X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=include%2Ffunctions.inc;h=1fdcf1a0b17f6a2ed28d9ff01b338d1cb5f157de;hb=5fb44ad64771094c678181a7e1a4ed0f159b0d5a;hp=7b9ff12f242c79f9bea9644ef4622e1cf2707086;hpb=0d8defdf2f98376403ea76587f91ca0aad5c9062;p=gosa.git
diff --git a/include/functions.inc b/include/functions.inc
index 7b9ff12f2..1fdcf1a0b 100644
--- a/include/functions.inc
+++ b/include/functions.inc
@@ -20,6 +20,7 @@
/* Configuration file location */
define ("CONFIG_DIR", "/etc/gosa");
+define ("CONFIG_FILE", "gosa.conf-trunk");
define ("CONFIG_TEMPLATE_DIR", "../contrib/");
define ("HELP_BASEDIR", "/var/www/doc/");
@@ -55,6 +56,7 @@ define ("DEBUG_SHELL", 8);
define ("DEBUG_POST", 16);
define ("DEBUG_SESSION",32);
define ("DEBUG_CONFIG", 64);
+define ("DEBUG_ACL", 128);
/* Rewrite german 'umlauts' and spanish 'accents'
to get better results */
@@ -291,7 +293,8 @@ function ldap_init ($server, $base, $binddn='', $pass='')
{
global $config;
- $ldap = new LDAP ($binddn, $pass, $server, isset($config->current['RECURSIVE']) && $config->current['RECURSIVE'] == "true",
+ $ldap = new LDAP ($binddn, $pass, $server,
+ isset($config->current['RECURSIVE']) && $config->current['RECURSIVE'] == "true",
isset($config->current['TLS']) && $config->current['TLS'] == "true");
/* Sadly we've no proper return values here. Use the error message instead. */
@@ -582,12 +585,10 @@ function get_lock ($object)
}
-function get_list($filter, $subtreeACL, $base= "", $attributes= array(), $flags= GL_SUBSEARCH)
+function get_list($filter, $category, $base= "", $attributes= array(), $flags= GL_SUBSEARCH)
{
global $config, $ui;
- echo "get_list called. Replace it, it doesn't support new acls";
-
/* Get LDAP link */
$ldap= $config->get_ldap_link($flags & GL_SIZELIMIT);
@@ -598,12 +599,6 @@ function get_list($filter, $subtreeACL, $base= "", $attributes= array(), $flags=
$ldap->cd ($base);
}
- /* Strict filter for administrative units? */
- if ($ui->gosaUnitTag != "" && isset($config->current['STRICT_UNITS']) &&
- preg_match('/TRUE/i', $config->current['STRICT_UNITS'])){
- $filter= "(&(gosaUnitTag=".$ui->gosaUnitTag.")$filter)";
- }
-
/* Perform ONE or SUB scope searches? */
if ($flags & GL_SUBSEARCH) {
$ldap->search ($filter, $attributes);
@@ -619,12 +614,26 @@ function get_list($filter, $subtreeACL, $base= "", $attributes= array(), $flags=
/* Crawl through reslut entries and perform the migration to the
result array */
$result= array();
+
while($attrs = $ldap->fetch()) {
$dn= $ldap->getDN();
- foreach ($subtreeACL as $key => $value){
- if (preg_match("/$key/", $dn)){
+ /* Sort in every value that fits the permissions */
+ if (is_array($category)){
+ foreach ($category as $o){
+ if ($ui->get_category_permissions($dn, $o) != ""){
+ if ($flags & GL_CONVERT){
+ $attrs["dn"]= convert_department_dn($dn);
+ } else {
+ $attrs["dn"]= $dn;
+ }
+ /* We found what we were looking for, break speeds things up */
+ $result[]= $attrs;
+ }
+ }
+ } else {
+ if ($ui->get_category_permissions($dn, $category) != ""){
if ($flags & GL_CONVERT){
$attrs["dn"]= convert_department_dn($dn);
