mirror of
https://github.com/dducret/kopano-webapp-passwd
synced 2026-08-08 08:23:57 +02:00
Merge d5bbcd4625 into 5934273402
This commit is contained in:
Matthias Fulz
GitHub
commit
47e9e50187
2 changed files with 352 additions and 303 deletions
|
|
@ -23,4 +23,10 @@ define('PLUGIN_PASSWD_LDAP_BIND_PW', "");
|
||||||
/** Set to true if you login with username@tenantname **/
|
/** Set to true if you login with username@tenantname **/
|
||||||
define('PLUGIN_PASSWD_LOGIN_WITH_TENANT', false);
|
define('PLUGIN_PASSWD_LOGIN_WITH_TENANT', false);
|
||||||
|
|
||||||
|
/** Set to user login attribute **/
|
||||||
|
define('PLUGIN_PASSWD_LDAP_USER_LOGIN_ATTR', 'sAMAccountName');
|
||||||
|
|
||||||
|
/** Ldap filter used to search valid users **/
|
||||||
|
define('PLUGIN_PASSWD_LDAP_FILTER', "(objectClass=person)");
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
|
||||||
|
|
@ -3,6 +3,7 @@
|
||||||
* Passwd module.
|
* Passwd module.
|
||||||
* Module that will be used to change passwords of the user
|
* Module that will be used to change passwords of the user
|
||||||
*/
|
*/
|
||||||
|
|
||||||
class PasswdModule extends Module
|
class PasswdModule extends Module
|
||||||
{
|
{
|
||||||
/**
|
/**
|
||||||
|
|
@ -109,12 +110,14 @@ class PasswdModule extends Module
|
||||||
// now bind to the ldap server to search the user dn
|
// now bind to the ldap server to search the user dn
|
||||||
ldap_bind($ldapconn, PLUGIN_PASSWD_LDAP_BIND_DN, PLUGIN_PASSWD_LDAP_BIND_PW);
|
ldap_bind($ldapconn, PLUGIN_PASSWD_LDAP_BIND_DN, PLUGIN_PASSWD_LDAP_BIND_PW);
|
||||||
|
|
||||||
|
// set ldapfilter
|
||||||
|
$ldap_filter = "(&(" . PLUGIN_PASSWD_LDAP_USER_LOGIN_ATTR . "=" . $uid . ")" . PLUGIN_PASSWD_LDAP_FILTER . ")";
|
||||||
|
|
||||||
// search for the user dn that will be used to do login into LDAP
|
// search for the user dn that will be used to do login into LDAP
|
||||||
$userdn = ldap_search (
|
$userdn = ldap_search (
|
||||||
$ldapconn, // connection-identify
|
$ldapconn, // connection-identify
|
||||||
PLUGIN_PASSWD_LDAP_BASEDN, // basedn
|
PLUGIN_PASSWD_LDAP_BASEDN, // basedn
|
||||||
'uid=' . $uid, // search filter
|
$ldap_filter
|
||||||
array('dn', 'objectClass') // needed attributes. we need dn and objectclass
|
|
||||||
);
|
);
|
||||||
|
|
||||||
if ($userdn) {
|
if ($userdn) {
|
||||||
|
|
@ -128,34 +131,13 @@ class PasswdModule extends Module
|
||||||
if(ldap_errno($ldapconn) === 0) {
|
if(ldap_errno($ldapconn) === 0) {
|
||||||
|
|
||||||
$passwd = $data['new_password'];
|
$passwd = $data['new_password'];
|
||||||
|
$oldpass = $data['current_password'];
|
||||||
|
|
||||||
if ($this->checkPasswordStrenth($passwd)) {
|
if ($this->checkPasswordStrenth($passwd)) {
|
||||||
$password_hash = $this->sshaEncode($passwd);
|
$msg = $this->change_password($ldapconn, $userdn, $passwd, $oldpass);
|
||||||
$entry = array('userPassword' => $password_hash);
|
|
||||||
if (in_array('sambaSamAccount', $entries[0]['objectclass'])) {
|
|
||||||
$nthash = strtoupper(bin2hex(mhash(MHASH_MD4, iconv("UTF-8","UTF-16LE", $passwd))));
|
|
||||||
$entry['sambaNTPassword'] = $nthash;
|
|
||||||
$entry['sambaPwdLastSet'] = strval(time());
|
|
||||||
}
|
|
||||||
ldap_modify($ldapconn, $userdn, $entry);
|
|
||||||
if (ldap_errno($ldapconn) === 0) {
|
|
||||||
// password changed successfully
|
|
||||||
|
|
||||||
// write new password to session because we don't want user to re-authenticate
|
if ($msg === "passwordchanged") {
|
||||||
session_start();
|
// password changed successfully
|
||||||
// if user has openssl module installed
|
|
||||||
if(function_exists("openssl_encrypt")) {
|
|
||||||
// In PHP 5.3.3 the iv parameter was added
|
|
||||||
if(version_compare(phpversion(), "5.3.3", "<")) {
|
|
||||||
$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0);
|
|
||||||
} else {
|
|
||||||
$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
$_SESSION['password'] = $passwd;
|
|
||||||
}
|
|
||||||
session_write_close();
|
|
||||||
|
|
||||||
// send feedback to client
|
// send feedback to client
|
||||||
$this->sendFeedback(true, array(
|
$this->sendFeedback(true, array(
|
||||||
|
|
@ -163,8 +145,10 @@ class PasswdModule extends Module
|
||||||
'display_message' => dgettext("plugin_passwd", 'Password is changed successfully.')
