X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=gosa-core%2Finclude%2Fclass_userinfo.inc;h=4ac5ea37c9167bed0153341ac223e11577f85712;hb=a495b80c7c6717a95dec3f584de338e95ab0444f;hp=b2e27116169ef3bcbf36034ef31d6bfb880f37c6;hpb=555d0f13a2240b7a79b8b8d1f361fd4306270d4c;p=gosa.git diff --git a/gosa-core/include/class_userinfo.inc b/gosa-core/include/class_userinfo.inc index b2e271161..4ac5ea37c 100644 --- a/gosa-core/include/class_userinfo.inc +++ b/gosa-core/include/class_userinfo.inc @@ -27,6 +27,7 @@ class userinfo var $username; var $cn; var $uid; + var $restrictions= array(); var $gidNumber= -1; var $language= ""; var $config; @@ -36,13 +37,16 @@ class userinfo var $ocMapping= array(); var $groups= array(); var $result_cache =array(); + var $ignoreACL = FALSE; + var $ACLperPath = array(); + var $ACLperPath_usesFilter = array(); /* get acl's an put them into the userinfo object attr subtreeACL (userdn:components, userdn:component1#sub1#sub2,component2,...) */ function userinfo(&$config, $userdn){ $this->config= &$config; $ldap= $this->config->get_ldap_link(); - $ldap->cat($userdn,array('sn', 'givenName', 'uid', 'gidNumber', 'preferredLanguage', 'gosaUnitTag')); + $ldap->cat($userdn,array('sn', 'givenName', 'uid', 'gidNumber', 'preferredLanguage', 'gosaUnitTag', 'gosaLoginRestriction')); $attrs= $ldap->fetch(); if (isset($attrs['givenName'][0]) && isset($attrs['sn'][0])){ @@ -54,6 +58,12 @@ class userinfo $this->gidNumber= $attrs['gidNumber'][0]; } + /* Restrictions? */ + if (isset($attrs['gosaLoginRestriction'])){ + $this->restrictions= $attrs['gosaLoginRestriction']; + unset($this->restrictions['count']); + } + /* Assign user language */ if (isset($attrs['preferredLanguage'][0])){ $this->language= $attrs['preferredLanguage'][0]; @@ -67,8 +77,9 @@ class userinfo $this->uid= $attrs['uid'][0]; $this->ip= $_SERVER['REMOTE_ADDR']; + $this->ignoreACL = ($this->config->get_cfg_value("ignoreAcl") == $this->dn); + /* Initialize ACL_CACHE */ - session::set('ACL_CACHE',array()); $this->reset_acl_cache(); } @@ -76,7 +87,7 @@ class userinfo public function reset_acl_cache() { /* Initialize ACL_CACHE */ - session::set('ACL_CACHE',array()); + session::global_set('ACL_CACHE',array()); } function loadACL() @@ -147,15 +158,16 @@ class userinfo foreach($aclc[$dn] as $idx => $type){ $interresting= FALSE; - /* No members? This is good for all users... */ + /* No members? This ACL rule is deactivated ... */ if (!count($type['members'])){ - $interresting= TRUE; + $interresting= FALSE; } else { /* Inspect members... */ foreach ($type['members'] as $grp => $grpdsc){ + /* Some group inside the members that is relevant for us? */ - if (in_array_ics(preg_replace('/^G:/', '', $grp), $this->groups)){ + if (in_array_ics(@LDAP::convert(preg_replace('/^G:/', '', $grp)), $this->groups)){ $interresting= TRUE; } @@ -163,6 +175,11 @@ class userinfo if (preg_replace('/^U:/', '', $grp) == $this->dn){ $interresting= TRUE; } + + /* Wildcard? */ + if (preg_match('/^G:\*/', $grp)){ + $interresting= TRUE; + } } } @@ -173,31 +190,75 @@ class userinfo $this->ACL[$dn][$idx]= $type; } } - } - } + /* Create an array which represenet all relevant permissions settings + per dn. - function get_category_permissions($dn, $category) - { - /* If we are forced to skip ACLs checks for the current user - then return all permissions. - */ - if($this->ignore_acl_for_current_user()){ - return("rwcdm"); - } + The array will look like this: + + . ['ou=base'] ['ou=base'] = array(ACLs); + . + . ['ou=dep1,ou=base']['ou=dep1,ou=base'] = array(ACLs); + . ['ou=base'] = array(ACLs); - /* Get list of objectClasses and get the permissions for it */ - $acl= ""; - if (isset($this->ocMapping[$category])){ - foreach($this->ocMapping[$category] as $oc){ - $acl.