Context Navigation

source: github/program/include/rcube_ldap.php @ 38dc510

Visit:

HEADcourier-fixdev-browser-capabilitiespdorelease-0.8

Last change on this file since 38dc510 was 38dc510, checked in by alecpl <alec@…>, 15 months ago
Fix warning when properties array is empty
Property mode set to `100644`
File size: 67.0 KB

Line
1	<?php
2	/*
3	+-----------------------------------------------------------------------+
4	\| program/include/rcube_ldap.php \|
5	\| \|
6	\| This file is part of the Roundcube Webmail client \|
7	\| Copyright (C) 2006-2012, The Roundcube Dev Team \|
8	\| Copyright (C) 2011, Kolab Systems AG \|
9	\| \|
10	\| Licensed under the GNU General Public License version 3 or \|
11	\| any later version with exceptions for skins & plugins. \|
12	\| See the README file for a full license statement. \|
13	\| \|
14	\| PURPOSE: \|
15	\| Interface to an LDAP address directory \|
16	\| \|
17	+-----------------------------------------------------------------------+
18	\| Author: Thomas Bruederli <roundcube@gmail.com> \|
19	\| Andreas Dick <andudi (at) gmx (dot) ch> \|
20	\| Aleksander Machniak <machniak@kolabsys.com> \|
21	+-----------------------------------------------------------------------+
22
23	$Id$
24
25	*/
26
27
28	/**
29	* Model class to access an LDAP address directory
30	*
31	* @package Addressbook
32	*/
33	class rcube_ldap extends rcube_addressbook
34	{
35	/** public properties */
36	public $primary_key = 'ID';
37	public $groups = false;
38	public $readonly = true;
39	public $ready = false;
40	public $group_id = 0;
41	public $coltypes = array();
42
43	/** private properties */
44	protected $conn;
45	protected $prop = array();
46	protected $fieldmap = array();
47
48	protected $filter = '';
49	protected $result = null;
50	protected $ldap_result = null;
51	protected $mail_domain = '';
52	protected $debug = false;
53
54	private $base_dn = '';
55	private $groups_base_dn = '';
56	private $group_url = null;
57	private $cache;
58
59	private $vlv_active = false;
60	private $vlv_count = 0;
61
62
63	/**
64	* Object constructor
65	*
66	* @param array LDAP connection properties
67	* @param boolean Enables debug mode
68	* @param string Current user mail domain name
69	* @param integer User-ID
70	*/
71	function __construct($p, $debug=false, $mail_domain=NULL)
72	{
73	$this->prop = $p;
74
75	if (isset($p['searchonly']))
76	$this->searchonly = $p['searchonly'];
77
78	// check if groups are configured
79	if (is_array($p['groups']) && count($p['groups'])) {
80	$this->groups = true;
81	// set member field
82	if (!empty($p['groups']['member_attr']))
83	$this->prop['member_attr'] = strtolower($p['groups']['member_attr']);
84	else if (empty($p['member_attr']))
85	$this->prop['member_attr'] = 'member';
86	// set default name attribute to cn
87	if (empty($this->prop['groups']['name_attr']))
88	$this->prop['groups']['name_attr'] = 'cn';
89	if (empty($this->prop['groups']['scope']))
90	$this->prop['groups']['scope'] = 'sub';
91	}
92
93	// fieldmap property is given
94	if (is_array($p['fieldmap'])) {
95	foreach ($p['fieldmap'] as $rf => $lf)
96	$this->fieldmap[$rf] = $this->_attr_name(strtolower($lf));
97	}
98	else if (!empty($p)) {
99	// read deprecated *_field properties to remain backwards compatible
100	foreach ($p as $prop => $value)
101	if (preg_match('/^(.+)_field$/', $prop, $matches))
