r107409 MediaWiki - Code Review archive

Repository:	MediaWiki
Revision:	< r107408‎ \| r107409 \| r107410 >
Date:	20:03, 27 December 2011
Author:	laner
Status:	resolved (Comments)
Tags:
Comment:	* Removed deprecated features Old style preference retrieval has been removed Old style group based restrictions have been removed * Removed unused features ** The username synching was never used, as support wasn't added to core for it, so it's been removed * Debug message clean up. Removed redundant messages, clarified other messages * Added wrapper functions for all ldap_* functions used; did this to remove usage of @ldap_* in a cleaner way
Modified paths:	/trunk/extensions/LdapAuthentication/LdapAuthentication.php (modified) (history) /trunk/extensions/LdapAuthentication/LdapAutoAuthentication.php (modified) (history)

Diff [purge]

Index: trunk/extensions/LdapAuthentication/LdapAutoAuthentication.php
—	—	@@ -26,6 +26,7 @@
27	27
28	28	$autoauthname = $wgAuth->getConf( 'AutoAuthUsername' );
29	29	$wgAuth->printDebug( "Calling authenticate with username ($autoauthname).", NONSENSITIVE );
	30	+
30	31	// The user hasn't already been authenticated, let's check them
31	32	$authenticated = $wgAuth->authenticate( $autoauthname );
32	33	if ( !$authenticated ) {
—	—	@@ -35,7 +36,7 @@
36	37	return false;
37	38	}
38	39
39		~~- // We need the username that MediaWiki will always use, not the one we~~
	40	+ // We need the username that MediaWiki will always use, not necessarily the one we
40	41	// get from LDAP.
41	42	$mungedUsername = $wgAuth->getCanonicalName( $autoauthname );
42	43
—	—	@@ -111,4 +112,5 @@
112	113
113	114	return true;
114	115	}
	116	+
115	117	}
Index: trunk/extensions/LdapAuthentication/LdapAuthentication.php
—	—	@@ -61,11 +61,9 @@
62	62	$wgLDAPUpdateLDAP = array();
63	63	$wgLDAPPasswordHash = array();
64	64	$wgLDAPMailPassword = array();
65		~~-$wgLDAPRetrievePrefs = array();~~
66	65	$wgLDAPPreferences = array();
67	66	$wgLDAPDisableAutoCreate = array();
68	67	$wgLDAPDebug = 0;
69		~~-$wgLDAPGroupDN = ""; //Deprecated~~
70	68	$wgLDAPGroupUseFullDN = array();
71	69	$wgLDAPLowerCaseUsername = array();
72	70	$wgLDAPLowerCaseUsernameScheme = array();
—	—	@@ -83,9 +81,6 @@
84	82	$wgLDAPAuthAttribute = array();
85	83	$wgLDAPAutoAuthUsername = "";
86	84	$wgLDAPAutoAuthDomain = "";
87		~~-$wgLDAPUniqueAttribute = array(); //Currently unused~~
88		~~-$wgLDAPUniqueBlockLogin = array(); //Currently unused~~
89		~~-$wgLDAPUniqueRenameUser = array(); //Currently unused~~
90	85	$wgPasswordResetRoutes['domain'] = true;
91	86
92	87	define( "LDAPAUTHVERSION", "2.0a" );
—	—	@@ -115,7 +110,7 @@
116	111	define( "SENSITIVE", 2 );
117	112	define( "HIGHLYSENSITIVE", 3 );
118	113
119		~~-class LdapAuthenticationPlugin extends AuthPlugin {~~
	114	+class LdapAuthenticationextends AuthPlugin {
120	115
121	116	// ldap connection resource
122	117	var $ldapconn;
—	—	@@ -145,6 +140,185 @@
146	141	// the user we are currently bound as
147	142	var $boundAs;
148	143
	144	+ /**
	145	+ * Wrapper for ldap_connect
	146	+ */
	147	+ public static function ldap_connect( $hostname=null, $port=389 ) {
	148	+ wfSuppressWarnings();
	149	+ $ret = ldap_connect( $hostname, $port );
	150	+ wfRestoreWarnings();
	151	+ return $ret;
	152	+ }
	153	+
	154	+ /**
	155	+ * Wrapper for ldap_bind
	156	+ */
	157	+ public static function ldap_bind( $ldapconn, $dn=null, $password=null ) {
	158	+ wfSuppressWarnings();
	159	+ $ret = ldap_bind( $ldapconn, $dn, $password );
	160	+ wfRestoreWarnings();
	161	+ return $ret;
	162	+ }
	163	+
	164	+ /**
	165	+ * Wrapper for ldap_unbind
	166	+ */
	167	+ public static function ldap_unbind( $ldapconn ) {
	168	+ if ( $ldapconn ) {
	169	+ wfSuppressWarnings();
	170	+ $ret = ldap_unbind( $ldapconn );
	171	+ wfRestoreWarnings();
	172	+ } else {
	173	+ $ret = false;
	174	+ }
	175	+ return $ret;
	176	+ }
	177	+
	178	+ /**
	179	+ * Wrapper for ldap_modify
	180	+ */
	181	+ public static function ldap_modify( $ldapconn, $dn, $entry ) {
	182	+ wfSuppressWarnings();
	183	+ $ret = ldap_modify( $ldapconn, $dn, $entry );
	184	+ wfRestoreWarnings();
	185	+ return $ret;
	186	+ }
	187	+
	188	+ /**
	189	+ * Wrapper for ldap_add
	190	+ */
	191	+ public static function ldap_add( $ldapconn, $dn, $entry ) {
	192	+ wfSuppressWarnings();
	193	+ $ret = ldap_add( $ldapconn, $dn, $entry );
	194	+ wfRestoreWarnings();
	195	+ return $ret;
	196	+ }
	197	+
	198	+ /**
	199	+ * Wrapper for ldap_delete
	200	+ */
	201	+ public static function ldap_delete( $ldapconn, $dn ) {
	202	+ wfSuppressWarnings();
	203	+ $ret = ldap_delete( $ldapconn, $dn );
	204	+ wfRestoreWarnings();
	205	+ return $ret;
	206	+ }
	207	+
	208	+ /**
	209	+ * Wrapper for ldap_search
	210	+ */
	211	+ public static function ldap_search( $ldapconn, $basedn, $filter, $attributes=null, $attrsonly=null, $sizelimit=null, $timelimit=null, $deref=null ) {
	212	+ wfSuppressWarnings();
	213	+ if ( $attributes ) {
	214	+ if ( $attrsonly ) {
	215	+ if ( $sizelimit ) {
	216	+ if ( $timelimit ) {
	217	+ if ( $deref ) {
	218	+ $ret = ldap_search( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit, $deref );
	219	+ } else {