|
'display_message' => dgettext("plugin_passwd", 'Password is changed successfully.')
|
||||||
)
|
)
|
||||||
));
|
));
|
||||||
|
WebAppSession::getInstance()->destroy();
|
||||||
|
header("Location: /");
|
||||||
} else {
|
} else {
|
||||||
$errorMessage = dgettext("plugin_passwd", 'Password is not changed.');
|
$errorMessage = dgettext("plugin_passwd", 'Password is not changed. Error: ' . $msg);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
|
$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
|
||||||
|
|
@ -172,7 +156,6 @@ class PasswdModule extends Module
|
||||||
} else {
|
} else {
|
||||||
$errorMessage = dgettext("plugin_passwd", 'Current password does not match.');
|
$errorMessage = dgettext("plugin_passwd", 'Current password does not match.');
|
||||||
}
|
}
|
||||||
|
|
||||||
// release ldap-bind
|
// release ldap-bind
|
||||||
ldap_unbind($ldapconn);
|
ldap_unbind($ldapconn);
|
||||||
}
|
}
|
||||||
|
|
@ -307,5 +290,65 @@ class PasswdModule extends Module
|
||||||
|
|
||||||
return $hash;
|
return $hash;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function make_ad_password($password) {
|
||||||
|
$password = "\"" . $password . "\"";
|
||||||
|
$adpassword = mb_convert_encoding($password, "UTF-16LE", "UTF-8");
|
||||||
|
return $adpassword;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
function change_password( $ldap, $dn, $password, $oldpassword ) {
|
||||||
|
$result = "";
|
||||||
|
$error_code = "";
|
||||||
|
$error_msg = "";
|
||||||
|
$ppolicy_error_code = "";
|
||||||
|
|
||||||
|
$time = time();
|
||||||
|
|
||||||
|
# Transform password value
|
||||||
|
$password = $this->make_ad_password($password);
|
||||||
|
|
||||||
|
# Set password value
|
||||||
|
$userdata["unicodePwd"] = $password;
|
||||||
|
|
||||||
|
# Commit modification on directory
|
||||||
|
|
||||||
|
# The AD password change procedure is modifying the attribute unicodePwd by
|
||||||
|
# first deleting unicodePwd with the old password and them adding it with the
|
||||||
|
# the new password
|
||||||
|
$oldpassword = $this->make_ad_password($oldpassword);
|
||||||
|
|
||||||
|
$modifications = array(
|
||||||
|
array(
|
||||||
|
"attrib" => "unicodePwd",
|
||||||
|
"modtype" => LDAP_MODIFY_BATCH_REMOVE,
|
||||||
|
"values" => array($oldpassword),
|
||||||
|
),
|
||||||
|
array(
|
||||||
|
"attrib" => "unicodePwd",
|
||||||
|
"modtype" => LDAP_MODIFY_BATCH_ADD,
|
||||||
|
"values" => array($password),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
$bmod = ldap_modify_batch($ldap, $dn, $modifications);
|
||||||
|
$error_code = ldap_errno($ldap);
|
||||||
|
$error_msg = ldap_error($ldap);
|
||||||
|
|
||||||
|
if ( !isset($error_code) ) {
|
||||||
|
$result = "ldaperror";
|
||||||
|
} elseif ( $error_code > 0 ) {
|
||||||
|
$result = "passworderror";
|
||||||
|
error_log("LDAP - Modify password error $error_code ($error_msg)");
|
||||||
|
if ( $ppolicy_error_code === 5 ) { $result = "badquality"; }
|
||||||
|
if ( $ppolicy_error_code === 6 ) { $result = "tooshort"; }
|
||||||
|
if ( $ppolicy_error_code === 7 ) { $result = "tooyoung"; }
|
||||||
|
if ( $ppolicy_error_code === 8 ) { $result = "inhistory"; }
|
||||||
|
} else {
|
||||||
|
$result = "passwordchanged";
|
||||||
|
}
|
||||||
|
|
||||||
|
return $result;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
?>
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue