mirror of
https://gitlab.com/davical-project/davical.git
synced 2026-08-01 13:49:28 +00:00
111 lines
2.9 KiB
PHP
111 lines
2.9 KiB
PHP
<?php
|
|
/**
|
|
* Manages PAM repository connection with local imap server help
|
|
*
|
|
* @package davical
|
|
* @category Technical
|
|
* @subpackage ldap
|
|
* @author Oliver Schulze <oliver@samera.com.py>
|
|
* @copyright Based on Eric Seigne script drivers_squid_pam.php
|
|
* @license http://gnu.org/copyleft/gpl.html GNU GPL v2
|
|
*/
|
|
|
|
require_once("auth-functions.php");
|
|
|
|
class imapPamDrivers
|
|
{
|
|
/**#@+
|
|
* @access private
|
|
*/
|
|
|
|
/**#@-*/
|
|
|
|
|
|
/**
|
|
* Constructor.
|
|
* @param string $imap_url formated for imap_open()
|
|
*/
|
|
function imapPamDrivers($imap_url){
|
|
$this->__construct($imap_url);
|
|
}
|
|
|
|
|
|
/**
|
|
* The constructor
|
|
*
|
|
* @param string $imap_url formated for imap_open()
|
|
*/
|
|
function __construct($imap_url)
|
|
{
|
|
global $c;
|
|
if (empty($imap_url)){
|
|
$c->messages[] = sprintf(i18n('drivers_imap_pam : imap_url parameter not configured in /etc/davical/*-conf.php'));
|
|
$this->valid=false;
|
|
return ;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
/**
|
|
* Check the username / password against the PAM system
|
|
*/
|
|
function IMAP_PAM_check($username, $password ){
|
|
global $c;
|
|
|
|
/**
|
|
* @todo Think of the children! This is a horribly insecure use of unvalidated user input! Probably it should be done with a popen or something, and it seems remarkably dodgy to expect that naively quoted strings will work in any way reliably.
|
|
* Meanwhile, I've quickly hacked something basic in place to improve the situation. No quotes/backslashes in passwords for YOU!
|
|
*/
|
|
|
|
$username_ori = $username;
|
|
$username = escapeshellcmd($username);
|
|
//$password = escapeshellcmd($password);
|
|
|
|
//$imap_url = '{localhost:143/imap/notls}';
|
|
//$imap_url = '{localhost:993/imap/ssl/novalidate-cert}';
|
|
$imap_url = $c->authenticate_hook['config']['imap_url'];
|
|
$auth_result = "ERR";
|
|
|
|
$imap_stream = @imap_open($imap_url, $username, $password, OP_HALFOPEN);
|
|
//print_r(imap_errors());
|
|
if ( $imap_stream ) {
|
|
// disconnect
|
|
imap_close($imap_stream);
|
|
// login ok
|
|
$auth_result = "OK";
|
|
}
|
|
|
|
if ( $auth_result == "OK") {
|
|
if ( $usr = getUserByName($username) ) {
|
|
return $usr;
|
|
}
|
|
else {
|
|
dbg_error_log( "PAM", "user %s doesn't exist in local DB, we need to create it",$username );
|
|
$cmd = "getent passwd '$username'";
|
|
$getent_res = exec($cmd);
|
|
$getent_arr = explode(":", $getent_res);
|
|
$fullname = $getent_arr[4];
|
|
if(empty($fullname)) {
|
|
$fullname = $username;
|
|
}
|
|
$usr = (object) array(
|
|
'user_no' => 0,
|
|
'username' => $username,
|
|
'active' => 't',
|
|
'email' => $username . "@" . $c->authenticate_hook['config']['email_base'],
|
|
'updated' => date(),
|
|
'fullname' => $fullname
|
|
);
|
|
|
|
UpdateUserFromExternal( $usr );
|
|
return $usr;
|
|
}
|
|
}
|
|
else {
|
|
dbg_error_log( "PAM", "User %s is not a valid username (or password was wrong)", $username );
|
|
return false;
|
|
}
|
|
|
|
}
|