= $this->get_permissions($dn, $category."/".$oc); + + For object located in 'ou=dep1,ou=base' we have to both ACLs, + for objects in 'ou=base' we only have to apply on ACL. + */ + $without_self_acl = $all_acl = array(); + foreach($this->ACL as $dn => $acl){ + $sdn =$dn; + $first= TRUE; // Run at least once + while(strpos($dn,",") !== FALSE || $first){ + $first = FALSE; + if(isset($this->ACL[$dn])){ + $all_acl[$sdn][$dn] = $this->ACL[$dn]; + $without_self_acl[$sdn][$dn] = $this->ACL[$dn]; + foreach($without_self_acl[$sdn][$dn] as $acl_id => $acl_set){ + + /* Remember which ACL set has speicial user filter + */ + if(isset($acl_set['filter']{1})){ + $this->ACLperPath_usesFilter[$sdn] = TRUE; + } + + /* Remove all acl entries which are especially for the current user (self acl) + */ + foreach($acl_set['acl'] as $object => $object_acls){ + if(isset($object_acls[0]) && strpos($object_acls[0],"s")){ + unset($without_self_acl[$sdn][$dn][$acl_id]['acl'][$object]); + } + } + } + } + $dn = preg_replace("/^[^,]*+,/","",$dn); } - }else{ - trigger_error("ACL request for an invalid category (".$category.")."); + } + $this->ACLperPath =$without_self_acl; + + /* Append Self entry */ + $dn = $this->dn; + while(strpos($dn,",") && !isset($all_acl[$dn])){ + $dn = preg_replace("/^[^,]*+,/","",$dn); } + if(isset($all_acl[$dn])){ + $this->ACLperPath[$this->dn] = $all_acl[$dn]; + } + } - return ($acl); + + /* Returns an array containing all target objects we've permssions on. + */ + function get_acl_target_objects() + { + return(array_keys($this->ACLperPath)); + } + + + function get_category_permissions($dn, $category, $any_acl = FALSE) + { + return($this->get_permissions($dn,$category.'/0',"")); } @@ -249,12 +310,10 @@ class userinfo if(!is_array($object)){ $object = array($object); } - $r = $w = $c = TRUE; + $r = $w = TRUE; foreach($object as $category){ $w &= preg_match("/w/",$this->has_complete_category_acls($dn, $category)); - $c &= preg_match("/c/",$this->has_complete_category_acls($dn, $category)); $r &= preg_match("/r/",$this->has_complete_category_acls($dn, $category)); -# print_a(array($category => array($r.$w.$c))); } return($r && $w ); } @@ -270,12 +329,9 @@ class userinfo if(!is_array($object)){ $object = array($object); } - $r = $w = $c = TRUE; + $r = TRUE; foreach($object as $category){ - $w &= preg_match("/w/",$this->has_complete_category_acls($dn, $category)); - $c &= preg_match("/c/",$this->has_complete_category_acls($dn, $category)); $r &= preg_match("/r/",$this->has_complete_category_acls($dn, $category)); -# print_a(array($category => array($r.$w.$c))); } return($r) ; } @@ -294,18 +350,60 @@ class userinfo } /* Push cache answer? */ - $ACL_CACHE = &session::get('ACL_CACHE'); + $ACL_CACHE = &session::global_get('ACL_CACHE'); if (isset($ACL_CACHE["$dn+$object+$attribute"])){ - - /* Remove write if needed */ - if ($skip_write){ - $ret = preg_replace('/w/', '', $ACL_CACHE["$dn+$object+$attribute"]); - }else{ - $ret = $ACL_CACHE["$dn+$object+$attribute"]; - } + $ret = $ACL_CACHE["$dn+$object+$attribute"]; + if($skip_write){ + $ret = str_replace(array('w','c','d','m'), '',$ret); + } return($ret); } + /* Check for correct category and class values... */ + if(strpos($object,'/') !== FALSE){ + list($aclCategory, $aclClass) = split("/", $object); + }else{ + $aclCategory = $object; + } + if(!isset($this->ocMapping[$aclCategory])){ + trigger_error("Invalid ACL category '".$aclCategory."'