Fixed ACL handling

git-svn-id: https://oss.gonicus.de/repositories/gosa/branches/2.6@16342 594d385d-05f5-0310-b6e9-bd551577e9d8

diff --git a/gosa-plugins/systems/admin/systems/class_filterSYSTEMS.inc b/gosa-plugins/systems/admin/systems/class_filterSYSTEMS.inc
index 178dee31c591f033879e311621bd46d3a42e52e3..945e845a561181a158d2d315db660436a7ebd57d 100644 (file)
--- a/gosa-plugins/systems/admin/systems/class_filterSYSTEMS.inc
+++ b/gosa-plugins/systems/admin/systems/class_filterSYSTEMS.inc
@@ -2,7 +2,7 @@
 
 class filterSYSTEMS {
 
-  static function query($parent,$base, $scope, $filter, $attributes, $category, $objectStorage= "")
+  static function query($parent,$base, $scope, $filter, $attributes, $category, $objectStorage= array())
   {
     $ui = get_userinfo();
     global $config;
@@ -10,7 +10,11 @@ class filterSYSTEMS {
     // Check whether the arp handling active or not
     $arp_handling_active = ($config->search("ArpNewDevice","CLASS",array('tabs')) != "");
 
-    $entries = filterLDAP::query($parent,$base, $scope, $filter, $attributes, $category, $objectStorage);
+    $config= session::global_get('config');
+    $ldap= $config->get_ldap_link(TRUE);
+    $flag= ($scope == "sub")?GL_SUBSEARCH:0;
+    $entries = filterSYSTEMS::get_list($parent,$base, $filter, $attributes, $category, $objectStorage, $flag | GL_SIZELIMIT);
+
     foreach($entries as $key => $entry){
       if(preg_match("/".preg_quote(get_ou('systemIncomingRDN'),'/')."/i", $entry['dn'])){
 
@@ -31,11 +35,11 @@ class filterSYSTEMS {
           $entries[$key]['cn'][0].= " <i>("._("New device").")</i>";
         }
 
-      // Detect SAMBA machines
+        // Detect SAMBA machines
       }elseif(in_array('sambaSamAccount', $entry['objectClass']) && preg_match("/\$$/", $entry['cn'][0])){
         $entries[$key]['objectClass'][] = 'FAKE_OC_winstation';
 
-      // Detect Workstation & templates
+        // Detect Workstation & templates
       }elseif(in_array('gotoWorkstation', $entry['objectClass'])){
         if(!isset($entry['macAddress'][0]) || $entry['macAddress'][0] == "-"){
           continue; // We do not need templates anymore, we've ogroups now.
@@ -46,7 +50,7 @@ class filterSYSTEMS {
           $entries[$key]['objectClass'][] = 'FAKE_OC_PWD_changeAble';
         }
 
-      // Detect Terminal & templates
+        // Detect Terminal & templates
       }elseif(in_array('gotoTerminal', $entry['objectClass'])){
         if(!isset($entry['macAddress'][0]) || $entry['macAddress'][0] == "-"){
           continue; // We do not need templates anymore, we've ogroups now.
@@ -57,7 +61,7 @@ class filterSYSTEMS {
           $entries[$key]['objectClass'][] = 'FAKE_OC_PWD_changeAble';
         }
 
-      // Detect Server & templates
+        // Detect Server & templates
       }elseif(in_array('goServer', $entry['objectClass'])){
         if(!isset($entry['macAddress'][0]) || $entry['macAddress'][0] == "-"){
           continue; // We do not need templates anymore, we've ogroups now.
@@ -68,7 +72,7 @@ class filterSYSTEMS {
           $entries[$key]['objectClass'][] = 'FAKE_OC_PWD_changeAble';
         }
 