	220	+ $ret = ldap_search( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit );
	221	+ }
	222	+ } else {
	223	+ $ret = ldap_search( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit );
	224	+ }
	225	+ } else {
	226	+ $ret = ldap_search( $ldapconn, $basedn, $filter, $attributes, $attrsonly );
	227	+ }
	228	+ } else {
	229	+ $ret = ldap_search( $ldapconn, $basedn, $filter, $attributes );
	230	+ }
	231	+ } else {
	232	+ $ret = ldap_search( $ldapconn, $basedn, $filter );
	233	+ }
	234	+ wfRestoreWarnings();
	235	+ return $ret;
	236	+ }
	237	+
	238	+ /**
	239	+ * Wrapper for ldap_read
	240	+ */
	241	+ public static function ldap_read( $ldapconn, $basedn, $filter, $attributes=null, $attrsonly=null, $sizelimit=null, $timelimit=null, $deref=null ) {
	242	+ wfSuppressWarnings();
	243	+ if ( $attributes ) {
	244	+ if ( $attrsonly ) {
	245	+ if ( $sizelimit ) {
	246	+ if ( $timelimit ) {
	247	+ if ( $deref ) {
	248	+ $ret = ldap_read( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit, $deref );
	249	+ } else {
	250	+ $ret = ldap_read( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit );
	251	+ }
	252	+ } else {
	253	+ $ret = ldap_read( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit );
	254	+ }
	255	+ } else {
	256	+ $ret = ldap_read( $ldapconn, $basedn, $filter, $attributes, $attrsonly );
	257	+ }
	258	+ } else {
	259	+ $ret = ldap_read( $ldapconn, $basedn, $filter, $attributes );
	260	+ }
	261	+ } else {
	262	+ $ret = ldap_read( $ldapconn, $basedn, $filter );
	263	+ }
	264	+ wfRestoreWarnings();
	265	+ return $ret;
	266	+ }
	267	+
	268	+ /**
	269	+ * Wrapper for ldap_list
	270	+ */
	271	+ public static function ldap_list( $ldapconn, $basedn, $filter, $attributes=null, $attrsonly=null, $sizelimit=null, $timelimit=null, $deref=null ) {
	272	+ wfSuppressWarnings();
	273	+ if ( $attributes ) {
	274	+ if ( $attrsonly ) {
	275	+ if ( $sizelimit ) {
	276	+ if ( $timelimit ) {
	277	+ if ( $deref ) {
	278	+ $ret = ldap_list( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit, $deref );
	279	+ } else {
	280	+ $ret = ldap_list( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit );
	281	+ }
	282	+ } else {
	283	+ $ret = ldap_list( $ldapconn, $basedn, $filter, $attributes, $attrsonly, $sizelimit );
	284	+ }
	285	+ } else {
	286	+ $ret = ldap_list( $ldapconn, $basedn, $filter, $attributes, $attrsonly );
	287	+ }
	288	+ } else {
	289	+ $ret = ldap_list( $ldapconn, $basedn, $filter, $attributes );
	290	+ }
	291	+ } else {
	292	+ $ret = ldap_list( $ldapconn, $basedn, $filter );
	293	+ }
	294	+ wfRestoreWarnings();
	295	+ return $ret;
	296	+ }
	297	+
	298	+ /**
	299	+ * Wrapper for ldap_get_entries
	300	+ */
	301	+ public static function ldap_get_entries( $ldapconn, $resultid ) {
	302	+ wfSuppressWarnings();
	303	+ $ret = ldap_get_entries( $ldapconn, $resultid );
	304	+ wfRestoreWarnings();
	305	+ return $ret;
	306	+ }
	307	+
	308	+ /**
	309	+ * Wrapper for ldap_count_entries
	310	+ */
	311	+ public static function ldap_count_entries( $ldapconn, $resultid ) {
	312	+ wfSuppressWarnings();
	313	+ $ret = ldap_count_entries( $ldapconn, $resultid );
	314	+ wfRestoreWarnings();
	315	+ return $ret;
	316	+ }
	317	+
	318	+ /**
	319	+ * Get the user's domain as defined in the user's session.
	320	+ *
	321	+ * @return string
	322	+ */
149	323	public function getSessionDomain() {
150	324	if ( isset( $_SESSION['wsDomain'] ) ) {
151	325	return $_SESSION['wsDomain'];
—	—	@@ -153,6 +327,12 @@
154	328	}
155	329	}
156	330
	331	+ /**
	332	+ * Get configuration defined by admin, or return default value
	333	+ *
	334	+ * @param string $preference
	335	+ * @return mixed
	336	+ */
157	337	public function getConf( $preference ) {
158	338	$domain = $this->getSessionDomain();
159	339	switch ( $preference ) {
—	—	@@ -290,13 +470,6 @@
291	471	} else {
292	472	return false;
293	473	}
294		~~- case 'RetrievePrefs':~~
295		~~- global $wgLDAPRetrievePrefs;~~
296		~~- if ( isset( $wgLDAPRetrievePrefs[$domain] ) ) {~~
297		~~- return $wgLDAPRetrievePrefs[$domain];~~
298		~~- } else {~~
299		~~- return false;~~
300		~~- }~~
301	474	case 'Preferences':
302	475	global $wgLDAPPreferences;
303	476	if ( isset( $wgLDAPPreferences[$domain] ) ) {
—	—	@@ -311,13 +484,6 @@
312	485	} else {
313	486	return false;
314	487	}
315		~~- case 'GroupDN':~~
316		~~- global $wgLDAPGroupDN;~~
317		~~- if ( isset( $wgLDAPGroupDN[$domain] ) ) {~~
318		~~- return $wgLDAPGroupDN[$domain];~~
319		~~- } else {~~
320		~~- return '';~~
321		~~- }~~
322	488	case 'GroupUseFullDN':
323	489	global $wgLDAPGroupUseFullDN;
324	490	if ( isset( $wgLDAPGroupUseFullDN[$domain] ) ) {
—	—	@@ -328,6 +494,7 @@
329	495	case 'LowerCaseUsername':
330	496	global $wgLDAPLowerCaseUsername;
331	497	if ( isset( $wgLDAPLowerCaseUsername[$domain] ) ) {
	498	+ $this->printDebug( "Configuration set to lowercase username.", NONSENSITIVE );
332	499	return $wgLDAPLowerCaseUsername[$domain];
333	500	} else {
334	501	return false;
—	—	@@ -431,27 +598,6 @@
432	599	case 'AutoAuthDomain':
433	600	global $wgLDAPAutoAuthDomain;
434	601	return $wgLDAPAutoAuthDomain;
435		~~- case 'UniqueAttribute':~~
436		~~- global $wgLDAPUniqueAttribute;~~
