Code

fixed base detection for new objects.
[gosa.git] / gosa-core / plugins / admin / ogroups / class_ogroup.inc
index bfd86e1014432351c8fd5f6ef4737a2c3a66b68b..d951b0b08e9ae3f92a7a0f001ceb8272efc42933 100644 (file)
@@ -42,17 +42,29 @@ class ogroup extends plugin
   var $description= "";
   var $base= "";
   var $gosaGroupObjects= "";
-  var $department= "";
   var $objects= array();
   var $objcache= array();
   var $memberList= array();
   var $member= array();
   var $orig_dn= "";
-  var $group_dialog= FALSE;
+  var $orig_cn= "";
+  var $orig_base= "";
+  var $objectSelect= FALSE;
   var $view_logged = FALSE;
 
+  var $accessTo= array();
+  var $trustModel= "";
+  var $trustSelect = FALSE;
+
+  var $was_trust_account= FALSE;
+  var $baseSelector;
+
+  /* Already assigned Workstations. Will be hidden in selection. 
+   */
+  var $used_workstations = array();
+
   /* attribute list for save action */
-  var $attributes= array("cn", "description", "gosaGroupObjects","member");
+  var $attributes= array("cn", "description", "gosaGroupObjects","member","accessTo","trustModel");
   var $objectclasses= array("top", "gosaGroupOfNames");
 
   function ogroup (&$config, $dn= NULL)
@@ -104,18 +116,71 @@ class ogroup extends plugin
     }
     session::set("ogfilter", $ogfilter);
   
-    if(session::is_set('CurrentMainBase')){
-     $this->base  = session::get('CurrentMainBase');
-    }
-
     /* Set base */
     if ($this->dn == "new"){
-      $this->base = session::get('CurrentMainBase');
+      $ui = get_userinfo();
+      $this->base= dn2base(session::global_is_set("CurrentMainBase")?"cn=dummy,".session::global_get("CurrentMainBase"):$ui->dn);
     } else {
-      $this->base= preg_replace("/^[^,]+,".normalizePreg(get_ou("ogroupou"))."/","",$this->dn);
+      $this->base= preg_replace("/^[^,]+,".preg_quote(get_ou("ogroupRDN"), '/')."/i","",$this->dn);
+
+      /* Is this account a trustAccount? */
+      if ($this->is_account && isset($this->attrs['trustModel'])){
+        $this->trustModel= $this->attrs['trustModel'][0];
+        $this->was_trust_account= TRUE;
+      } else {
+        $this->was_trust_account= FALSE;
+        $this->trustModel= "";
+      }
+
+      $this->accessTo = array();
+      if ($this->is_account && isset($this->attrs['accessTo'])){
+        for ($i= 0; $i<$this->attrs['accessTo']['count']; $i++){
+          $tmp= $this->attrs['accessTo'][$i];
+          $this->accessTo[$tmp]= $tmp;
+        }
+      }
+    }
+
+    /* Detect all workstations, which are already assigned to an object group  
+        - Those objects will be hidden in the add object dialog.
+        - Check() will complain if such a system is assigned to this object group.
+     */ 
+    $base = $this->config->current['BASE'];
+    $res    = get_list("(|(objectClass=gotoWorkstation)(objectClass=gotoTerminal))","none" , 
+        $base, array("dn"),GL_NO_ACL_CHECK|GL_SUBSEARCH);
+    $ws_dns = array();
+    foreach($res as $data){
+      $ws_dns[] = $data['dn'];
+    }
+    $res=get_list("(&(member=*)(objectClass=gosaGroupOfNames))","none",
+        $base, array("dn","member", "gosaGroupObjects"),GL_NO_ACL_CHECK|GL_SUBSEARCH);
+    $this->used_workstations = array();
+    foreach($res as $og){
+      if($og['dn'] == $this->dn) continue;
+      $test = array_intersect($ws_dns,$og['member']);
+      if(($og['gosaGroupObjects'] == "[W]" || $og['gosaGroupObjects'] == "[T]") && count($test)){
+        $this->used_workstations = array_merge($this->used_workstations,$test);
+      }
     }
 
