaryGroup == 0 && !$this->initially_was_account){
853 $ldap->cd($this->config->current['BASE']);
854 $ldap->search("(&(objectClass=posixGroup)(gidNumber=".$this->gidNumber."))", array("cn"));
856 /* Create group if it doesn't exist */
857 if ($ldap->count() == 0){
858 $groupdn= preg_replace ('/^'.$this->config->current['DNMODE'].'=[^,]+,'.get_people_ou().'/i', 'cn='.$this->uid.','.get_groups_ou(), $this->dn);
859 $g= new group($this->config, $groupdn);
860 $g->cn= $this->uid;
861 $g->force_gid= 1;
862 $g->gidNumber= $this->gidNumber;
863 $g->description= "Group of user ".$this->givenName." ".$this->sn;
864 $g->save ();
865 }
866 }
868 /* Take care about groupMembership values: add to groups */
869 foreach ($this->groupMembership as $key => $value){
870 if (!isset($this->savedGroupMembership[$key])){
871 $g= new grouptabs($this->config,$this->config->data['TABS']['GROUPTABS'], $key, false);
872 $g->by_object['group']->addUser($this->uid);
873 $g->dnMapping[$this->uid]= $this->dn;
874 $g->save();
875 }
876 }
878 /* Remove from groups not listed in groupMembership */
879 foreach ($this->savedGroupMembership as $key => $value){
880 if (!isset($this->groupMembership[$key])){
881 $g= new grouptabs($this->config,$this->config->data['TABS']['GROUPTABS'], $key);
882 $g->by_object['group']->removeUser ($this->uid);
883 $g->save();
884 }
885 }
887 /* Optionally execute a command after we're done */
888 if ($this->initially_was_account == $this->is_account){
889 if ($this->is_modified){
890 $this->handle_post_events("modify",array("uid" => $this->uid));
891 }
892 } else {
893 $this->handle_post_events("add",array("uid" , $this->uid));
894 }
895 }
897 /* Check formular input */
898 function check()
899 {
900 /* Include global link_info */
901 $ldap= $this->config->get_ldap_link();
903 /* Call common method to give check the hook */
904 $message= plugin::check();
906 /* must: homeDirectory */
907 if ($this->homeDirectory == ""){
908 $message[]= _("The required field 'Home directory' is not set.");
909 }
910 if (!is_path($this->homeDirectory)){
911 $message[]= _("Please enter a valid path in 'Home directory' field.");
912 }
914 /* Check ID's if they are forced by user */
915 if ($this->force_ids == "1"){
917 /* Valid uid/gid? */
918 if (!is_id($this->uidNumber)){
919 $message[]= _("Value specified as 'UID' is not valid.");
920 } else {
921 if ($this->uidNumber < $this->config->current['MINID']){
922 $message[]= _("Value specified as 'UID' is too small.");
923 }
924 }
925 if (!is_id($this->gidNumber)){
926 $message[]= _("Value specified as 'GID' is not valid.");
927 } else {
928 if ($this->gidNumber < $this->config->current['MINID']){
929 $message[]= _("Value specified as 'GID' is too small.");
930 }
931 }
932 }
934 /* Check shadow settings, well I like spaghetties... */
935 if ($this->use_shadowMin){
936 if (!is_id($this->shadowMin)){
937 $message[]= _("Value specified as 'shadowMin' is not valid.");
938 }
939 }
940 if ($this->use_shadowMax){
941 if (!is_id($this->shadowMax)){
942 $message[]= _("Value specified as 'shadowMax' is not valid.");
943 }
944 }
945 if ($this->use_shadowWarning){
946 if (!is_id($this->shadowWarning)){
947 $message[]= _("Value specified as 'shadowWarning' is not valid.");
948 }
949 if (!$this->use_shadowMax){
950 $message[]= _("'shadowWarning' without 'shadowMax' makes no sense.");
951 }
952 if ($this->shadowWarning > $this->shadowMax){
953 $message[]= _("Value specified as 'shadowWarning' should be smaller than 'shadowMax'.");
954 }