437		~~- if ( isset( $wgLDAPUniqueAttribute[$domain] ) ) {~~
438		~~- return $wgLDAPUniqueAttribute[$domain];~~
439		~~- } else {~~
440		~~- return '';~~
441		~~- }~~
442		~~- case 'UniqueBlockLogin':~~
443		~~- global $wgLDAPUniqueBlockLogin;~~
444		~~- if ( isset( $wgLDAPUniqueBlockLogin[$domain] ) ) {~~
445		~~- return $wgLDAPUniqueBlockLogin[$domain];~~
446		~~- } else {~~
447		~~- return false;~~
448		~~- }~~
449		~~- case 'UniqueRenameUser':~~
450		~~- global $wgLDAPUniqueRenameUser;~~
451		~~- if ( isset( $wgLDAPUniqueRenameUser[$domain] ) ) {~~
452		~~- return $wgLDAPUniqueRenameUser[$domain];~~
453		~~- } else {~~
454		~~- return false;~~
455		~~- }~~
456	602	}
457	603	}
458	604
—	—	@@ -479,7 +625,7 @@
480	626
481	627	$this->connect();
482	628	if ( $this->ldapconn ) {
483		~~- $this->printDebug( "Successfully connected", NONSENSITIVE );~~
	629	+ $this->printDebug( "PHP's LDAP connect method returned true (note, this does not imply it connected to the server).", NONSENSITIVE );
484	630
485	631	$searchstring = $this->getSearchString( $username );
486	632
—	—	@@ -487,17 +633,15 @@
488	634	// anything back, then the user exists.
489	635	if ( $this->useAutoAuth() && $searchstring != '' ) {
490	636	// getSearchString is going to bind, but will not unbind
491		~~- // Let's clean up~~
492		~~- @ldap_unbind();~~
	637	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
493	638	return true;
494	639	}
495	640
496	641	// Search for the entry.
497		~~- $entry = @ldap_read( $this->ldapconn, $searchstring, "objectclass=*" );~~
	642	+ $entry = LdapAuthentication::ldap_read( $this->ldapconn, $searchstring, "objectclass=*" );
498	643
499	644	// getSearchString is going to bind, but will not unbind
500		~~- // Let's clean up~~
501		~~- @ldap_unbind();~~
	645	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
502	646	if ( !$entry ) {
503	647	$this->printDebug( "Did not find a matching user in LDAP", NONSENSITIVE );
504	648	return false;
—	—	@@ -506,7 +650,7 @@
507	651	return true;
508	652	}
509	653	} else {
510		~~- $this->printDebug( "Failed to connect", NONSENSITIVE );~~
	654	+ $this->printDebug( "PHP's LDAP method returned false, this likely implies a misconfiguration of the plugin.", NONSENSITIVE );
511	655	return false;
512	656	}
513	657	}
—	—	@@ -532,8 +676,6 @@
533	677	$encryptionType = $this->getConf( 'EncryptionType' );
534	678	switch( $encryptionType ) {
535	679	case "ldapi":
536		~~- # this is a really dirty place to put this,~~
537		~~- # but it is easy and avoids another config option.~~
538	680	$this->printDebug( "Using ldapi", SENSITIVE );
539	681	$serverpre = "ldapi://";
540	682	break;
—	—	@@ -546,7 +688,7 @@
547	689	$serverpre = "ldap://";
548	690	}
549	691
550		~~- // Make a space separated list of server strings with the ldap:// or ldaps://~~
	692	+ // Make a space separated list of server strings with the connection type
551	693	// string added.
552	694	$servers = "";
553	695	$tmpservers = $this->getConf( 'ServerNames' );
—	—	@@ -560,7 +702,7 @@
561	703	$this->printDebug( "Using servers: $servers", SENSITIVE );
562	704
563	705	// Connect and set options
564		~~- $this->ldapconn = @ldap_connect( $servers );~~
	706	+ $this->ldapconn = LdapAuthentication::ldap_connect( $servers );
565	707	ldap_set_option( $this->ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3 );
566	708	ldap_set_option( $this->ldapconn, LDAP_OPT_REFERRALS, 0 );
567	709
—	—	@@ -570,7 +712,7 @@
571	713	}
572	714	}
573	715
574		~~- // TLS needs to be started after the connection is made~~
	716	+ // TLS needs to be started after the connection resource is available
575	717	if ( $encryptionType == "tls" ) {
576	718	$this->printDebug( "Using TLS", SENSITIVE );
577	719	if ( !ldap_start_tls( $this->ldapconn ) ) {
—	—	@@ -620,14 +762,11 @@
621	763
622	764	$this->connect();
623	765	if ( $this->ldapconn ) {
624		~~- $this->printDebug( "Connected successfully", NONSENSITIVE );~~
625		-
626	766	// Mediawiki munges the username before authenticate is called,
627	767	// this can mess with authentication, group pulling/restriction,
628	768	// preference pulling, etc. Let's allow the admin to use
629	769	// a lowercased username if needed.
630	770	if ( $this->getConf( 'LowerCaseUsername') ) {
631		~~- $this->printDebug( "Lowercasing the username: $username", NONSENSITIVE );~~
632	771	$username = strtolower( $username );
633	772	}
634	773
—	—	@@ -638,7 +777,7 @@
639	778	// return true, and will let anyone in!
640	779	if ( '' == $this->userdn ) {
641	780	$this->printDebug( "User DN is blank", NONSENSITIVE );
642		~~- @ldap_unbind();~~
	781	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
643	782	$this->markAuthFailed();
644	783	return false;
645	784	}
—	—	@@ -647,8 +786,6 @@
648	787	// user to make sure the password is correct.
649	788	if ( !$this->useAutoAuth() ) {
650	789	$this->printDebug( "Binding as the user", NONSENSITIVE );
651		-
652		~~- // Let's see if the user can authenticate.~~
653	790	$bind = $this->bindAs( $this->userdn, $password );
654	791	if ( !$bind ) {
655	792	$this->markAuthFailed();
—	—	@@ -676,12 +813,12 @@
677	814	$filter = "(" . $aa . ")";
678	815	$attributes = array( "dn" );
679	816