-    /* Load member data */
+    $this->orig_cn = $this->cn;
+    $this->orig_base = $this->base;
+
+    /* Get global filter config */
+    if (!session::is_set("sysfilter")){
+      $ui= get_userinfo();
+      $base= get_base_from_people($ui->dn);
+      $sysfilter= array( "depselect"       => $base,
+          "regex"           => "*");
+      session::set("sysfilter", $sysfilter);
+    }
+
+    /* Instanciate base selector */
+    $this->baseSelector= new baseSelector($this->get_allowed_bases(), $this->base);
+    $this->baseSelector->setSubmitButton(false);
+    $this->baseSelector->setHeight(300);
+    $this->baseSelector->update(true);
+
     $this->reload();
   }
 
@@ -145,22 +210,37 @@ class ogroup extends plugin
       }
 
       /* Add objects to group */
-      if (isset($_POST['add_object_finish']) && isset($_POST['objects'])){
-
-        $tmp = "";
-        foreach($this->memberList as $obj){
-          $tmp .= $obj['type'];
-        }
+      if (isset($_POST['objectSelect_save']) && $this->objectSelect instanceOf objectSelect){
+        $objects = $this->objectSelect->save();
         $skipped = FALSE;
-        foreach ($_POST['objects'] as $value){
-          if(preg_match("/T/",$tmp) && $this->objects[$value]['type'] == "W"){
+        foreach($objects as $object){
+
+          $tmp = "";
+          foreach($this->memberList as $obj){
+            $tmp .= $obj['type'];
+          }
+
+          $type  = $this->getObjectType($object);
+          $name= $this->getObjectName($object);
+          $dn = $object['dn'];
+
+          /* Fill array */
+          if (isset($object["description"][0])){
+            $object= array("text" => "$name [".$object["description"][0]."]", "type" => "$type");
+          } elseif (isset($object["uid"][0])) {
+            $object= array("text" => "$name [".$object["uid"][0]."]", "type" => "$type");
+          } else {
+            $object= array("text" => "$name", "type" => "$type");
+          }
+
+          if(preg_match("/T/",$tmp) && $type == "W"){
             $skipped =TRUE;
-          }elseif(preg_match("/W/",$tmp) && $this->objects[$value]['type'] == "T"){
+          }elseif(preg_match("/W/",$tmp) && $type == "T"){
             $skipped =TRUE;
           }else{
-            $this->memberList["$value"]= $this->objects[$value];
-            $this->member["$value"]= $value;
-            unset ($this->objects[$value]);
+
+            $this->memberList["$dn"]= $object;
+            $this->member["$dn"]= $dn;
             uasort ($this->memberList, 'sort_list');
             reset ($this->memberList);
           }
@@ -168,7 +248,8 @@ class ogroup extends plugin
         if($skipped){
           msg_dialog::display(_("Information"), _("You cannot combine terminals and workstations in one object group!"), INFO_DIALOG);
         }
-        $this->reload();
+        $this->objectSelect= FALSE;
+        $this->dialog= FALSE;
       }
     }
   }
@@ -186,7 +267,7 @@ class ogroup extends plugin
 
     /* Do we represent a valid group? */
     if (!$this->is_account){
-      $display= "<img alt=\"\" src=\"images/stop.png\" align=\"middle\">&nbsp;<b>".
+      $display= "<img alt=\"\" src=\"images/small-error.png\" align=\"middle\">&nbsp;<b>".
         msgPool::noValidExtension("object group")."</b>";
       return ($display);
     }
@@ -194,22 +275,68 @@ class ogroup extends plugin
 
     /* Load templating engine */
     $smarty= get_smarty();
+    $smarty->assign("usePrototype", "true");
 