955 if ($this->use_shadowMin && $this->shadowWarning < $this->shadowMin){
956 $message[]= _("Value specified as 'shadowWarning' should be greater than 'shadowMin'.");
957 }
958 }
959 if ($this->use_shadowInactive){
960 if (!is_id($this->shadowInactive)){
961 $message[]= _("Value specified as 'shadowInactive' is not valid.");
962 }
963 if (!$this->use_shadowMax){
964 $message[]= _("'shadowInactive' without 'shadowMax' makes no sense.");
965 }
966 }
967 if ($this->use_shadowMin && $this->use_shadowMax){
968 if ($this->shadowMin > $this->shadowMax){
969 $message[]= _("Value specified as 'shadowMin' should be smaller than 'shadowMax'.");
970 }
971 }
973 // if(empty($this->gosaDefaultPrinter)){
974 // $message[]= _("You need to specify a valid default printer.");
975 // }
977 return ($message);
978 }
980 function addGroup ($groups)
981 {
982 /* include global link_info */
983 $ldap= $this->config->get_ldap_link();
985 /* Walk through groups and add the descriptive entry if not exists */
986 foreach ($groups as $value){
987 if (!array_key_exists($value, $this->groupMembership)){
988 $ldap->cat($value, array('cn', 'description', 'dn'));
989 $attrs= $ldap->fetch();
990 error_reporting (0);
991 if (!isset($attrs['description'][0])){
992 $entry= $attrs["cn"][0];
993 } else {
994 $dsc= preg_replace ('/^Group of user/', _("Group of user"), $attrs["description"][0]);
995 $entry= $attrs["cn"][0]." [$dsc]";
996 }
997 error_reporting (E_ALL);
998 $this->groupMembership[$attrs['dn']]= $entry;
999 }
1000 }
1002 /* Sort groups */
1003 asort ($this->groupMembership);
1004 reset ($this->groupMembership);
1005 }
1008 /* Del posix user from some groups */
1009 function delGroup ($groups)
1010 {
1011 $dest= array();
1013 foreach ($this->groupMembership as $key => $value){
1014 if (!in_array($key, $groups)){
1015 $dest[$key]= $value;
1016 }
1017 }
1018 $this->groupMembership= $dest;
1019 }
1021 /* Adapt from template, using 'dn' */
1022 function adapt_from_template($dn)
1023 {
1024 /* Include global link_info */
1025 $ldap= $this->config->get_ldap_link();
1027 plugin::adapt_from_template($dn);
1028 $template= $this->attrs['uid'][0];
1030 /* Adapt group membership */
1031 $ldap->cd($this->config->current['BASE']);
1032 $ldap->search("(&(objectClass=posixGroup)(memberUid=".$this->attrs["uid"][0]."))", array("description", "cn"));
1034 while ($this->attrs= $ldap->fetch()){
1035 if (!isset($this->attrs["description"][0])){
1036 $entry= $this->attrs["cn"][0];
1037 } else {
1038 $entry= $this->attrs["cn"][0]." [".$this->attrs["description"][0]."]";
1039 }
1040 $this->groupMembership[$ldap->getDN()]= $entry;
1041 }
1043 /* Fix primary group settings */
1044 $ldap->cd($this->config->current['BASE']);
1045 $ldap->search("(&(objectClass=posixGroup)(cn=$template)(gidNumber=".$this->gidNumber."))", array("cn"));
1046 if ($ldap->count() != 1){
1047 $this->primaryGroup= $this->gidNumber;
1048 }
1050 $ldap->cd($this->config->current['BASE']);
1051 $ldap->search("(&(objectClass=gosaUserTemplate)(uid=".$template.")(accessTo=*))", array("cn","accessTo"));
1053 while($attr = $ldap->fetch()){
1054 $tmp = $attr['accessTo'];
1055 unset ($tmp['count']);
1056 $this->accessTo = $tmp;
1057 }
1059 /* Adjust shadow checkboxes */
1060 foreach (array("shadowMin", "shadowMax", "shadowWarning", "shadowInactive") as $val){
1061 if ($this->$val != 0){
1062 $oval= "use_".$val;
1063 $this->$oval= "1";
1064 }
1065 }
1067 /*
1068 * If shadowExpire is not enabled in the template, it's a UNIX timestamp - so don't convert it to seconds.