680		~~- $entry = ldap_read( $this->ldapconn, $this->userdn, $filter, $attributes );~~
681		~~- $info = ldap_get_entries( $this->ldapconn, $entry );~~
	817	+ $entry = LdapAuthentication::ldap_read( $this->ldapconn, $this->userdn, $filter, $attributes );
	818	+ $info = LdapAuthentication::ldap_get_entries( $this->ldapconn, $entry );
682	819
683	820	if ( $info["count"] < 1 ) {
684	821	$this->printDebug( "Failed auth attribute check", NONSENSITIVE );
685		~~- @ldap_unbind();~~
	822	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
686	823	$this->markAuthFailed();
687	824	return false;
688	825	}
—	—	@@ -691,22 +828,15 @@
692	829	$this->getGroups( $username );
693	830
694	831	if ( !$this->checkGroups( $username ) ) {
695		~~- @ldap_unbind();~~
	832	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
696	833	$this->markAuthFailed();
697	834	return false;
698	835	}
699	836
700	837	$this->getPreferences();
701	838
702		~~- if ( !$this->synchUsername( $username ) ) {~~
703		~~- @ldap_unbind();~~
704		~~- $this->markAuthFailed();~~
705		~~- return false;~~
706		~~- }~~
707		-
708		~~- @ldap_unbind();~~
	839	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
709	840	} else {
710		~~- $this->printDebug( "Failed to connect", NONSENSITIVE );~~
711	841	$this->markAuthFailed();
712	842	return false;
713	843	}
—	—	@@ -815,7 +945,6 @@
816	946
817	947	$this->connect();
818	948	if ( $this->ldapconn ) {
819		~~- $this->printDebug( "Connected successfully", NONSENSITIVE );~~
820	949	$this->userdn = $this->getSearchString( $user->getName() );
821	950
822	951	$this->printDebug( "Binding as the writerDN", NONSENSITIVE );
—	—	@@ -830,10 +959,9 @@
831	960	// domain credentials for security reasons.
832	961	$password = '';
833	962
834		~~- $success = @ldap_modify( $this->ldapconn, $this->userdn, $values );~~
	963	+ $success = LdapAuthentication::ldap_modify( $this->ldapconn, $this->userdn, $values );
835	964
836		~~- // Let's clean up~~
837		~~- @ldap_unbind();~~
	965	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
838	966	if ( $success ) {
839	967	$this->printDebug( "Successfully modified the user's password", NONSENSITIVE );
840	968	return true;
—	—	@@ -842,7 +970,6 @@
843	971	return false;
844	972	}
845	973	} else {
846		~~- $this->printDebug( "Failed to connect", NONSENSITIVE );~~
847	974	return false;
848	975	}
849	976	}
—	—	@@ -881,7 +1008,6 @@
882	1009
883	1010	$this->connect();
884	1011	if ( $this->ldapconn ) {
885		~~- $this->printDebug( "Connected successfully", NONSENSITIVE );~~
886	1012	$this->userdn = $this->getSearchString( $user->getName() );
887	1013
888	1014	$this->printDebug( "Binding as the writerDN", NONSENSITIVE );
—	—	@@ -895,17 +1021,16 @@
896	1022	if ( '' != $this->realname ) { $values["cn"] = $this->realname; }
897	1023	if ( '' != $this->lang ) { $values["preferredlanguage"] = $this->lang; }
898	1024
899		~~- if ( 0 != sizeof( $values ) && @ldap_modify( $this->ldapconn, $this->userdn, $values ) ) {~~
	1025	+ if ( 0 != sizeof( $values ) && LdapAuthentication::ldap_modify( $this->ldapconn, $this->userdn, $values ) ) {
900	1026	$this->printDebug( "Successfully modified the user's attributes", NONSENSITIVE );
901		~~- @ldap_unbind();~~
	1027	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
902	1028	return true;
903	1029	} else {
904	1030	$this->printDebug( "Failed to modify the user's attributes", NONSENSITIVE );
905		~~- @ldap_unbind();~~
	1031	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
906	1032	return false;
907	1033	}
908	1034	} else {
909		~~- $this->printDebug( "Failed to Connect", NONSENSITIVE );~~
910	1035	return false;
911	1036	}
912	1037	}
—	—	@@ -960,7 +1085,7 @@
961	1086	return true;
962	1087	}
963	1088
964		~~- if ( $this->getConf( 'RequiredGroups' ) \|\| $this->getConf( 'GroupDN' ) ) {~~
	1089	+ if ( $this->getConf( 'RequiredGroups' ) ) {
965	1090	$this->printDebug( "The wiki is requiring users to be in specific groups, and cannot add users as this would be a security hole.", NONSENSITIVE );
966	1091	// It is possible that later we can add users into
967	1092	// groups, but since we don't support it, we don't want
—	—	@@ -984,8 +1109,6 @@
985	1110
986	1111	$this->connect();
987	1112	if ( $this->ldapconn ) {
988		~~- $this->printDebug( "Successfully connected", NONSENSITIVE );~~
989		-
990	1113	$writeloc = $this->getConf( 'WriteLocation' );
991	1114	$this->userdn = $this->getSearchString( $username );
992	1115	if ( '' == $this->userdn ) {
—	—	@@ -997,13 +1120,12 @@
998	1121	} else {
999	1122	$this->printDebug( "wgLDAPWriteLocation is not set, failing", NONSENSITIVE );
1000	1123	// getSearchString will bind, but will not unbind
1001		~~- @ldap_unbind();~~
	1124	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
1002	1125	return false;
1003	1126	}
1004	1127	}
1005	1128
1006	1129	$this->printDebug( "Binding as the writerDN", NONSENSITIVE );
1007		-
1008	1130	$bind = $this->bindAs( $writer, $this->getConf( 'WriterPassword' ) );
1009	1131	if ( !$bind ) {
1010	1132	$this->printDebug( "Failed to bind as the writerDN; add failed", NONSENSITIVE );
—	—	@@ -1025,7 +1147,7 @@