     $tmp = $this->plInfo();
     foreach($tmp['plProvidedAcls'] as $name => $translation){
       $smarty->assign($name."ACL",$this->getacl($name));
     }
 
-    /* Base select dialog */
-    $once = true;
-    foreach($_POST as $name => $value){
-      if(preg_match("/^chooseBase/",$name) && $once && $this->acl_is_moveable()){
-        $once = false;
-        $this->dialog = new baseSelectDialog($this->config,$this,$this->get_allowed_bases());
-        $this->dialog->setCurrentBase($this->base);
+    /***********
+     * Trusts 
+     ***********/
+
+    /* Add user workstation? */
+    if (isset($_POST["add_ws"])){
+      $this->trustSelect= new trustSelect($this->config,get_userinfo());
+      $this->dialog= TRUE;
+    }
+
+    // Add selected machines to trusted ones.
+    if (isset($_POST["add_ws_finish"]) &&  $this->trustSelect){
+      $trusts = $this->trustSelect->detectPostActions();
+      if(isset($trusts['targets'])){
+
+        $headpage = $this->trustSelect->getHeadpage();
+        foreach($trusts['targets'] as $id){
+          $attrs = $headpage->getEntry($id);
+          $this->accessTo[$attrs['cn'][0]]= $attrs['cn'][0];
+        }
+        ksort($this->accessTo);
+        $this->is_modified= TRUE;
       }
+      $this->trustSelect= NULL;
+      $this->dialog= FALSE;
+    }
+
+
+    /* Remove user workstations? */
+    if (isset($_POST["delete_ws"]) && isset($_POST['workstation_list'])){
+      foreach($_POST['workstation_list'] as $name){
+        unset ($this->accessTo[$name]);
+      }
+      $this->is_modified= TRUE;
+    }
+
+    /* Add user workstation finished? */
+    if (isset($_POST["add_ws_cancel"])){
+      $this->trustSelect= NULL;
+      $this->dialog= FALSE;
+    }
+
+    /* Show ws dialog */
+    if ($this->trustSelect){
+  
+      // Build up blocklist
+      session::set('filterBlacklist', array('cn' => array_values($this->accessTo)));
+      return($this->trustSelect->execute());
     }
 
+    /***********
+     * Ende - Trusts 
+     ***********/
+
+
     /* Dialog handling */
     if(is_object($this->dialog) && $this->acl_is_moveable()){
       /* Must be called before save_object */
@@ -232,67 +359,20 @@ class ogroup extends plugin
 
     /* Add objects? */
     if (isset($_POST["edit_membership"])){
-      $this->group_dialog= TRUE;
+      $this->objectSelect= new objectSelect($this->config, get_userinfo());
       $this->dialog= TRUE;
     }
 
     /* Add objects finished? */
-    if (isset($_POST["add_object_finish"]) || isset($_POST["add_object_cancel"])){
-      $this->group_dialog= FALSE;
+    if (isset($_POST["objectSelect_cancel"])){
+      $this->objectSelect= FALSE;
       $this->dialog= FALSE;
     }
 
     /* Manage object add dialog */
-    if ($this->group_dialog){
-
-      /* Save data */
-      $ogfilter= session::get("ogfilter");
-      foreach( array("dselect", "regex") as $type){
-        if (isset($_POST[$type])){
-          $ogfilter[$type]= $_POST[$type];
-        }
-      }
-      if (isset($_POST['dselect'])){
-        foreach( array("accounts", "groups", "applications", "departments",
-              "servers", "workstations", "winstations", "terminals", "printers","subtrees",
-              "phones") as $type){
-
-          if (isset($_POST[$type])) {
-            $ogfilter[$type]= "checked";
-          } else {
-            $ogfilter[$type]= "";
-          }
-        }
-      }
-      if (isset($_GET['search'])){
-        $s= mb_substr($_GET['search'], 0, 1, "UTF8")."*";
-        if ($s == "**"){
-          $s= "*";
-        }
-        $ogfilter['regex']= $s;
-      }
-      session::set("ogfilter", $ogfilter);
-      $this->reload();
-
-      /* Calculate actual groups */
-      $smarty->assign("objects", $this->convert_list($this->objects));
-
-      /* Show dialog */
-      $smarty->assign("search_image", get_template_path('images/search.png'));
-      $smarty->assign("launchimage", get_template_path('images/small_filter.png'));
-      $smarty->assign("tree_image", get_template_path('images/tree.png'));
-      $smarty->assign("deplist", $this->config->idepartments);
-      $smarty->assign("alphabet", generate_alphabet());
-      foreach( array("dselect", "regex", "accounts", "groups", "applications",
-            "departments", "servers", "workstations", "winstations", "terminals","subtrees",
-            "printers", "phones") as $type){
-        $smarty->assign("$type", $ogfilter[$type]);
-      }
-      $smarty->assign("hint", print_sizelimit_warning());
-      $smarty->assign("apply", apply_filter());
-
-      $display= $smarty->fetch (get_template_path('ogroup_objects.tpl', TRUE, dirname(__FILE__)));
-      return ($display);
+    if ($this->objectSelect){
+      session::set('filterBlacklist', array('dn'=> $this->member));
+      return($this->objectSelect->execute());
     }
 
     /* Bases / Departments */
@@ -330,9 +410,7 @@ class ogroup extends plugin
     }
 
     /* Assign variables */
-    $smarty->assign("bases", $this->get_allowed_bases());
-    $smarty->assign("base_select", $this->base);
-    $smarty->assign("department", $this->department);
+    $smarty->assign("base", $this->baseSelector->render());
     $smarty->assign("members", $this->convert_list($this->memberList));
 
     /* Objects have to be tuned... */
@@ -343,6 +421,39 @@ class ogroup extends plugin
       $smarty->assign("$val", $this->$val);
     }
 
+    /******
+      Trust account
+     ******/
+    $smarty->assign("trusthide", " disabled ");
+    $smarty->assign("trustmodeACL",  $this->getacl("trustModel"));
+    if ($this->trustModel == "fullaccess"){
+      $trustmode= 1;
+      // pervent double disable tag in html code, this will disturb our clean w3c html
+      $smarty->assign("trustmode",  $this->getacl("trustModel"));
+
+    } elseif ($this->trustModel == "byhost"){
+      $trustmode= 2;
+      $smarty->assign("trusthide", "");
+    } else {
+      // pervent double disable tag in html code, this will disturb our clean w3c html
+      $smarty->assign("trustmode",  $this->getacl("trustModel"));
+      $trustmode= 0;
+    }
+    $smarty->assign("trustmode", $trustmode);
+    $smarty->assign("trustmodes", array( 0 => _("disabled"), 1 => _("full access"),
+          2 => _("allow access to these hosts")));
+
+    $smarty->assign("workstations", $this->accessTo);
+
+    if((count($this->accessTo))==0){
+      $smarty->assign("emptyArrAccess",true);
+    }else{
+      $smarty->assign("emptyArrAccess",false);
+    }
+    /******
+      Ende - Trust account
+     ******/
+
     return ($smarty->fetch (get_template_path('generic.tpl', TRUE)));
   }
 
@@ -353,6 +464,29 @@ class ogroup extends plugin
     /* Save additional values for possible next step */
     if (isset($_POST['ogroupedit'])){
 
+      /******
+        Trust account 
+       ******/
+
+      if($this->acl_is_writeable("trustModel")){
+        if (isset($_POST['trustmode'])){
+          $saved= $this->trustModel;
+          if ($_POST['trustmode'] == "1"){
+            $this->trustModel= "fullaccess";
+          } elseif ($_POST['trustmode'] == "2"){
+            $this->trustModel= "byhost";
+          } else {
+            $this->trustModel= "";
+          }
+          if ($this->trustModel != $saved){
+            $this->is_modified= TRUE;
+          }
+        }
+      }
+      /******
+        Ende Trust account
+       ******/
+
       /* Create a base backup and reset the
          base directly after calling plugin::save_object();
          Base will be set seperatly a few lines below */
@@ -360,13 +494,17 @@ class ogroup extends plugin
       plugin::save_object();
       $this->base = $base_tmp;
 
