ston1th/kopano-webapp-passwd
1
0
Fork 0
mirror of https://github.com/dducret/kopano-webapp-passwd synced 2026-07-27 10:32:26 +02:00
Code Releases Activity

LDAP bugfixes, allow non anonymous binds and ssl/tls

Browse source
This commit is contained in:
Christoph Haas 2015-05-20 01:34:29 +02:00
commit ceebc4174e
2 changed files with 90 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
config.php
View file

@ -9,7 +9,16 @@ define('PLUGIN_PASSWD_LDAP', false);
define('PLUGIN_PASSWD_LDAP_BASEDN', 'dc=example,dc=com');
/** URI to access LDAP server **/
define('PLUGIN_PASSWD_LDAP_URI', 'localhost');
define('PLUGIN_PASSWD_LDAP_URI', 'ldap://localhost');
/** Use TLS to access LDAP server **/
define('PLUGIN_PASSWD_LDAP_USE_TLS', true);
/** Bind DN to access LDAP server (keep empty for anonymous bind) **/
define('PLUGIN_PASSWD_LDAP_BIND_DN', "");
/** Bind password to access LDAP server (keep empty for anonymous bind) **/
define('PLUGIN_PASSWD_LDAP_BIND_PW', "");
/** Set to true if you login with username@tenantname **/
define('PLUGIN_PASSWD_LOGIN_WITH_TENANT', false);

112
php/class.passwdmodule.php
View file

@ -97,11 +97,23 @@ class PasswdModule extends Module
$uid = $data['username'];
}
// check if we should use tls!
if(strrpos(PLUGIN_PASSWD_LDAP_URI, "ldaps://", -strlen(PLUGIN_PASSWD_LDAP_URI)) === FALSE && PLUGIN_PASSWD_LDAP_USE_TLS === true) {
ldap_start_tls($ldapconn);
}
// set connection parametes
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
// now bind to the ldap server to search the user dn
ldap_bind($ldapconn, PLUGIN_PASSWD_LDAP_BIND_DN, PLUGIN_PASSWD_LDAP_BIND_PW);
// search for the user dn that will be used to do login into LDAP
$userdn = ldap_search (
$ldapconn, // connection-identify
PLUGIN_PASSWD_LDAP_BASEDN, // basedn
'uid=' . $uid, // search filter
'uid=' . $uid, // search filter
array('dn') // needed attributes. we need the dn
);
@ -110,25 +122,34 @@ class PasswdModule extends Module
$userdn = $userdn[0]['dn'];
// bind to ldap directory
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
// login with current password if that fails then current password is wrong
$bind = ldap_bind($ldapconn, $userdn, $data['current_password']);
ldap_bind($ldapconn, $userdn, $data['current_password']);
if(ldap_errno($ldapconn) === 0) {
$passwd = $data['new_password'];
$passwdRepeat = $data['new_password_repeat'];
if($this->checkPasswordStrenth($passwd)) {
$passwd = $data['new_password'];
if ($this->checkPasswordStrenth($passwd)) {
$password_hash = $this->sshaEncode($passwd);
$entry = array('userPassword' => $password_hash);
$return_mod = ldap_modify($ldapconn, $userdn, $entry);
ldap_modify($ldapconn, $userdn, $entry);
if (ldap_errno($ldapconn) === 0) {
// password changed successfully
// write new password to session because we don't want user to re-authenticate
session_start();
$_SESSION['password'] = $passwd;
// if user has openssl module installed
if(function_exists("openssl_encrypt")) {
// In PHP 5.3.3 the iv parameter was added
if(version_compare(phpversion(), "5.3.3", "<")) {
$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0);
} else {
$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV);
}
}
else {
$_SESSION['password'] = $passwd;
}
session_write_close();
// send feedback to client
@ -172,32 +193,60 @@ class PasswdModule extends Module
{
$errorMessage = '';
$passwd = $data['new_password'];
$passwdRepeat = $data['new_password_repeat'];
if($this->checkPasswordStrenth($passwd)) {
// all information correct, change password
$store = $GLOBALS['mapisession']->getDefaultMessageStore();
$userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) {
// password changed successfully
// write new password to session because we don't want user to re-authenticate
session_start();
$_SESSION['password'] = $passwd;
session_write_close();
// send feedback to client
$this->sendFeedback(true, array(
'info' => array(
'display_message' => dgettext("plugin_passwd", 'Password is changed successfully.')
)
));
// get current session password
$sessionPass = $_SESSION['password'];
// if user has openssl module installed
if (function_exists("openssl_decrypt")) {
if (version_compare(phpversion(), "5.3.3", "<")) {
$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0);
} else {
$errorMessage = dgettext("plugin_passwd", 'Password is not changed.');
$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0, PASSWORD_IV);
}
if (!$sessionPass) {
$sessionPass = $_SESSION['password'];
}
}
if($data['current_password'] === $sessionPass) {
if ($this->checkPasswordStrenth($passwd)) {
// all information correct, change password
$store = $GLOBALS['mapisession']->getDefaultMessageStore();
$userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) {
// password changed successfully
// write new password to session because we don't want user to re-authenticate
session_start();
// if user has openssl module installed
if (function_exists("openssl_encrypt")) {
// In PHP 5.3.3 the iv parameter was added
if (version_compare(phpversion(), "5.3.3", "<")) {
$_SESSION['password'] = openssl_encrypt($passwd, "des-ede3-cbc", PASSWORD_KEY, 0);
} else {
$_SESSION['password'] = openssl_encrypt($passwd, "des-ede3-cbc", PASSWORD_KEY, 0, PASSWORD_IV);
}
} else {
$_SESSION['password'] = $passwd;
}
session_write_close();
// send feedback to client
$this->sendFeedback(true, array(
'info' => array(
'display_message' => dgettext("plugin_passwd", 'Password is changed successfully.')
)
));
} else {
$errorMessage = dgettext("plugin_passwd", 'Password is not changed.');
}
} else {
$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
}
} else {
$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
$errorMessage = dgettext("plugin_passwd", 'Current password does not match.');
}
if(!empty($errorMessage)) {
@ -222,7 +271,6 @@ class PasswdModule extends Module
*/
public function checkPasswordStrenth($password)
{
// @FIXME should be moved to client side
if (preg_match("#.*^(?=.{8,20})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9]).*$#", $password)) {
return true;
} else {