1026	1148	wfRunHooks( 'LDAPSetCreationValues', array( $this, $username, &$values, $writeloc, &$this->userdn, &$result ) );
1027	1149	if ( ! $result ) {
1028	1150	$this->printDebug( "Failed to add user because LDAPSetCreationValues returned false", NONSENSITIVE );
1029		~~- @ldap_unbind();~~
	1151	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
1030	1152	return false;
1031	1153	}
1032	1154
—	—	@@ -1035,17 +1157,16 @@
1036	1158	}
1037	1159
1038	1160	$this->printDebug( "Adding user", NONSENSITIVE );
1039		~~- if ( @ldap_add( $this->ldapconn, $this->userdn, $values ) ) {~~
	1161	+ if ( LdapAuthentication::ldap_add( $this->ldapconn, $this->userdn, $values ) ) {
1040	1162	$this->printDebug( "Successfully added user", NONSENSITIVE );
1041		~~- @ldap_unbind();~~
	1163	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
1042	1164	return true;
1043	1165	} else {
1044	1166	$this->printDebug( "Failed to add user", NONSENSITIVE );
1045		~~- @ldap_unbind();~~
	1167	+ LdapAuthentication::ldap_unbind( $this->ldapconn );
1046	1168	return false;
1047	1169	}
1048	1170	} else {
1049		~~- $this->printDebug( "Failed to connect; add failed", NONSENSITIVE );~~
1050	1171	return false;
1051	1172	}
1052	1173	}
—	—	@@ -1099,7 +1220,7 @@
1100	1221
1101	1222	// If we aren't pulling preferences, we don't want to accidentally
1102	1223	// overwrite anything.
1103		~~- if ( $this->getConf( 'RetrievePrefs' ) \|\| $this->getConf( 'Preferences' ) ) {~~
	1224	+ if ( $this->getConf( 'Preferences' ) ) {
1104	1225	$this->printDebug( "Setting user preferences.", NONSENSITIVE );
1105	1226
1106	1227	if ( '' != $this->lang ) {
—	—	@@ -1119,13 +1240,7 @@
1120	1241	$user->setEmail( $this->email );
1121	1242	$user->confirmEmail();
1122	1243	}
1123		~~- if ( $this->getConf( 'UniqueBlockLogin' ) \|\| $this->getConf( 'UniqueRenameUser' ) ) {~~
1124	1244
1125		~~- if ( '' != $this->externalid ) {~~
1126		~~- $user->setExternalID( $this->externalid );~~
1127		~~- }~~
1128		~~- }~~
1129		-
1130	1245	$saveSettings = true;
1131	1246	}
1132	1247
—	—	@@ -1228,11 +1343,8 @@
1229	1344	} else {
1230	1345	$this->connect();
1231	1346	if ( $this->ldapconn ) {
1232		~~- $this->printDebug( "Successfully connected", NONSENSITIVE );~~
1233	1347	$this->userdn = $this->getSearchString( $username );
1234	1348	wfRunHooks( 'SetUsernameAttributeFromLDAP', array( &$this->LDAPUsername, $this->userInfo ) );
1235		~~- } else {~~
1236		~~- $this->printDebug( "Failed to connect in getCanonicalName, this is non-critical, but may indicate a misconfiguration.", NONSENSITIVE );~~
1237	1349	}
1238	1350	}
1239	1351
—	—	@@ -1334,14 +1446,14 @@
1335	1447
1336	1448	$this->printDebug( "Using base: $base", SENSITIVE );
1337	1449
1338		~~- $entry = @ldap_search( $this->ldapconn, $base, $filter, $attributes );~~
1339		~~- if ( @ldap_count_entries($this->ldapconn,$entry)==0 ) {~~
	1450	+ $entry = LdapAuthentication::ldap_search( $this->ldapconn, $base, $filter, $attributes );
	1451	+ if ( LdapAuthentication::ldap_count_entries( $this->ldapconn, $entry ) == 0 ) {
1340	1452	$this->printDebug( "Couldn't find an entry", NONSENSITIVE );
1341	1453	$this->fetchedUserInfo = false;
1342	1454	return '';
1343	1455	}
1344	1456
1345		~~- $this->userInfo = @ldap_get_entries( $this->ldapconn, $entry );~~
	1457	+ $this->userInfo = LdapAuthentication::ldap_get_entries( $this->ldapconn, $entry );
1346	1458	$this->fetchedUserInfo = true;
1347	1459	if ( isset( $this->userInfo[0][$searchattr] ) ) {
1348	1460	$username = $this->userInfo[0][$searchattr][0];
—	—	@@ -1381,8 +1493,8 @@
1382	1494	// Don't fetch the same data more than once
1383	1495	// TODO: use memcached here
1384	1496
1385		~~- $entry = @ldap_read( $this->ldapconn, $userdn, "objectclass=", array( '', 'memberof' ) );~~
1386		~~- $userInfo = @ldap_get_entries( $this->ldapconn, $entry );~~
	1497	+ $entry = LdapAuthentication::ldap_read( $this->ldapconn, $userdn, "objectclass=", array( '', 'memberof' ) );
	1498	+ $userInfo = LdapAuthentication::ldap_get_entries( $this->ldapconn, $entry );
1387	1499	if ( $userInfo["count"] < 1 ) {
1388	1500	return;
1389	1501	} else {
—	—	@@ -1434,97 +1546,9 @@
1435	1547	break;
1436	1548	}
1437	1549	}
1438		~~- } elseif ( $this->getConf( 'RetrievePrefs' ) ) {~~
1439		~~- // DEPRECATED. Kept for backwards compatibility.~~
1440		~~- $this->printDebug( "Retrieving preferences", NONSENSITIVE );~~
1441		~~- $this->printDebug( '$wgLDAPRetrievePrefs is a DEPRECATED option, please use $wgLDAPPreferences.', NONSENSITIVE );~~
1442		-
1443		~~- if ( isset( $this->userInfo[0]["mail"] ) ) {~~
1444		~~- $this->email = $this->userInfo[0]["mail"][0];~~
1445		~~- }~~
1446		~~- if ( isset( $this->userInfo[0]["preferredlanguage"] ) ) {~~
1447		~~- $this->lang = $this->userInfo[0]["preferredlanguage"][0];~~
1448		~~- }~~
1449		~~- if ( isset( $this->userInfo[0]["displayname"] ) ) {~~
1450		~~- $this->nickname = $this->userInfo[0]["displayname"][0];~~
1451		~~- }~~
1452		~~- if ( isset( $this->userInfo[0]["cn"] ) ) {~~
1453		~~- $this->realname = $this->userInfo[0]["cn"][0];~~
1454		~~- }~~
1455		-
1456		~~- $this->printDebug( "Retrieved: $this->email, $this->lang, $this->nickname, $this->realname", SENSITIVE );~~
1457	1550	}