-      /* Save base, since this is no LDAP attribute */
-      $tmp = $this->get_allowed_bases();
-      if(isset($_POST['base'])){
-        if(isset($tmp[$_POST['base']])){
-          $this->base= $_POST['base'];
+      /* Refresh base */
+      if ($this->acl_is_moveable($this->base)){
+        if (!$this->baseSelector->update()) {
+          msg_dialog::display(_("Error"), msgPool::permMove(), ERROR_DIALOG);
+        }
+        if ($this->base != $this->baseSelector->getBase()) {
+          $this->base= $this->baseSelector->getBase();
+          $this->is_modified= TRUE;
         }
       }
+
     }
   }
 
@@ -394,18 +532,33 @@ class ogroup extends plugin
       Generate Filter 
       ###########*/
 
-    $p_f= array("accounts"        => array("CLASS"=>"gosaAccount"    ,"DN"=> get_people_ou()           ,"ACL" => "users"), 
-                "groups"          => array("CLASS"=>"posixGroup"     ,"DN"=> get_groups_ou('ogroupou') ,"ACL" => "groups"), 
-                "applications"    => array("CLASS"=>"gosaApplication","DN"=> get_ou('applicationou')   ,"ACL" => "application"), 
-                "departments"     => array("CLASS"=>"gosaDepartment" ,"DN"=> ""                        ,"ACL" => "department"), 
-                "servers"         => array("CLASS"=>"goServer"       ,"DN"=> get_ou('serverou')        ,"ACL" => "server"),
-                "workstations"    => array("CLASS"=>"gotoWorkstation","DN"=> get_ou('workstationou')   ,"ACL" => "workstation"),
-                "winstations"    => array("CLASS"=>"opsiClient",        "DN"=> get_ou('WINSTATIONS')     ,"ACL" => "winstation"),
-                "terminals"       => array("CLASS"=>"gotoTerminal"   ,"DN"=> get_ou('terminalou')      ,"ACL" => "terminal"),
-                "printers"        => array("CLASS"=>"gotoPrinter"    ,"DN"=> get_ou('printerou')       ,"ACL" => "printer"),
-                "phones"          => array("CLASS"=>"goFonHardware"  ,"DN"=> get_ou('phoneou')         ,"ACL" => "phone"));
-
-
+    $p_f= array("accounts"=> array("OBJ"=>"user", "CLASS"=>"gosaAccount"    ,
+          "DN"=> get_people_ou()           ,"ACL" => "users"), 
+        "groups"          => array("OBJ"=>"group", "CLASS"=>"posixGroup"     ,
+          "DN"=> get_groups_ou('ogroupRDN') ,"ACL" => "groups"), 
+        "departments"     => array("OBJ"=>"department", "CLASS"=>"gosaDepartment" ,
+          "DN"=> ""                        ,"ACL" => "department"), 
+        "servers"         => array("OBJ"=>"servgeneric", "CLASS"=>"goServer"       ,
+          "DN"=> get_ou('serverRDN')        ,"ACL" => "server"),
+        "workstations"    => array("OBJ"=>"workgeneric", "CLASS"=>"gotoWorkstation",
+          "DN"=> get_ou('workstationRDN')   ,"ACL" => "workstation"),
+        "winstations"     => array("OBJ"=>"wingeneric", "CLASS"=>"opsiClient",        
+          "DN"=> get_ou('SAMBAMACHINEACCOUNTRDN')     ,"ACL" => "winstation"),
+        "terminals"       => array("OBJ"=>"termgeneric", "CLASS"=>"gotoTerminal"   ,
+          "DN"=> get_ou('terminalRDN')      ,"ACL" => "terminal"),
+        "printers"        => array("OBJ"=>"printgeneric", "CLASS"=>"gotoPrinter"    ,
+          "DN"=> get_ou('printerRDN')       ,"ACL" => "printer"),
+        "phones"          => array("OBJ"=>"phoneGeneric", "CLASS"=>"goFonHardware"  ,
+          "DN"=> get_ou('phoneRDN')         ,"ACL" => "phone"));
+
+
+    /* Allow searching for applications, if we are not using release managed applications 
+      */
+    if(!$this->IsReleaseManagementActivated()){
+      $p_f[      "applications"]    = array("OBJ"=>"application", "CLASS"=>"gosaApplication",
+          "DN"=> get_ou('applicationRDN')   ,"ACL" => "application"); 
+    }
+           
     /*###########
       Perform search for selected objectClasses & regex to fill list with objects   
       ###########*/
@@ -417,14 +570,15 @@ class ogroup extends plugin
 