102	$this->fieldmap[$matches[1]] = $this->_attr_name(strtolower($value));
103	}
104
105	// use fieldmap to advertise supported coltypes to the application
106	foreach ($this->fieldmap as $col => $lf) {
107	list($col, $type) = explode(':', $col);
108	if (!is_array($this->coltypes[$col])) {
109	$subtypes = $type ? array($type) : null;
110	$this->coltypes[$col] = array('limit' => 1, 'subtypes' => $subtypes);
111	}
112	elseif ($type) {
113	$this->coltypes[$col]['subtypes'][] = $type;
114	$this->coltypes[$col]['limit']++;
115	}
116	if ($type && !$this->fieldmap[$col])
117	$this->fieldmap[$col] = $lf;
118	}
119
120	// support for composite address
121	if ($this->fieldmap['street'] && $this->fieldmap['locality']) {
122	$this->coltypes['address'] = array('limit' => max(1, $this->coltypes['locality']['limit']), 'subtypes' => $this->coltypes['locality']['subtypes'], 'childs' => array());
123	foreach (array('street','locality','zipcode','region','country') as $childcol) {
124	if ($this->fieldmap[$childcol]) {
125	$this->coltypes['address']['childs'][$childcol] = array('type' => 'text');
126	unset($this->coltypes[$childcol]); // remove address child col from global coltypes list
127	}
128	}
129	}
130	else if ($this->coltypes['address'])
131	$this->coltypes['address'] = array('type' => 'textarea', 'childs' => null, 'limit' => 1, 'size' => 40);
132
133	// make sure 'required_fields' is an array
134	if (!is_array($this->prop['required_fields']))
135	$this->prop['required_fields'] = (array) $this->prop['required_fields'];
136
137	foreach ($this->prop['required_fields'] as $key => $val)
138	$this->prop['required_fields'][$key] = $this->_attr_name(strtolower($val));
139
140	$this->sort_col = is_array($p['sort']) ? $p['sort'][0] : $p['sort'];
141	$this->debug = $debug;
142	$this->mail_domain = $mail_domain;
143
144	// initialize cache
145	$rcmail = rcmail::get_instance();
146	$this->cache = $rcmail->get_cache('LDAP.' . asciiwords($this->prop['name']), 'db', 600);
147
148	$this->_connect();
149	}
150
151
152	/**
153	* Establish a connection to the LDAP server
154	*/
155	private function _connect()
156	{
157	global $RCMAIL;
158
159	if (!function_exists('ldap_connect'))
160	raise_error(array('code' => 100, 'type' => 'ldap',
161	'file' => __FILE__, 'line' => __LINE__,
162	'message' => "No ldap support in this installation of PHP"),
163	true, true);
164
165	if (is_resource($this->conn))
166	return true;
167
168	if (!is_array($this->prop['hosts']))
169	$this->prop['hosts'] = array($this->prop['hosts']);
170
171	if (empty($this->prop['ldap_version']))
172	$this->prop['ldap_version'] = 3;
173
174	foreach ($this->prop['hosts'] as $host)
175	{
176	$host = idn_to_ascii(rcube_parse_host($host));
177	$hostname = $host.($this->prop['port'] ? ':'.$this->prop['port'] : '');
178
179	$this->_debug("C: Connect [$hostname] [{$this->prop['name']}]");
180
181	if ($lc = @ldap_connect($host, $this->prop['port']))
182	{
183	if ($this->prop['use_tls'] === true)
184	if (!ldap_start_tls($lc))
185	continue;
186
187	$this->_debug("S: OK");
188
189	ldap_set_option($lc, LDAP_OPT_PROTOCOL_VERSION, $this->prop['ldap_version']);
190	$this->prop['host'] = $host;
191	$this->conn = $lc;
192
193	if (isset($this->prop['referrals']))
194	ldap_set_option($lc, LDAP_OPT_REFERRALS, $this->prop['referrals']);
195	break;
196	}
197	$this->_debug("S: NOT OK");
198	}
199
200	// See if the directory is writeable.