1458	1551	}
1459	1552
1460		~~- function synchUsername( $username ) {~~
1461		~~- $this->printDebug( "Entering synchUsername", NONSENSITIVE );~~
1462		-
1463		~~- $this->userInfo = $this->getUserInfo();~~
1464		~~- if ( is_null( $this->userInfo ) ) {~~
1465		~~- $this->printDebug( "Failed to get preferences", NONSENSITIVE );~~
1466		~~- }~~
1467		-
1468		~~- // Are we blocking login/renaming users on unique external ID mismatches?~~
1469		- // * WARNING *
1470		~~- // This needs to be fixed before use! This probably does not work correctly~~
1471		~~- // with all options. It is probably a good idea to refactor the username stuff~~
1472		~~- // in general (as it is currently somewhat of a kludge). Also, MediaWiki does~~
1473		~~- // not currently have support for this.~~
1474		- // * WARNING *
1475		~~- if ( $this->getConf( 'UniqueBlockLogin' ) \|\| $this->getConf( 'UniqueRenameUser' ) ) {~~
1476		-
1477		~~- $this->printDebug( "Checking for username change in LDAP.", SENSITIVE );~~
1478		-
1479		~~- // Get the user's unique attribute from LDAP~~
1480		~~- $ldapuniqueattr = $this->getConf( 'UniqueAttribute' );~~
1481		~~- if ( $ldapuniqueattr ) {~~
1482		~~- $this->externalid = $this->info[0][$ldapuniqueattr][0];~~
1483		~~- } else {~~
1484		~~- return false;~~
1485		~~- }~~
1486		-
1487		~~- $this->printDebug( "Retrieved external id: $this->externalid", SENSITIVE );~~
1488		-
1489		~~- $retrievedusername = User::whoIsExternalID( "$this->externalid" );~~
1490		-
1491		~~- $this->printDebug( "Username (in MediaWiki database) of fetched external id: $retrievedusername", SENSITIVE );~~
1492		-
1493		~~- // See if the username returned from the database matches the username given~~
1494		~~- if ( $retrievedusername != '' && ( $username != $retrievedusername ) ) {~~
1495		~~- if ( $this->getConf( 'UniqueBlockLogin' ) ) {~~
1496		-
1497		~~- $this->printDebug( "Usernames do not match, blocking login.", SENSITIVE );~~
1498		~~- return false;~~
1499		~~- } elseif ( $this->getConf( 'UniqueRenameUser' ) ) {~~
1500		-
1501		~~- $this->printDebug( "Usernames do not match, renaming user in database.", SENSITIVE );~~
1502		-
1503		~~- $olduser = User::newFromName( $retrievedusername );~~
1504		~~- $uid = $olduser->idForName();~~
1505		-
1506		~~- // Ensure we don't require the same class twice~~
1507		~~- if ( !class_exists( 'RenameuserSQL' ) ) {~~
1508		~~- require( 'Renameuser/SpecialRenameuser_body.php' );~~
1509		~~- }~~
1510		-
1511		~~- // Make a new rename user object with: from, to, uid of from~~
1512		~~- $rename = new RenameuserSQL( $retrievedusername, $username, $uid );~~
1513		~~- $rename->rename();~~
1514		-
1515		~~- // For the time being we can't just allow the user to log in~~
1516		~~- // as MediaWiki will try to create the user account after we~~
1517		~~- // do a rename. If we don't return false, the user will get~~
1518		~~- // a database error~~
1519		~~- return false;~~
1520		~~- }~~
1521		~~- }~~
1522		-
1523		~~- $this->printDebug( "Usernames matched or the user doesn't exist in the database yet.", SENSITIVE );~~
1524		~~- }~~
1525		-
1526		~~- return true;~~
1527		~~- }~~
1528		-
1529	1553	/**
1530	1554	* Checks to see whether a user is in a required group.
1531	1555	*
—	—	@@ -1535,18 +1559,6 @@
1536	1560	function checkGroups( $username ) {
1537	1561	$this->printDebug( "Entering checkGroups", NONSENSITIVE );
1538	1562
1539		~~- // Old style groups, non-nestable and fairly limited on group type (full DN~~
1540		~~- // versus username). DEPRECATED~~
1541		~~- $groupdn = $this->getConf( 'GroupDN' );~~
1542		~~- if ( $groupdn ) {~~
1543		~~- $this->printDebug( "Checking for (old style) group membership", NONSENSITIVE );~~
1544		~~- // we need to do a subbase search for the entry~~
1545		~~- $filter = "(member=" . $this->getLdapEscapedString( $this->userdn ) . ")";~~
1546		~~- $info = @ldap_get_entries( $this->ldapconn, @ldap_search( $this->ldapconn, $groupdn, $filter ) );~~
1547		-
1548		~~- return ( $info["count"] >= 1 );~~
1549		~~- }~~
1550		-
1551	1563	$excgroups = $this->getConf( 'ExcludedGroups' );
1552	1564	if ( $excgroups ) {
1553	1565	$this->printDebug( "Checking for excluded group membership", NONSENSITIVE );
—	—	@@ -1565,7 +1577,6 @@
1566	1578	}
1567	1579	}
1568	1580
1569		~~- // New style group checking~~
1570	1581	$reqgroups = $this->getConf( 'RequiredGroups' );
1571	1582	if ( $reqgroups ) {
1572	1583	$this->printDebug( "Checking for (new style) group membership", NONSENSITIVE );
—	—	@@ -1647,10 +1658,10 @@
1648	1659	}
1649	1660	} else {
1650	1661	$this->printDebug( "Searching for the groups", NONSENSITIVE );
1651		~~- $this->userLDAPGroups = $this->searchGroups( $usertopass );~~
	1662	+ $this->userLDAPGroups = LdapAuthentication::ldap_searchGroups( $usertopass );
1652	1663
1653	1664	if ( $this->getConf( 'GroupSearchNestedGroups' ) ) {
1654		~~- $this->userLDAPGroups = $this->searchNestedGroups( $this->userLDAPGroups );~~
	1665	+ $this->userLDAPGroups = LdapAuthentication::ldap_searchNestedGroups( $this->userLDAPGroups );
1655	1666	$this->printDebug( "Got the following nested groups:", SENSITIVE, $this->userLDAPGroups["dn"] );
1656	1667	}