     foreach($p_f as $post_name => $data){
 
-      if($ogfilter[$post_name] == "checked"){
+      if($ogfilter[$post_name] == "checked" && class_available($data['OBJ'])){
 
         if($ogfilter['subtrees']){
           $base =  $ogfilter['dselect'];
         }else{
           $base =  $data['DN'].$ogfilter['dselect'];
         }
-    
+   
+         
         $filter = "(&(objectClass=".$data['CLASS'].")(|(uid=$regex)(cn=$regex)(ou=$regex)))";
         $res    = get_list($filter, $data['ACL']  , $base, 
                     array("description", "objectClass", "sn", "givenName", "uid","ou","cn"),$Get_list_flags);
@@ -432,6 +586,14 @@ class ogroup extends plugin
         /* fetch results and append them to the list */
         foreach($res as $attrs){
 
+          /* Skip workstations which are already assigned to an object group.
+           */
+          if ($this->gosaGroupObjects == "[W]" || $this->gosaGroupObjects == "[T]"){
+            if(in_array($attrs['dn'],$this->used_workstations)){
+              continue;
+            }
+          }
+
           $type= $this->getObjectType($attrs);
           $name= $this->getObjectName($attrs);
 
@@ -463,11 +625,11 @@ class ogroup extends plugin
          it seams that this entry was removed 
        */ 
       /* Try to resolv the entry again, if it still fails, display error msg */
-      $ldap->cat($dn, array("cn", "sn", "givenName", "ou", "description", "objectClass"));
+      $ldap->cat($dn, array("cn", "sn", "givenName", "ou", "description", "objectClass", "macAddress"));
 
       /* It has failed, add entry with type flag I (Invalid)*/
       if (!$ldap->success()){
-        $this->memberList[$dn]= array('text' => _("Non existing dn:")." ".@LDAP::fix($dn),"type" => "I");
+        $this->memberList[$dn]= array('text' => _("Non existing dn:")." ".LDAP::fix($dn),"type" => "I");
 