} else {
@@ -633,7 +642,6 @@ function get_list($filter, $subtreeACL, $base= "", $attributes= array(), $flags=
/* We found what we were looking for, break speeds things up */
$result[]= $attrs;
- break;
}
}
}
@@ -730,93 +738,17 @@ function getMenuCache()
}
-function get_permissions ($dn, $subtreeACL)
+function get_permissions ()
{
- global $config;
-echo "get_permissions() - to be removed
";
-
- $base= $config->current['BASE'];
- $tmp= "d,".$dn;
- $sacl= array();
-
- /* Sort subacl's for lenght to simplify matching
- for subtrees */
- foreach ($subtreeACL as $key => $value){
- $sacl[$key]= strlen($key);
- }
- arsort ($sacl);
- reset ($sacl);
-
- /* Successively remove leading parts of the dn's until
- it doesn't contain commas anymore */
- $tmp_dn= preg_replace('/\\\\,/', '', $tmp);
- while (preg_match('/,/', $tmp_dn)){
- $tmp_dn= ltrim(strstr($tmp_dn, ","), ",");
- $tmp= preg_replace('/\/', '\\,', $tmp);
-
- /* Check for acl that may apply */
- foreach ($sacl as $key => $value){
- if (preg_match("/$key$/", $tmp)){
- return ($subtreeACL[$key]);
- }
- }
- }
-
+ /* Look for attribute in ACL */
+ trigger_error("Don't use get_permissions() its obsolete. Use userinfo::get_permissions() instead.");
return array("");
}
-function get_module_permission($acl_array, $module, $dn)
+function get_module_permission()
{
- global $ui;
-echo "get_module_permissions() - to be removed
";
-
- $final= "";
- foreach($acl_array as $acl){
-
- /* Check for selfflag (!) in ACL to determine if
- the user is allowed to change parts of his/her
- own account */
- if (preg_match("/^!/", $acl)){
- if ($dn != "" && $dn != $ui->dn){
-
- /* No match for own DN, give up on this ACL */
- continue;
-
- } else {
-
- /* Matches own DN, remove the selfflag */
- $acl= preg_replace("/^!/", "", $acl);
-
- }
- }
-
- /* Remove leading garbage */
- $acl= preg_replace("/^:/", "", $acl);
-
- /* Discover if we've access to the submodule by comparing
- all allowed submodules specified in the ACL */
- $tmp= split(",", $acl);
- foreach ($tmp as $mod){
- if (preg_match("/^$module#/", $mod)){
- $final= strstr($mod, "#")."#";
- continue;
- }
- if (preg_match("/[^#]$module$/", $mod)){
- return ("#all#");
- }
- if (preg_match("/^all$/", $mod)){
- return ("#all#");
- }
- }
- }
-
- /* Return assembled ACL, or none */
- if ($final != ""){
- return (preg_replace('/##/', '#', $final));
- }
-
- /* Nothing matches - disable access for this object */
+ trigger_error("Don't use get_module_permission() its obsolete.");
return ("#none#");
}
@@ -926,16 +858,11 @@ function get_base_from_people($dn)
}
-function chkacl($acl, $name)
+function chkacl()
{
- echo "chkacl - to be removed
";
/* Look for attribute in ACL */
- if (preg_match("/#$name#/", $acl) || $acl == "#all#"){
- return ("");
- }
-
- /* Optically disable html object for no match */
- return (" disabled ");
+ trigger_error("Don't use chkacl() its obsolete. Use userinfo::getacl() instead.");
+ return("-deprecated-");
}
@@ -979,7 +906,7 @@ function is_uid($uid)
/* STRICT adds spaces and case insenstivity to the uid check.