! ({$object})"); + return(""); + }elseif(isset($aclClass) && !in_array($aclClass, $this->ocMapping[$aclCategory])){ + trigger_error("Invalid ACL class '".$aclClass."'! ({$object})"); + return(""); + } + + /* Detect the set of ACLs we have to check for this object + */ + $adn = $dn; + while(!isset($this->ACLperPath[$adn]) && strpos($adn,",") !== FALSE){ + $adn = preg_replace("/^[^,]*+,/","",$adn); + } + if(isset($this->ACLperPath[$adn])){ + $ACL = $this->ACLperPath[$adn]; + }else{ + $ACL_CACHE["$dn+$object+$attribute"] = ""; + return(""); + } + + /* If we do not need to respect any user-filter settings + we can skip the per object ACL checks. + */ + $orig_dn= $dn; + if(!isset($this->ACLperPath_usesFilter[$adn])){ + $dn = $adn; + if (isset($ACL_CACHE["$dn+$object+$attribute"])){ + $ret = $ACL_CACHE["$dn+$object+$attribute"]; + if(!isset($ACL_CACHE["$orig_dn+$object+$attribute"])){ + $ACL_CACHE["$orig_dn+$object+$attribute"] = $ACL_CACHE["$dn+$object+$attribute"]; + } + if($skip_write){ + $ret = str_replace('w','',$ret); + } + return($ret); + } + } + /* Get ldap object, for later filter checks */ $ldap = $this->config->get_ldap_link(); @@ -313,7 +411,7 @@ class userinfo $acl= array("r" => "", "w" => "", "c" => "", "d" => "", "m" => "", "a" => ""); /* Build dn array */ - $path= split(',', $dn); + $path= explode(',', $dn); $path= array_reverse($path); /* Walk along the path to evaluate the acl */ @@ -321,7 +419,7 @@ class userinfo foreach ($path as $element){ /* Clean potential ACLs for each level */ - if(in_array($cpath,$this->config->departments)){ + if(isset($this->config->idepartments[$cpath])){ $acl= $this->cleanACL($acl); } @@ -331,10 +429,10 @@ class userinfo $cpath= $element.','.$cpath; } - if (isset($this->ACL[$cpath])){ + if (isset($ACL[$cpath])){ /* Inspect this ACL, place the result into ACL */ - foreach ($this->ACL[$cpath] as $subacl){ + foreach ($ACL[$cpath] as $subacl){ /* Reset? Just clean the ACL and turn over to the next one... */ if ($subacl['type'] == 'reset'){ @@ -349,14 +447,18 @@ class userinfo /* With user filter */ if (isset($subacl['filter']) && !empty($subacl['filter'])){ - if(!$ldap->object_match_filter($dn,$subacl['filter'])){ + $id = $dn."-".$subacl['filter']; + if(!isset($ACL_CACHE['FILTER'][$id])){ + $ACL_CACHE['FILTER'][$id] = $ldap->object_match_filter($dn,$subacl['filter']); + } + if(!$ACL_CACHE['FILTER'][$id]){ continue; } } /* Self ACLs? */ - if(isset($subacl['acl'][$object][0]) && preg_match("/s/",$subacl['acl'][$object][0]) && $dn != $this->dn){ + if($dn != $this->dn && isset($subacl['acl'][$object][0]) && (strpos($subacl['acl'][$object][0],"s") !== FALSE)){ continue; } @@ -387,6 +489,37 @@ class userinfo $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl']['all'][0]); continue; } + + /* Category ACLs (e.g. $object = "user/0") + */ + if(strstr($object,"/0")){ + $ocs = preg_replace("/\/0$/","",$object); + if(isset($this->ocMapping[$ocs])){ + + /* if $attribute is "", then check every single attribute for this object. + if it is 0, then just check the object category ACL. + */ + if($attribute == ""){ + foreach($this->ocMapping[$ocs] as $oc){ + if (isset($subacl['acl'][$ocs.'/'.$oc])){ + + if($dn != $this->dn && strpos($subacl['acl'][$ocs.'/'.$oc][0],"s") !== FALSE) continue; + + foreach($subacl['acl'][$ocs.'/'.$oc] as $attr => $dummy){ + $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl'][$ocs.'/'.$oc][$attr]); + } + continue; + } + } + }else{ + if(isset($subacl['acl'][$ocs.'/'.$oc][0])){ + if($dn != $this->dn && strpos($subacl['acl'][$ocs.'/'.$oc][0],"s") !== FALSE) continue; + $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl'][$ocs.'/'.