-      // Detect ieee802Device
+        // Detect ieee802Device
       }elseif(in_array('ieee802Device', $entry['objectClass'])){
         $pwd_acl = $ui->get_permissions($entry['dn'],'component/componentGeneric','userPassword');
         if(preg_match("/w/",$pwd_acl)){
@@ -142,6 +146,123 @@ class filterSYSTEMS {
     }
     return($entries);
   }
+
+
+  static function get_list($parent,$base, $filter, $attributes, $category, $objectStorage, $flags= GL_SUBSEARCH)
+  {
+    $ui= session::global_get('ui');
+    $config= session::global_get('config');
+
+    // Move to arrays for category and objectStorage
+    if (!is_array($category)) {
+      $category= array($category);
+    }
+
+    // Store in base - i.e. is a rdn value empty?
+    $storeOnBase= count($objectStorage) == 1 && empty($objectStorage[0]);
+
+    $method= ($storeOnBase && !($flags & GL_SUBSEARCH))?"ls":"search";
+
+    // Initialize search bases
+    $bases= array();
+
+    // Get list of sub bases to search on
+    if ($storeOnBase) {
+      $bases[$base]= "";
+    } else {
+      foreach ($objectStorage as $oc) {
+        $oc= preg_replace('/,$/', '', $oc);
+        $tmp= explode(',', $oc);
+        if (count($tmp) == 1) {
+          preg_match('/([^=]+)=(.*)$/', $oc, $m);
+          if ($flags & GL_SUBSEARCH) {
+            $bases[$base][]= $m[1].":dn:=".$m[2];
+          } else {
+            $bases["$oc,$base"][]= $m[1].":dn:=".$m[2];
+          }
+        } else {
+          // No, there's no \, in pre defined RDN values
+          preg_match('/^([^,]+),(.*)$/', $oc, $matches);
+          preg_match('/([^=]+)=(.*)$/', $matches[1], $m);
+          if ($flags & GL_SUBSEARCH) {
+            $bases[$base][]= $m[1].":dn:=".$m[2];
+          } else {
+            $bases[$matches[2].",$base"][]= $m[1].":dn:=".$m[2];
+          }
+        }
+      }
+    }
+    // Get LDAP link
+    $ldap= $config->get_ldap_link($flags & GL_SIZELIMIT);
+
+    // Do search for every base
+    $result= array();
+    $limit_exceeded = FALSE;
+    foreach($bases as $base => $dnFilters) {
+
+      // Break if the size limit is exceeded
+      if($limit_exceeded){
+        return($result);
+      }
+
+      // Switch to new base and search
+      if (is_array($dnFilters)){
+        $dnFilter= "(|";
+        foreach ($dnFilters as $df) {
+          $dnFilter.= "($df)";
+        }
+        $dnFilter.= ")";
+      } else {
+        $dnFilter= "";
+      }
+      $ldap->cd($base);
+      if ($method == "ls") {
+        $ldap->ls("(&$filter$dnFilter)", $base, $attributes);
+      } else {
+        $ldap->search("(&$filter$dnFilter)", $attributes);
+      }
+
+      // Check for size limit exceeded messages for GUI feedback
+      if (preg_match("/size limit/i", $ldap->get_error())){
+        session::set('limit_exceeded', TRUE);
+        $limit_exceeded = TRUE;
+      }
+
+      /* Crawl through result entries and perform the migration to the
+         result array */
+      while($attrs = $ldap->fetch()) {
+        $dn= $ldap->getDN();
+
+        /* Convert dn into a printable format */
+        if ($flags & GL_CONVERT){
+          $attrs["dn"]= convert_department_dn($dn);
+        } else {
+          $attrs["dn"]= $dn;
+        }
+
+        /* Skip ACL checks if we are forced to skip those checks */
+        if($flags & GL_NO_ACL_CHECK){
+          $result[]= $attrs;
+        }else{
+
+          if(preg_match("/".preg_quote(get_ou('systemIncomingRDN'),'/')."/i",$dn)){
+            $attrs['objectClass'][] = "gotoTerminal";
+          }
+          $obj = $parent->headpage->getObjectType($parent->headpage->objectTypes, $attrs['objectClass']);
+
+          if(isset($obj['category'])){
+            $o = $obj['category']."/".$obj['class'];
+            if(preg_match("/r/",$ui->get_permissions($dn,$o))){
+              $result[]= $attrs;
+            }
+          }
+        }
+      }
+
+    }
+
+    return $result;
+  }
 }
 
 ?>