201	if ($this->prop['writable']) {
202	$this->readonly = false;
203	}
204
205	if (!is_resource($this->conn)) {
206	raise_error(array('code' => 100, 'type' => 'ldap',
207	'file' => __FILE__, 'line' => __LINE__,
208	'message' => "Could not connect to any LDAP server, last tried $hostname"), true);
209
210	return false;
211	}
212
213	$bind_pass = $this->prop['bind_pass'];
214	$bind_user = $this->prop['bind_user'];
215	$bind_dn = $this->prop['bind_dn'];
216
217	$this->base_dn = $this->prop['base_dn'];
218	$this->groups_base_dn = ($this->prop['groups']['base_dn']) ?
219	$this->prop['groups']['base_dn'] : $this->base_dn;
220
221	// User specific access, generate the proper values to use.
222	if ($this->prop['user_specific']) {
223	// No password set, use the session password
224	if (empty($bind_pass)) {
225	$bind_pass = $RCMAIL->decrypt($_SESSION['password']);
226	}
227
228	// Get the pieces needed for variable replacement.
229	if ($fu = $RCMAIL->user->get_username())
230	list($u, $d) = explode('@', $fu);
231	else
232	$d = $this->mail_domain;
233
234	$dc = 'dc='.strtr($d, array('.' => ',dc=')); // hierarchal domain string
235
236	$replaces = array('%dn' => '', '%dc' => $dc, '%d' => $d, '%fu' => $fu, '%u' => $u);
237
238	if ($this->prop['search_base_dn'] && $this->prop['search_filter']) {
239	if (!empty($this->prop['search_bind_dn']) && !empty($this->prop['search_bind_pw'])) {
240	$this->bind($this->prop['search_bind_dn'], $this->prop['search_bind_pw']);
241	}
242
243	// Search for the dn to use to authenticate
244	$this->prop['search_base_dn'] = strtr($this->prop['search_base_dn'], $replaces);
245	$this->prop['search_filter'] = strtr($this->prop['search_filter'], $replaces);
246
247	$this->_debug("S: searching with base {$this->prop['search_base_dn']} for {$this->prop['search_filter']}");
248
249	$res = @ldap_search($this->conn, $this->prop['search_base_dn'], $this->prop['search_filter'], array('uid'));
250	if ($res) {
251	if (($entry = ldap_first_entry($this->conn, $res))
252	&& ($bind_dn = ldap_get_dn($this->conn, $entry))
253	) {
254	$this->_debug("S: search returned dn: $bind_dn");
255	$dn = ldap_explode_dn($bind_dn, 1);
256	$replaces['%dn'] = $dn[0];
257	}
258	}
259	else {
260	$this->_debug("S: ".ldap_error($this->conn));
261	}
262
263	// DN not found
264	if (empty($replaces['%dn'])) {
265	if (!empty($this->prop['search_dn_default']))
266	$replaces['%dn'] = $this->prop['search_dn_default'];
267	else {
268	raise_error(array(
269	'code' => 100, 'type' => 'ldap',
270	'file' => __FILE__, 'line' => __LINE__,
271	'message' => "DN not found using LDAP search."), true);
272	return false;
273	}
274	}
275	}
276
277	// Replace the bind_dn and base_dn variables.