$oc][0]); + } + } + } + continue; + } } } } @@ -394,7 +527,7 @@ class userinfo /* If the requested ACL is for a container object, then alter ACLs by applying cleanACL a last time. */ - if(in_array($dn,$this->config->departments)){ + if(isset($this->config->idepartments[$dn])){ $acl = $this->cleanACL($acl); } @@ -407,10 +540,11 @@ class userinfo } $ACL_CACHE["$dn+$object+$attribute"]= $ret; + $ACL_CACHE["$orig_dn+$object+$attribute"]= $ret; /* Remove write if needed */ if ($skip_write){ - $ret= preg_replace('/w/', '', $ret); + $ret = str_replace(array('w','c','d','m'), '',$ret); } return ($ret); } @@ -420,7 +554,6 @@ class userinfo accessible department) */ function get_module_departments($module, $skip_self_acls = FALSE ) { - /* If we are forced to skip ACLs checks for the current user then return all departments as valid. */ @@ -429,132 +562,97 @@ class userinfo } /* Use cached results if possilbe */ - $ACL_CACHE = session::get('ACL_CACHE'); - if(isset($ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)])){ - return($ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)]); + $ACL_CACHE = &session::global_get('ACL_CACHE'); + + if(!is_array($module)){ + $module = array($module); } global $plist; - - $objects= array(); - $deps= array(); - - /* Extract all relevant objects for this module from plist */ - foreach ($plist->info as $object => $info){ - if (!isset($info['plCategory'])){ + $res = array(); + foreach($module as $mod){ + if(isset($ACL_CACHE['MODULE_DEPARTMENTS'][$mod])){ + $res = array_merge($res,$ACL_CACHE['MODULE_DEPARTMENTS'][$mod]); continue; } - foreach ($info['plCategory'] as $idx => $data){ - if (preg_match('/^[0-9]+$/', $idx)){ - if ($data == $module){ - $objects[$object]= $object; - } - } else { - if ($idx == $module){ - $objects[$object]= $object; - } - } - } - } - /* Search for per object ACLs. - */ - $this->config->get_departments(); - $this->config->make_idepartments(); - - foreach($this->ACL as $dn => $infos){ - foreach($infos as $info){ - $found = FALSE; - foreach($info['acl'] as $cat => $data){ - - /* Skip self acls? */ - if($skip_self_acls && isset($data['0']) && strpos($data['0'], "s")) continue; - - if(is_array($module)){ - foreach($module as $mod){ - if(preg_match("/^".normalizePreg($mod)."/",$cat)){ - $found =TRUE; - break; - } - } - }else{ - if(preg_match("/^".normalizePreg($module)."/",$cat)){ + $deps = array(); + + /* Search for per object ACLs */ + foreach($this->ACL as $dn => $infos){ + foreach($infos as $info){ + $found = FALSE; + foreach($info['acl'] as $cat => $data){ + + /* Skip self acls? */ + if($skip_self_acls && isset($data['0']) && (strpos($data['0'], "s") !== FALSE)) continue; + if(preg_match("/^".preg_quote($mod, '/')."/",$cat)){ $found =TRUE; break; } - } - } + } - if($found && !isset($this->config->idepartments[$dn])){ - while(!isset($this->config->idepartments[$dn]) && strpos($dn, ",")){ - $dn = preg_replace("/^[^,]+,/","",$dn); - } - if(isset($this->config->idepartments[$dn])){ - $deps[] = $dn; + if($found && !isset($this->config->idepartments[$dn])){ + while(!isset($this->config->idepartments[$dn]) && strpos($dn, ",")){ + $dn = preg_replace("/^[^,]+,/","",$dn); + } + if(isset($this->config->idepartments[$dn])){ + $deps[$dn] = $dn; + } } } } - } - /* For all gosaDepartments */ - foreach ($this->config->departments as $dn){ - if(!is_array($module)){ - $module = array($module); - } - $acl = ""; - foreach($module as $mod){ + /* For all gosaDepartments */ + foreach ($this->config->departments as $dn){ + if(isset($deps[$dn])) continue; + $acl = ""; if(strpos($mod, '/')){ $acl.= $this->get_permissions($dn,$mod); }else{ - $acl.