1657	1668	}
—	—	@@ -1658,7 +1669,7 @@
1659	1670	// Only find all groups if the user has any groups; otherwise, we are
1660	1671	// just wasting a search.
1661	1672	if ( $this->getConf( 'GroupsPrevail' ) && count( $this->userLDAPGroups ) != 0 ) {
1662		~~- $this->allLDAPGroups = $this->searchGroups( '*' );~~
	1673	+ $this->allLDAPGroups = LdapAuthentication::ldap_searchGroups( '*' );
1663	1674	}
1664	1675	}
1665	1676	}
—	—	@@ -1686,7 +1697,7 @@
1687	1698
1688	1699	$groupstosearch = array( "short" => array(), "dn" => array() );
1689	1700	foreach ( $groups["dn"] as $group ) {
1690		~~- $returnedgroups = $this->searchGroups( $group );~~
	1701	+ $returnedgroups = LdapAuthentication::ldap_searchGroups( $group );
1691	1702	$this->printDebug( "Group $group is in the following groups:", SENSITIVE, $returnedgroups["dn"] );
1692	1703	foreach ( $returnedgroups["dn"] as $searchme ) {
1693	1704	if ( in_array( $searchme, $searchedgroups["dn"] ) ) {
—	—	@@ -1712,8 +1723,7 @@
1713	1724
1714	1725	$searchedgroups = array_merge_recursive( $groups, $searchedgroups );
1715	1726
1716		~~- // Mmmmmm. Tail recursion. Tasty.~~
1717		~~- return $this->searchNestedGroups( $groupstosearch, $searchedgroups );~~
	1727	+ return LdapAuthentication::ldap_searchNestedGroups( $groupstosearch, $searchedgroups );
1718	1728	}
1719	1729
1720	1730	/**
—	—	@@ -1753,8 +1763,8 @@
1754	1764	if ( $dn != "*" ) {
1755	1765	$PGfilter = "(&(distinguishedName=$value)(objectclass=user))";
1756	1766	$this->printDebug( "User Filter: $PGfilter", SENSITIVE );
1757		~~- $PGinfo = @ldap_search( $this->ldapconn, $base, $PGfilter );~~
1758		~~- $PGentries = @ldap_get_entries( $this->ldapconn, $PGinfo );~~
	1767	+ $PGinfo = LdapAuthentication::ldap_search( $this->ldapconn, $base, $PGfilter );
	1768	+ $PGentries = LdapAuthentication::ldap_get_entries( $this->ldapconn, $PGinfo );
1759	1769	if ( $PGentries ) {
1760	1770	$Usid = $PGentries[0]['objectsid'][0];
1761	1771	$PGrid = $PGentries[0]['primarygroupid'][0];
—	—	@@ -1777,8 +1787,8 @@
1778	1788	}
1779	1789	$PGfilter = "(&(objectSid=$PGsid_string)(objectclass=$objectclass))";
1780	1790	$this->printDebug( "Primary Group Filter: $PGfilter", SENSITIVE );
1781		~~- $info = @ldap_search( $this->ldapconn, $base, $PGfilter );~~
1782		~~- $PGentries = @ldap_get_entries( $this->ldapconn, $info );~~
	1791	+ $info = LdapAuthentication::ldap_search( $this->ldapconn, $base, $PGfilter );
	1792	+ $PGentries = LdapAuthentication::ldap_get_entries( $this->ldapconn, $info );
1783	1793	array_shift( $PGentries );
1784	1794	$dnMember = strtolower( $PGentries[0]['dn'] );
1785	1795	$groups["dn"][] = $dnMember;
—	—	@@ -1798,7 +1808,7 @@
1799	1809
1800	1810	$this->printDebug( "Search string: $filter", SENSITIVE );
1801	1811
1802		~~- $info = @ldap_search( $this->ldapconn, $base, $filter );~~
	1812	+ $info = LdapAuthentication::ldap_search( $this->ldapconn, $base, $filter );
1803	1813	if ( !$info ) {
1804	1814	$this->printDebug( "No entries returned from search.", SENSITIVE );
1805	1815
—	—	@@ -1807,7 +1817,7 @@
1808	1818	return array( "short" => array(), "dn" => array() );
1809	1819	}
1810	1820
1811		~~- $entries = @ldap_get_entries( $this->ldapconn, $info );~~
	1821	+ $entries = LdapAuthentication::ldap_get_entries( $this->ldapconn, $info );
1812	1822
1813	1823	if ( $entries ){
1814	1824	// We need to shift because the first entry will be a count
—	—	@@ -1985,13 +1995,12 @@
1986	1996	function bindAs( $userdn = null, $password = null ) {
1987	1997	// Let's see if the user can authenticate.
1988	1998	if ( $userdn == null \|\| $password == null ) {
1989		~~- $bind = @ldap_bind( $this->ldapconn );~~
	1999	+ $bind = LdapAuthentication::ldap_bind( $this->ldapconn );
1990	2000	} else {
1991		~~- $bind = @ldap_bind( $this->ldapconn, $userdn, $password );~~
	2001	+ $bind = LdapAuthentication::ldap_bind( $this->ldapconn, $userdn, $password );
1992	2002	}
1993	2003	if ( !$bind ) {
1994	2004	$this->printDebug( "Failed to bind as $userdn", NONSENSITIVE );
1995		~~- $this->printDebug( "with password: $password", HIGHLYSENSITIVE );~~
1996	2005	return false;
1997	2006	}
1998	2007	$this->boundAs = $userdn;
—	—	@@ -2022,9 +2031,9 @@
2023	2032	function getLdapEscapedString( $string ) {
2024	2033	// Make the string LDAP compliant by escaping *, (, ) , \ & NUL
2025	2034	return str_replace(
2026		~~- array( "\\", "(", ")", "*", "\x00" ), // replace this~~
2027		~~- array( "\\5c", "\\28", "\\29", "\\2a", "\\00" ), // with this~~
2028		~~- $string // in this~~
	2035	+ array( "\\", "(", ")", "*", "\x00" ),
	2036	+ array( "\\5c", "\\28", "\\29", "\\2a", "\\00" ),
	2037	+ $string
2029	2038	);
2030	2039	}
2031	2040
—	—	@@ -2068,11 +2077,11 @@
2069	2078	}
2070	2079	}
2071	2080
2072		~~-// The following was derived from the SSL Authentication plugin~~
	2081	+// The auto-auth code was originally derived from the SSL Authentication plugin
2073	2082	// http://www.mediawiki.org/wiki/SSL_authentication
2074	2083
2075	2084	/**
2076		~~- * Sets up the SSL authentication piece of the LDAP plugin.~~
	2085	+ * Sets up the auto-authentication piece of the LDAP plugin.
2077	2086	*
2078	2087	* @access public
2079	2088	*/