1069 * The check is a hack - if difference between timestamp generated above and here is max 1 day.
1070 */
1071 if(abs($this->shadowExpire - time())>86400) {
1072 $this->shadowExpire= $this->convertToSeconds($this->shadowExpire);
1073 }
1075 /* Only enable checkbox, if shadowExpire is in the future */
1076 if($this->shadowExpire > time()) {
1077 $this->use_shadowExpire= "1";
1078 }
1079 }
1081 function get_next_id($attrib, $dn)
1082 {
1083 $ids= array();
1084 $ldap= $this->config->get_ldap_link();
1086 $ldap->cd ($this->config->current['BASE']);
1087 if (preg_match('/gidNumber/i', $attrib)){
1088 $oc= "posixGroup";
1089 } else {
1090 $oc= "posixAccount";
1091 }
1092 $ldap->search ("(&(objectClass=$oc)($attrib=*))", array("$attrib"));
1094 /* Get list of ids */
1095 while ($attrs= $ldap->fetch()){
1096 $ids[]= (int)$attrs["$attrib"][0];
1097 }
1099 /* Add the nobody id */
1100 $ids[]= 65534;
1102 /* Find out next free id near to UID_BASE */
1103 if (!isset($this->config->current['BASE_HOOK'])){
1104 $base= $this->config->current['UIDBASE'];
1105 } else {
1106 /* Call base hook */
1107 $base= get_base_from_hook($dn, $attrib);
1108 }
1109 for ($id= $base; $id++; $id < pow(2,32)){
1110 if (!in_array($id, $ids)){
1111 return ($id);
1112 }
1113 }
1115 /* Check if current id reaches the maximum of 32 bit */
1116 if ($id >= pow(2,32)){
1117 echo _("Too many users, can't allocate a free ID!");
1118 exit;
1119 }
1120 }
1122 function reload()
1123 {
1125 /* Set base for all searches */
1126 $base = $_SESSION['CurrentMainBase'];
1127 $base = $base;
1128 $ldap = $this->config->get_ldap_link();
1129 $attrs = array("cn", "description", "gidNumber");
1130 $Flags = GL_SIZELIMIT;
1132 /* Get groups */
1133 if ($this->GroupUserRegex == '*'){
1134 $filter = "(&(objectClass=posixGroup)(cn=".$this->GroupRegex."))";
1135 } else {
1136 $filter= "(&(objectClass=posixGroup)(cn=".$this->GroupRegex.")(memberUid=".$this->GroupUserRegex."))";
1137 }
1138 if($this->SubSearch){
1139 $Flags |= GL_SUBSEARCH;
1140 }else{
1141 $base = get_groups_ou().$base;
1142 }
1145 $res= get_list($filter, $this->ui->subtreeACL, $base,$attrs, $Flags);
1147 /* check sizelimit */
1148 if (preg_match("/size limit/i", $ldap->error)){
1149 $_SESSION['limit_exceeded']= TRUE;
1150 }
1152 /* Create a list of users */
1153 $this->grouplist = array();
1154 foreach ($res as $value){
1155 $this->grouplist[$value['gidNumber'][0]]= $value;
1156 }
1158 $tmp=array();
1159 foreach($this->grouplist as $tkey => $val ){
1160 $tmp[strtolower($val['cn'][0]).$val['cn'][0]]=$val;
1161 }
1163 /* Sort index */
1164 ksort($tmp);
1166 /* Recreate index array[dn]=cn[description]*/
1167 $this->grouplist=array();
1168 foreach($tmp as $val){
1169 if(isset($val['description'])){
1170 $this->grouplist[$val['dn']]=$val['cn'][0]." [".$val['description'][0]."]";
1171 }else{
1172 $this->grouplist[$val['dn']]=$val['cn'][0];
1173 }
1174 }
1175 reset ($this->grouplist);
1176 }
1179 /* Get posts from copy & paste dialog */
1180 function saveCopyDialog()
1181 {
1182 if(isset($_POST['homeDirectory'])){