This is dangerous and should not be used. */
- if (isset($config->current['STRICT']) && preg_match('/^no$/i', $config->current['STRICT'])){
+ if (isset($config->current['STRICT']) && preg_match('/^(no|false)$/i', $config->current['STRICT'])){
return preg_match ("/^[a-z0-9 _.-]+$/i", $uid);
} else {
return preg_match ("/^[a-z0-9_-]+$/", $uid);
@@ -993,6 +920,60 @@ function is_ip($ip)
}
+function is_mac($mac)
+{
+ return preg_match("/^[a-f0-9][a-f0-9]:[a-f0-9][a-f0-9]:[a-f0-9][a-f0-9]:[a-f0-9][a-f0-9]:[a-f0-9][a-f0-9]:[a-f0-9][a-f0-9]$/i", $mac);
+}
+
+
+/* Checks if the given ip address dosen't match
+ "is_ip" because there is also a sub net mask given */
+function is_ip_with_subnetmask($ip)
+{
+ /* Generate list of valid submasks */
+ $res = array();
+ for($e = 0 ; $e <= 32; $e++){
+ $res[$e] = $e;
+ }
+ $i[0] =255;
+ $i[1] =255;
+ $i[2] =255;
+ $i[3] =255;
+ for($a= 3 ; $a >= 0 ; $a --){
+ $c = 1;
+ while($i[$a] > 0 ){
+ $str = $i[0].".".$i[1].".".$i[2].".".$i[3];
+ $res[$str] = $str;
+ $i[$a] -=$c;
+ $c = 2*$c;
+ }
+ }
+ $res["0.0.0.0"] = "0.0.0.0";
+ if(preg_match("/^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.".
+ "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.".
+ "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.".
+ "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/", $ip)){
+ $mask = preg_replace("/^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.".
+ "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.".
+ "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.".
+ "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/","",$ip);
+
+ $mask = preg_replace("/^\//","",$mask);
+ if((in_array("$mask",$res)) && preg_match("/^[0-9\.]/",$mask)){
+ return(TRUE);
+ }
+ }
+ return(FALSE);
+}
+
+/* Simple is domain check, it checks if the given string looks like "string(...).string" */
+function is_domain($str)
+{
+ return(preg_match("/^([a-z0-9i\-]*)\.[a-z0-9]*$/i",$str));
+}
+
+
+
function is_id($id)
{
if ($id == ""){
@@ -1177,45 +1158,11 @@ function to_string ($value)
function get_printer_list($cups_server)
{
global $config;
-
- $res= array();
-
- /* Use CUPS, if we've access to it */
- if (function_exists('cups_get_dest_list')){
- $dest_list= cups_get_dest_list ($cups_server);
-
- foreach ($dest_list as $prt){
- $attr= cups_get_printer_attributes ($cups_server, $prt->name);
-
- foreach ($attr as $prt_info){
- if ($prt_info->name == "printer-info"){
- $info= $prt_info->value;
- break;
- }
- }
- $res[$prt->name]= "$info [$prt->name]";
- }
-
- /* CUPS is not available, try lpstat as a replacement */
- } else {
- $ar = false;
- exec("lpstat -p", $ar);
- foreach($ar as $val){
- @list($dummy, $printer, $rest)= split(' ', $val, 3);
- if (preg_match('/^[^@]+$/', $printer)){
- $res[$printer]= "$printer";
- }
- }
+ $res = array();
+ $data = get_list('(objectClass=gotoPrinter)',"printer",$config->current['BASE'], array('cn'));
+ foreach($data as $attrs ){
+ $res[$attrs['cn'][0]] = $attrs['cn'][0];
}
-
- /* Merge in printers from LDAP */
- $ldap= $config->get_ldap_link();
- $ldap->cd ($config->current['BASE']);
- $ldap->search('(objectClass=gotoPrinter)', array('cn'));
- while ($attrs= $ldap->fetch()){
- $res[$attrs["cn"][0]]= $attrs["cn"][0];
- }
-
return $res;
}