Follow-up revisions

Revision	Commit summary	Author	Date
r107410	Fixing a very obvious mistake.	laner	20:12, 27 December 2011
r107420	Fix bad search and replace.	laner	20:52, 27 December 2011
r107421	Follow up to r107420. These calls shouldn't be static	laner	20:56, 27 December 2011

Comments

#Comment by Nikerabbit (talk | contribs) 08:24, 5 January 2012

This code hurts my eyes.

#Comment by MarkAHershberger (talk | contribs) 17:54, 5 January 2012

Does this even work:

+class LdapAuthenticationextends AuthPlugin {

#Comment by Reedy (talk | contribs) 17:55, 5 January 2012

Already fixed in trunk

Status & tagging log

08:52, 18 January 2012 Siebrand (talk | contribs) changed the tags for r107409 [removed: ldap]
17:31, 14 January 2012 😂 (talk | contribs) changed the status of r107409 [removed: new added: resolved]
21:32, 5 January 2012 MarkAHershberger (talk | contribs) changed the tags for r107409 [added: ldap]
17:56, 5 January 2012 MarkAHershberger (talk | contribs) changed the status of r107409 [removed: fixme added: new]
17:54, 5 January 2012 MarkAHershberger (talk | contribs) changed the status of r107409 [removed: new added: fixme]