1183 $this->homeDirectory = $_POST['homeDirectory'];
1184 if (isset ($_POST['force_ids'])){
1185 $data= 1;
1186 $this->gidNumber = $_POST['gidNumber'];
1187 $this->uidNumber = $_POST['uidNumber'];
1188 } else {
1189 $data= 0;
1190 }
1191 if ($this->force_ids != $data){
1192 $this->is_modified= TRUE;
1193 }
1194 $this->force_ids= $data;
1195 }
1196 }
1199 /* Create the posix dialog part for copy & paste */
1200 function getCopyDialog()
1201 {
1202 /* Skip dialog creation if this is not a valid account */
1203 if(!$this->is_account) return("");
1204 if ($this->force_ids == 1){
1205 $force_ids = "checked";
1206 if ($_SESSION['js']){
1207 $forceMode = "";
1208 }
1209 } else {
1210 if ($_SESSION['js']){
1211 if($this->acl != "#none#")
1212 $forceMode ="disabled";
1213 }
1214 $force_ids = "";
1215 }
1217 $sta = "";
1219 /* Open group add dialog */
1220 if(isset($_POST['edit_groupmembership'])){
1221 $this->group_dialog = TRUE;
1222 $sta = "SubDialog";
1223 }
1225 /* If the group-add dialog is closed, call execute
1226 to ensure that the membership is updatd */
1227 if(isset($_POST['add_groups_finish']) || isset($_POST['add_groups_cancel'])){
1228 $this->execute();
1229 $this->group_dialog =FALSE;
1230 }
1232 if($this->group_dialog){
1233 $str = $this->execute(true);
1234 $ret = array();
1235 $ret['string'] = $str;
1236 $ret['status'] = $sta;
1237 return($ret);
1238 }
1240 /* If a group member should be deleted, simply call execute */
1241 if(isset($_POST['delete_groupmembership'])){
1242 $this->execute();
1243 }
1245 /* Assigned informations to smarty */
1246 $smarty = get_smarty();
1247 $smarty->assign("homeDirectory",$this->homeDirectory);
1248 $smarty->assign("uidNumber",$this->uidNumber);
1249 $smarty->assign("gidNumber",$this->gidNumber);
1250 $smarty->assign("forceMode",$forceMode);
1251 $smarty->assign("force_ids",$force_ids);
1252 if (!count($this->groupMembership)){
1253 $smarty->assign("groupMembership", array(" "));
1254 } else {
1255 $smarty->assign("groupMembership", $this->groupMembership);
1256 }
1258 /* Display wars message if there are more than 16 group members */
1259 if (count($this->groupMembership) > 16){
1260 $smarty->assign("groups", "too_many_for_nfs");
1261 } else {
1262 $smarty->assign("groups", "");
1263 }
1264 $str = $smarty->fetch(get_template_path("paste_generic.tpl",TRUE,dirname(__FILE__)));
1266 $ret = array();
1267 $ret['string'] = $str;
1268 $ret['status'] = $sta;
1269 return($ret);
1270 }
1272 function PrepareForCopyPaste($source)
1273 {
1274 plugin::PrepareForCopyPaste($source);
1276 /* Avoid using the same gid/uid number as source user */
1277 $this->savedUidNumber = $this->get_next_id("gidNumber", $this->dn);
1278 $this->savedGidNumber = $this->get_next_id("uidNumber", $this->dn);
1279 }
1281 function convertToSeconds($val)
1282 {
1283 if ($val != 0){
1284 $val*= 60 * 60 * 24;
1285 } else {
1286 $date= getdate();
1287 $val= floor($date[0] / (60*60*24)) * 60 * 60 * 24;
1288 }
1289 return($val);
1290 }
1292 }
1294 // vim:tabstop=2:expandtab:shiftwidth=2:filetype=php:syntax:ruler:
1295 ?>