LDAP bugfixes, allow non anonymous binds and ssl/tls

config.php

@@ -9,7 +9,16 @@ define('PLUGIN_PASSWD_LDAP', false);
 define('PLUGIN_PASSWD_LDAP_BASEDN', 'dc=example,dc=com');
 
 /** URI to access LDAP server **/
-define('PLUGIN_PASSWD_LDAP_URI', 'localhost');
+define('PLUGIN_PASSWD_LDAP_URI', 'ldap://localhost');
+
+/** Use TLS to access LDAP server **/
+define('PLUGIN_PASSWD_LDAP_USE_TLS', true);
+
+/** Bind DN to access LDAP server (keep empty for anonymous bind) **/
+define('PLUGIN_PASSWD_LDAP_BIND_DN', "");
+
+/** Bind password to access LDAP server (keep empty for anonymous bind) **/
+define('PLUGIN_PASSWD_LDAP_BIND_PW', "");
 
 /** Set to true if you login with username@tenantname **/
 define('PLUGIN_PASSWD_LOGIN_WITH_TENANT', false);

php/class.passwdmodule.php

@@ -97,6 +97,18 @@ class PasswdModule extends Module
 				$uid = $data['username'];
 			}
 
+			// check if we should use tls!
+			if(strrpos(PLUGIN_PASSWD_LDAP_URI, "ldaps://", -strlen(PLUGIN_PASSWD_LDAP_URI)) === FALSE && PLUGIN_PASSWD_LDAP_USE_TLS === true) {
+				ldap_start_tls($ldapconn);
+			}
+
+			// set connection parametes
+			ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
+			ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
+
+			// now bind to the ldap server to search the user dn
+			ldap_bind($ldapconn, PLUGIN_PASSWD_LDAP_BIND_DN, PLUGIN_PASSWD_LDAP_BIND_PW);
+
 			// search for the user dn that will be used to do login into LDAP
 			$userdn = ldap_search (
 				$ldapconn,						// connection-identify
@@ -110,25 +122,34 @@ class PasswdModule extends Module
 				$userdn = $userdn[0]['dn'];
 
 				// bind to ldap directory
-				ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
-
 				// login with current password if that fails then current password is wrong
-				$bind = ldap_bind($ldapconn, $userdn, $data['current_password']);
+				ldap_bind($ldapconn, $userdn, $data['current_password']);
 
 				if(ldap_errno($ldapconn) === 0) {
-					$passwd = $data['new_password'];
-					$passwdRepeat = $data['new_password_repeat'];
 
-					if($this->checkPasswordStrenth($passwd)) {
+					$passwd = $data['new_password'];
+
+					if ($this->checkPasswordStrenth($passwd)) {
 						$password_hash = $this->sshaEncode($passwd);
 						$entry = array('userPassword' => $password_hash);
-						$return_mod = ldap_modify($ldapconn, $userdn, $entry);
+						ldap_modify($ldapconn, $userdn, $entry);
 						if (ldap_errno($ldapconn) === 0) {
 							// password changed successfully
 
 							// write new password to session because we don't want user to re-authenticate
 							session_start();
+							// if user has openssl module installed
+							if(function_exists("openssl_encrypt")) {
+								// In PHP 5.3.3 the iv parameter was added
+								if(version_compare(phpversion(), "5.3.3", "<")) {
+									$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0);
+								} else {
+									$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV);
+								}
+							}
+							else {
 								$_SESSION['password'] = $passwd;
+							}
 							session_write_close();
 
 							// send feedback to client
@@ -172,9 +193,24 @@ class PasswdModule extends Module
 	{
 		$errorMessage = '';
 		$passwd = $data['new_password'];
-		$passwdRepeat = $data['new_password_repeat'];
 
-		if($this->checkPasswordStrenth($passwd)) {
+		// get current session password
+		$sessionPass = $_SESSION['password'];
+		// if user has openssl module installed
+		if (function_exists("openssl_decrypt")) {
+			if (version_compare(phpversion(), "5.3.3", "<")) {
+				$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0);
+			} else {
+				$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0, PASSWORD_IV);
+			}
+
+			if (!$sessionPass) {
+				$sessionPass = $_SESSION['password'];
+			}
+		}
+
+		if($data['current_password'] === $sessionPass) {
+			if ($this->checkPasswordStrenth($passwd)) {
 				// all information correct, change password
 				$store = $GLOBALS['mapisession']->getDefaultMessageStore();
 				$userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
@@ -184,7 +220,17 @@ class PasswdModule extends Module
 
 					// write new password to session because we don't want user to re-authenticate
 					session_start();
+					// if user has openssl module installed
+					if (function_exists("openssl_encrypt")) {
+						// In PHP 5.3.3 the iv parameter was added
+						if (version_compare(phpversion(), "5.3.3", "<")) {
+							$_SESSION['password'] = openssl_encrypt($passwd, "des-ede3-cbc", PASSWORD_KEY, 0);
+						} else {
+							$_SESSION['password'] = openssl_encrypt($passwd, "des-ede3-cbc", PASSWORD_KEY, 0, PASSWORD_IV);
+						}
+					} else {
 						$_SESSION['password'] = $passwd;
+					}
 					session_write_close();
 
 					// send feedback to client
@@ -199,6 +245,9 @@ class PasswdModule extends Module
 			} else {
 				$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
 			}
+		} else {
+			$errorMessage = dgettext("plugin_passwd", 'Current password does not match.');
+		}
 
 		if(!empty($errorMessage)) {
 			$this->sendFeedback(false, array(
@@ -222,7 +271,6 @@ class PasswdModule extends Module
 	 */
 	public function checkPasswordStrenth($password)
 	{
-		// @FIXME should be moved to client side
 		if (preg_match("#.*^(?=.{8,20})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9]).*$#", $password)) {
 			return true;
 		} else {