@@ -2122,6 +2069,263 @@ function obj_is_writable($dn, $object, $attribute)
}
+function gosa_ldap_explode_dn($dn,$config = NULL,$verify_in_ldap=false)
+{
+ /* Initialize variables */
+ $ret = array("count" => 0); // Set count to 0
+ $next = true; // if false, then skip next loops and return
+ $cnt = 0; // Current number of loops
+ $max = 100; // Just for security, prevent looops
+ $ldap = NULL; // To check if created result a valid
+ $keep = ""; // save last failed parse string
+
+ /* Check each parsed dn in ldap ? */
+ if($config!=NULL && $verify_in_ldap){
+ $ldap = $config->get_ldap_link();
+ }
+
+ /* Lets start */
+ $called = false;
+ while(preg_match("/,/",$dn) && $next && $cnt < $max){
+
+ $cnt ++;
+ if(!preg_match("/,/",$dn)){
+ $next = false;
+ }
+ $object = preg_replace("/[,].*$/","",$dn);
+ $dn = preg_replace("/^[^,]+,/","",$dn);
+
+ $called = true;
+
+ /* Check if current dn is valid */
+ if($ldap!=NULL){
+ $ldap->cd($dn);
+ $ldap->cat($dn,array("dn"));
+ if($ldap->count()){
+ $ret[] = $keep.$object;
+ $keep = "";
+ }else{
+ $keep .= $object.",";
+ }
+ }else{
+ $ret[] = $keep.$object;
+ $keep = "";
+ }
+ }
+
+ /* No dn was posted */
+ if($cnt == 0 && !empty($dn)){
+ $ret[] = $dn;
+ }
+
+ /* Append the rest */
+ $test = $keep.$dn;
+ if($called && !empty($test)){
+ $ret[] = $keep.$dn;
+ }
+ $ret['count'] = count($ret) - 1;
+
+ return($ret);
+}
+
+function is_php4()
+{
+ if (isset($_SESSION['PHP4COMPATIBLE'])){
+ return true;
+ }
+ return (preg_match('/^4/', phpversion()));
+}
+
+/* Add "str_split" if this function is missing.
+ * This function is only available in PHP5
+ */
+ if(!function_exists("str_split")){
+ function str_split($str,$length =1)
+ {
+ if($length < 1 ) $length =1;
+
+ $ret = array();
+ for($i = 0 ; $i < strlen($str); $i = $i +$length){
+ $ret[] = substr($str,$i ,$length);
+ }
+ return($ret);
+ }
+ }
+
+
+function get_base_from_hook($dn, $attrib)
+{
+ global $config;
+
+ if (isset($config->current['BASE_HOOK'])){
+
+ /* Call hook script - if present */
+ $command= $config->current['BASE_HOOK'];
+
+ if ($command != ""){
+ $command.= " '$dn' $attrib";
+ if (check_command($command)){
+ @DEBUG (DEBUG_SHELL, __LINE__, __FUNCTION__, __FILE__, $command, "Execute");
+ exec($command, $output);
+ if (preg_match("/^[0-9]+$/", $output[0])){
+ return ($output[0]);
+ } else {
+ print_red(_("Warning - base_hook is not available. Using default base."));
+ return ($config->current['UIDBASE']);
+ }
+ } else {
+ print_red(_("Warning - base_hook is not available. Using default base."));
+ return ($config->current['UIDBASE']);
+ }
+
+ } else {
+
+ print_red(_("Warning - no base_hook defined. Using default base."));
+ return ($config->current['UIDBASE']);
+
+ }
+ }
+}
+
+/* Schema validation functions */
+
+function check_schema_version($class, $version)
+{
+ return preg_match("/\(v$version\)/", $class['DESC']);
+}
+
+function check_schema($cfg,$rfc2307bis = FALSE)
+{
+ $messages= array();
+
+ /* Get objectclasses */
+ $ldap = new LDAP($cfg['admin'],$cfg['password'],$cfg['connection'] ,FALSE,$cfg['tls']);
+ $objectclasses = $ldap->get_objectclasses();
+ if(count($objectclasses) == 0){
+ print_red(_("Can't get schema information from server. No schema check possible!"));
+ }
+
+ /* This is the default block used for each entry.
+ * to avoid unset indexes.
+ */
+ $def_check = array("REQUIRED_VERSION" => "0",
+ "SCHEMA_FILES" => array(),
+ "CLASSES_REQUIRED" => array(),
+ "STATUS" => FALSE,
+ "IS_MUST_HAVE" => FALSE,
+ "MSG" => "",
+ "INFO" => "");#_("There is currently no information specified for this schema extension."));
+
+ /* The gosa base schema */
+ $checks['gosaObject'] = $def_check;
+ $checks['gosaObject']['REQUIRED_VERSION'] = "2.4";
+ $checks['gosaObject']['SCHEMA_FILES'] = array("gosa+samba3.schema","gosa.schema");
+ $checks['gosaObject']['CLASSES_REQUIRED'] = array("gosaObject");
+ $checks['gosaObject']['IS_MUST_HAVE'] = TRUE;
+
+ /* GOsa Account class */
+ $checks["gosaAccount"]["REQUIRED_VERSION"]= "2.4";
+ $checks["gosaAccount"]["SCHEMA_FILES"] = array("gosa+samba3.schema","gosa.schema");
+ $checks["gosaAccount"]["CLASSES_REQUIRED"]= array("gosaAccount");
+ $checks["gosaAccount"]["IS_MUST_HAVE"] = TRUE;
+ $checks["gosaAccount"]["INFO"] = _("Used to store account specific informations.");
+
+ /* GOsa lock entry, used to mark currently edited objects as 'in use' */
+ $checks["gosaLockEntry"]["REQUIRED_VERSION"] = "2.4";
+ $checks["gosaLockEntry"]["SCHEMA_FILES"] = array("gosa+samba3.schema","gosa.schema");
+ $checks["gosaLockEntry"]["CLASSES_REQUIRED"] = array("gosaLockEntry");
+ $checks["gosaLockEntry"]["IS_MUST_HAVE"] = TRUE;
+ $checks["gosaLockEntry"]["INFO"] = _("Used to lock currently edited entries to avoid multiple changes at the same time.");
+
+ /* Some other checks */
+ foreach(array(
+ "gosaCacheEntry" => array("version" => "2.4"),
+ "gosaDepartment" => array("version" => "2.4"),
+ "goFaxAccount" => array("version" => "1.0.4", "class" => "gofaxAccount","file" => "gofax.schema"),
+ "goFaxSBlock" => array("version" => "1.0.4", "class" => "gofaxAccount","file" => "gofax.schema"),
+ "goFaxRBlock" => array("version" => "1.0.4", "class" => "gofaxAccount","file" => "gofax.schema"),
+ "gosaUserTemplate" => array("version" => "2.4", "class" => "posixAccount","file" => "nis.schema"),
+ "gosaMailAccount" => array("version" => "2.4", "class" => "mailAccount","file" => "gosa+samba3.schema"),
+ "gosaProxyAccount" => array("version" => "2.4", "class" => "proxyAccount","file" => "gosa+samba3.schema"),
+ "gosaApplication" => array("version" => "2.4", "class" => "appgroup","file" => "gosa.schema"),
+ "gosaApplicationGroup" => array("version" => "2.4", "class" => "appgroup","file" => "gosa.schema"),
+ "GOhard" => array("version" => "2.5", "class" => "terminals","file" => "goto.schema"),
+ "gotoTerminal" => array("version" => "2.5", "class" => "terminals","file" => "goto.schema"),
+ "goServer" => array("version" => "2.4","class" => "server","file" => "goserver.schema"),
+ "goTerminalServer" => array("version" => "2.4", "class" => "terminals","file" => "goto.schema"),
+ "goShareServer" => array("version" => "2.4", "class" => "terminals","file" => "goto.schema"),
+ "goNtpServer" => array("version" => "2.4", "class" => "terminals","file" => "goto.schema"),
+ "goSyslogServer" => array("version" => "2.4", "class" => "terminals","file" => "goto.schema"),
+ "goLdapServer" => array("version" => "2.4"),
+ "goCupsServer" => array("version" => "2.4", "class" => array("posixAccount", "terminals"),),
+ "goImapServer" => array("version" => "2.4", "class" => array("mailAccount", "mailgroup"),"file" => "gosa+samba3. schema"),
+ "goKrbServer" => array("version" => "2.4"),
+ "goFaxServer" => array("version" => "2.4", "class" => "gofaxAccount","file" => "gofax.schema"),
+ ) as $name => $values){
+
+ $checks[$name] = $def_check;
+ if(isset($values['version'])){
+ $checks[$name]["REQUIRED_VERSION"] = $values['version'];
+ }
+ if(isset($values['file'])){
+ $checks[$name]["SCHEMA_FILES"] = array($values['file']);
+ }
+ $checks[$name]["CLASSES_REQUIRED"] = array($name);
+ }
+ foreach($checks as $name => $value){
+ foreach($value['CLASSES_REQUIRED'] as $class){
+
+ if(!isset($objectclasses[$name])){
+ $checks[$name]['STATUS'] = FALSE;
+ if($value['IS_MUST_HAVE']){
+ $checks[$name]['MSG'] = sprintf(_("The required objectClass '%s' is not present in your schema setup"),$class);
+ }else{
+ $checks[$name]['MSG'] = sprintf(_("The optional objectClass '%s' is not present in your schema setup"),$class);
+ }
+ }elseif(!check_schema_version($objectclasses[$name],$value['REQUIRED_VERSION'])){
+ $checks[$name]['STATUS'] = FALSE;
+
+ if($value['IS_MUST_HAVE']){
+ $checks[$name]['MSG'] = sprintf(_("The required objectclass '%s' does not have version %s"), $class, $value['REQUIRED_VERSION']);
+ }else{
+ $checks[$name]['MSG'] = sprintf(_("The optional objectclass '%s' does not have version %s"), $class, $value['REQUIRED_VERSION']);
+ }
+ }else{
+ $checks[$name]['STATUS'] = TRUE;
+ $checks[$name]['MSG'] = sprintf(_("Class(es) available"));
+ }
+ }
+ }
+
+ $tmp = $objectclasses;
+
+ /* The gosa base schema */
+ $checks['posixGroup'] = $def_check;
+ $checks['posixGroup']['REQUIRED_VERSION'] = "2.4";
+ $checks['posixGroup']['SCHEMA_FILES'] = array("gosa+samba3.schema","gosa.schema");
+ $checks['posixGroup']['CLASSES_REQUIRED'] = array("posixGroup");
+ $checks['posixGroup']['STATUS'] = TRUE;
+ $checks['posixGroup']['IS_MUST_HAVE'] = TRUE;
+ $checks['posixGroup']['MSG'] = "";
+ $checks['posixGroup']['INFO'] = "";
+
+ /* Depending on selected rfc2307bis mode, we need different schema configurations */
+ if(isset($tmp['posixGroup'])){
+
+ if($rfc2307bis && isset($tmp['posixGroup']['STRUCTURAL'])){
+ $checks['posixGroup']['STATUS'] = FALSE;
+ $checks['posixGroup']['MSG'] = _("You have enabled the rfc2307bis option on the 'ldap setup' step, but your schema configuration do not support this option.");
+ $checks['posixGroup']['INFO'] = _("In order to use rfc2307bis conform groups the objectClass 'posixGroup' must be AUXILIARY");
+ }
+ if(!$rfc2307bis && !isset($tmp['posixGroup']['STRUCTURAL'])){
+ $checks['posixGroup']['STATUS'] = FALSE;
+ $checks['posixGroup']['MSG'] = _("You have disabled the rfc2307bis option on the 'ldap setup' step, but your schema configuration do not support this option.");
+ $checks['posixGroup']['INFO'] = _("The objectClass 'posixGroup' must be STRUCTURAL");
+ }
+ }
+
+ return($checks);
+}
// vim:tabstop=2:expandtab:shiftwidth=2:filetype=php:syntax:ruler:
?>