       } else {
 
@@ -487,6 +649,13 @@ class ogroup extends plugin
           $this->objcache[$attrs["dn"]]= array("text" => "$name", "type" => "$type");
         }
         $this->objcache[$attrs["dn"]]['objectClass']  = $attrs['objectClass'];
+
+        if(isset($attrs['macAddress'][0])){
+          $this->objcache[$attrs["dn"]]['macAddress']  = $attrs['macAddress'][0];
+        }else{
+          $this->objcache[$attrs["dn"]]['macAddress']  = "";
+        }
+
         if(isset($attrs['uid'])){
           $this->objcache[$attrs["dn"]]['uid']          = $attrs['uid'];
         }
@@ -525,21 +694,23 @@ class ogroup extends plugin
   function convert_list($input)
   {
     $temp= "";
-    $conv= array(  "U" => "select_user.png",
-        "G" => "select_groups.png",
-        "A" => "select_application.png",
-        "D" => "select_department.png",
-        "S" => "select_server.png",
-        "W" => "select_workstation.png",
-        "O" => "select_winstation.png",
-        "T" => "select_terminal.png",
-        "F" => "select_phone.png",
-        "I" => "flag.png",
-        "P" => "select_printer.png");
+    $conv= array(  
+        "Y" => "plugins/users/images/select_template.png",
+        "U" => "plugins/generic/images/head.png",
+        "G" => "plugins/groups/images/groups.png",
+        "A" => "plugins/ogroups/images/application.png",
+        "D" => "plugins/departments/images/department.png",
+        "S" => "plugins/ogroups/images/server.png",
+        "W" => "plugins/ogroups/images/workstation.png",
+        "O" => "plugins/ogroups/images/winstation.png",
+        "T" => "plugins/ogroups/images/terminal.png",
+        "F" => "plugins/ogroups/images/phone.png",
+        "P" => "plugins/ogroups/images/printer.png",
+        "I" => "images/false.png");
 
     foreach ($input as $key => $value){
       /* Generate output */
-      $temp.= "<option title='".addslashes( $key)."' value=\"$key\" class=\"select\" style=\"background-image:url('".get_template_path("images/".$conv[$value['type']])."');\">".$value['text']."</option>\n";
+      $temp.= "<option title='".addslashes( $key)."' value=\"$key\" class=\"select\" style=\"background-image:url('".get_template_path($conv[$value['type']])."');\">".$value['text']."</option>\n";
     }
 
     return ($temp);
@@ -550,7 +721,9 @@ class ogroup extends plugin
   {
     $type= "I";
 
-    foreach(array(  "U" => "gosaAccount",
+    foreach(array(  
+          "Y" => "gosaUserTemplate",
+          "U" => "gosaAccount",
           "G" => "posixGroup",
           "A" => "gosaApplication",
           "D" => "gosaDepartment",
@@ -599,14 +772,26 @@ class ogroup extends plugin
 
     /* Permissions for that base? */
     if ($this->base != ""){
-      $new_dn= 'cn='.$this->cn.','.get_ou('ogroupou').$this->base;
+      $new_dn= 'cn='.$this->cn.','.get_ou('ogroupRDN').$this->base;
     } else {
       $new_dn= $this->dn;
     }
 
+    /* Check if we have workstations assigned, that are already assigned to
+        another object group.  */
+    if ($this->gosaGroupObjects == "[W]" || $this->gosaGroupObjects == "[T]" ) {
+      $test =array_intersect($this->used_workstations,$this->member); 
+      if(count($test)){
+        $str = "";
+        foreach($test as $dn){
+          $str .= "<li>".$dn."</li>";
+        }
+        $message[] = sprintf(_("These systems are already configured by other object groups and cannot be added:")."<br><ul>%s</ul>",$str);
+      }
+    }
 
     $ldap = $this->config->get_ldap_link();
-    if($this->dn != $new_dn){
+    if(LDAP::fix($this->dn) != LDAP::fix($new_dn)){
       $ldap->cat ($new_dn, array('dn'));
     }
     
@@ -614,6 +799,11 @@ class ogroup extends plugin
       $message[]= msgPool::duplicated(_("Name"));
     } 
 
+    // Check if a wrong base was supplied
+    if(!$this->baseSelector->checkLastBaseUpdate()){
+      $message[]= msgPool::check_base();;
+    } 
+
     /* Set new acl base */
     if($this->dn == "new") {
       $this->set_acl_base($this->base);
@@ -629,6 +819,14 @@ class ogroup extends plugin
       $message[]= _("You can combine two different object types at maximum, only!");
     }
 
+    /* Check if we are allowed to create or move this object 
+     */
+    if($this->orig_dn == "new" && !$this->acl_is_createable($this->base)){
+      $message[] = msgPool::permCreate();
+    }elseif($this->orig_dn != "new" && $this->base != $this->orig_base && !$this->acl_is_moveable($this->base)){
+      $message[] = msgPool::permMove();
+    }
+
     return ($message);
   }
 