= $this->get_category_permissions($dn,$mod); + $acl.= $this->get_category_permissions($dn,$mod,TRUE); + } + if(!empty($acl)) { + $deps[$dn] = $dn; } } - if($acl !== "") $deps[] = $dn; + + $ACL_CACHE['MODULE_DEPARTMENTS'][$mod] = $deps; + $res = array_merge($res,$deps); } - - $ACL_CACHE = &session::get('ACL_CACHE'); - $ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)] = $deps; - return ($deps); + + return (array_values($res)); } function mergeACL($acl, $type, $newACL) { + $at= array("psub" => "p", "sub" => "s", "one" => "1"); + if (strpos($newACL, 'w') !== FALSE && strpos($newACL, 'r') === FALSE){ $newACL .= "r"; } + /* Ignore invalid characters */ + $newACL= preg_replace('/[^rwcdm]/', '', $newACL); + foreach(str_split($newACL) as $char){ - /* Ignore invalid characters */ - if (!preg_match('/[rwcdm]/', $char)){ - continue; - } + /* Skip "self" ACLs without combination of rwcdm, they have no effect. + -self flag without read/write/create/... + */ + if(empty($char)) continue; /* Skip permanent and subtree entries */ if (preg_match('/[sp]/', $acl[$char])){ continue; } - switch ($type){ - case 'psub': - $acl[$char]= 'p'; - break; - - case 'sub': - $acl[$char]= 's'; - break; - - case 'one': - $acl[$char]= 1; - break; - - case 'base': - if ($acl[$char] != 1){ - $acl[$char]= 0; - } - break; - } + if ($type == "base" && $acl[$char] != 1) { + $acl[$char]= 0; + } else { + $acl[$char]= $at[$type]; + } } return ($acl); @@ -563,20 +661,25 @@ class userinfo function cleanACL($acl, $reset= FALSE) { - foreach ($acl as &$value){ + foreach ($acl as $key => $value){ + + /* Continue, if value is empty or permanent */ + if ($value == "" || $value == "p") { + continue; + } /* Reset removes everything but 'p' */ if ($reset && $value != 'p'){ - $value= ""; + $acl[$key]= ""; continue; } /* Decrease tree level */ if (is_int($value)){ if ($value){ - $value--; + $acl[$key]--; } else { - $value= ""; + $acl[$key]= ""; } } } @@ -609,7 +712,7 @@ class userinfo /* Skip objectClass '0' (e.g. users/0) get_permissions will ever return '' ?? */ if($oc == "0") continue; $tmp = $this->get_permissions($dn, $category."/".$oc); - for($i = 0 ; $i < strlen($types); $i++) { + for($i = 0, $l= strlen($types); $i < $l; $i++) { if(!preg_match("/".$types[$i]."/",$tmp)){ $acl = preg_replace("/".$types[$i]."/","",$acl); } @@ -633,10 +736,55 @@ class userinfo */ function ignore_acl_for_current_user() { - return($this->config->get_cfg_value("ignoreAcl") == $this->dn); + return($this->ignoreACL); + } + + + function loginAllowed() + { + // Need to check restrictions? + if (count($this->restrictions)){ + + // We have restrictions but cannot check them + if (!isset($_SERVER['REMOTE_ADDR'])){ + return false; + } + + // Move to binary... + $source= $_SERVER['REMOTE_ADDR']; + foreach ($this->restrictions as $restriction) { + + // Single IP + if (preg_match('/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/', $restriction)) { + if ($source == $restriction){ + return true; + } + } + + // Match with short netmask + if (preg_match('/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\/([0-9]+)$/', $restriction, $matches)) { + if (isIpInNet($source, $matches[1], long2ip(~(pow(2, (32-$matches[2]))-1)))) { + return true; + } + } + + // Match with long netmask + if (preg_match('/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\/([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)$/', $restriction, $matches)) { + if (isIpInNet($source, $matches[1], $matches[2])) { + return true; + } + } + + } + + return false; + } + + return true; } } + // vim:tabstop=2:expandtab:shiftwidth=2:filetype=php:syntax:ruler: ?>