@@ -641,14 +839,14 @@ class ogroup extends plugin
     /* Move members to target array */
     $this->attrs['member'] =array();
     foreach ($this->member as $key => $desc){
-      $this->attrs['member'][]= @LDAP::fix($key);
+      $this->attrs['member'][]= LDAP::fix($key);
     }
 
     $ldap= $this->config->get_ldap_link();
 
     /* New accounts need proper 'dn', propagate it to remaining objects */
     if ($this->dn == 'new'){
-      $this->dn= 'cn='.$this->cn.','.get_ou('ogroupou').$this->base;
+      $this->dn= 'cn='.$this->cn.','.get_ou('ogroupRDN').$this->base;
     }
 
     /* Save data. Using 'modify' implies that the entry is already present, use 'add' for
@@ -667,6 +865,37 @@ class ogroup extends plugin
       $ldap->create_missing_trees(preg_replace('/^[^,]+,/', '', $this->dn));
     }
 
+    /******
+      Trust accounts 
+     ******/
+    $objectclasses= array();
+    foreach ($this->attrs['objectClass'] as $key => $class){
+      if (preg_match('/trustAccount/i', $class)){
+        continue;
+      }
+      $objectclasses[]= $this->attrs['objectClass'][$key];
+    }
+    $this->attrs['objectClass']= $objectclasses;
+    if ($this->trustModel != ""){
+      $this->attrs['objectClass'][]= "trustAccount";
+      $this->attrs['trustModel']= $this->trustModel;
+      $this->attrs['accessTo']= array();
+      if ($this->trustModel == "byhost"){
+        foreach ($this->accessTo as $host){
+          $this->attrs['accessTo'][]= $host;
+        }
+      }
+    } else {
+      if ($this->was_trust_account){
+        $this->attrs['accessTo']= array();
+        $this->attrs['trustModel']= array();
+      }
+    }
+
+    /******
+      Ende - Trust accounts 
+     ******/
+
     /* Write back to ldap */
     $ldap->cd($this->dn);
     $this->cleanup();
@@ -709,10 +938,7 @@ class ogroup extends plugin
   
   function PrepareForCopyPaste($source)
   {
-    /* Update available object types */
-    if(isset($source['gosaGroupObjects'][0])){
-      $this->gosaGroupObjects =  $source['gosaGroupObjects'][0];
-    }
+    plugin::PrepareForCopyPaste($source);
 
     /* Reload tabs */
     $this->parent->reload($this->gosaGroupObjects );
@@ -724,16 +950,10 @@ class ogroup extends plugin
       }
     }
 
-    /* Load member objects */
-    if (isset($source['member'])){
-      foreach ($source['member'] as $key => $value){
-        if ("$key" != "count"){
-          $value= @LDAP::convert($value);
-          $this->member["$value"]= "$value";
-        }
-      }
+    $source_o = new ogroup ($this->config, $source['dn']);
+    foreach(array("accessTo","member","gosaGroupObjects")  as $attr){
+      $this->$attr = $source_o->$attr;
     }
-
   }
 
 
@@ -756,6 +976,17 @@ class ogroup extends plugin
   }
 
 
+  function IsReleaseManagementActivated()
+  {
+    /* Check if we should enable the release selection */
+    $tmp = $this->config->search("faiManagement", "CLASS",array('menu','tabs'));
+    if(!empty($tmp)){
+      return(true);
+    }
+    return(false);
+  }
+
+
   static function plInfo()
   {
     return (array(
@@ -771,6 +1002,7 @@ class ogroup extends plugin
             "cn"                => _("Name"),
             "base"              => _("Base"),
             "description"       => _("Description"),
+            "trustModel"        => _("Sytem trust"),
             "member"            => _("Member"))
           ));
   }