278	$bind_dn = strtr($bind_dn, $replaces);
279	$this->base_dn = strtr($this->base_dn, $replaces);
280	$this->groups_base_dn = strtr($this->groups_base_dn, $replaces);
281
282	if (empty($bind_user)) {
283	$bind_user = $u;
284	}
285	}
286
287	if (empty($bind_pass)) {
288	$this->ready = true;
289	}
290	else {
291	if (!empty($bind_dn)) {
292	$this->ready = $this->bind($bind_dn, $bind_pass);
293	}
294	else if (!empty($this->prop['auth_cid'])) {
295	$this->ready = $this->sasl_bind($this->prop['auth_cid'], $bind_pass, $bind_user);
296	}
297	else {
298	$this->ready = $this->sasl_bind($bind_user, $bind_pass);
299	}
300	}
301
302	return $this->ready;
303	}
304
305
306	/**
307	* Bind connection with (SASL-) user and password
308	*
309	* @param string $authc Authentication user
310	* @param string $pass Bind password
311	* @param string $authz Autorization user
312	*
313	* @return boolean True on success, False on error
314	*/
315	public function sasl_bind($authc, $pass, $authz=null)
316	{
317	if (!$this->conn) {
318	return false;
319	}
320
321	if (!function_exists('ldap_sasl_bind')) {
322	raise_error(array('code' => 100, 'type' => 'ldap',
323	'file' => __FILE__, 'line' => __LINE__,
324	'message' => "Unable to bind: ldap_sasl_bind() not exists"),
325	true, true);
326	}
327
328	if (!empty($authz)) {
329	$authz = 'u:' . $authz;
330	}
331
332	if (!empty($this->prop['auth_method'])) {
333	$method = $this->prop['auth_method'];
334	}
335	else {
336	$method = 'DIGEST-MD5';
337	}
338
339	$this->_debug("C: Bind [mech: $method, authc: $authc, authz: $authz] [pass: $pass]");
340
341	if (ldap_sasl_bind($this->conn, NULL, $pass, $method, NULL, $authc, $authz)) {
342	$this->_debug("S: OK");
343	return true;
344	}
345
346	$this->_debug("S: ".ldap_error($this->conn));
347
348	raise_error(array(
349	'code' => ldap_errno($this->conn), 'type' => 'ldap',
350	'file' => __FILE__, 'line' => __LINE__,
351	'message' => "Bind failed for authcid=$authc ".ldap_error($this->conn)),
352	true);
353
354	return false;
355	}
356
357
358	/**
359	* Bind connection with DN and password
360	*
361	* @param string Bind DN
362	* @param string Bind password
363	*
364	* @return boolean True on success, False on error
365	*/
366	public function bind($dn, $pass)
367	{
368	if (!$this->conn) {
369	return false;
370	}
371
372	$this->_debug("C: Bind [dn: $dn] [pass: $pass]");
373
374	if (@ldap_bind($this->conn, $dn, $pass)) {
375	$this->_debug("S: OK");
376	return true;
377	}
378
379	$this->_debug("S: ".ldap_error($this->conn));
380
381	raise_error(array(
382	'code' => ldap_errno($this->conn), 'type' => 'ldap',
383	'file' => __FILE__, 'line' => __LINE__,
384	'message' => "Bind failed for dn=$dn: ".ldap_error($this->conn)),
385	true);
386
387	return false;
388	}
389
390
391	/**
392	* Close connection to LDAP server
393	*/
394	function close()
395	{
396	if ($this->conn)
397	{
398	$this->_debug("C: Close");
399	ldap_unbind($this->conn);
400	$this->conn = null;
401	}
402	}
403
404
405	/**
406	* Returns address book name
407	*
408	* @return string Address book name
409	*/
410	function get_name()
411	{
412	return $this->prop['name'];
413	}
414
415
416	/**
417	* Set internal sort settings
418	*
419	* @param string $sort_col Sort column
420	* @param string $sort_order Sort order
421	*/
422	function set_sort_order($sort_col, $sort_order = null)
423	{
424	if ($this->fieldmap[$sort_col])
425	$this->sort_col = $this->fieldmap[$sort_col];
426	}
427
428
429	/**
430	* Save a search string for future listings
431	*
432	* @param string $filter Filter string
433	*/
434	function set_search_set($filter)
435	{
436	$this->filter = $filter;
437	}
438
439
440	/**
441	* Getter for saved search properties
442	*
443	* @return mixed Search properties used by this class
444	*/
445	function get_search_set()
446	{
447	return $this->filter;
448	}
449
450
451	/**
452	* Reset all saved results and search parameters
453	*/
454	function reset()
455	{
456	$this->result = null;
457	$this->ldap_result = null;
458	$this->filter = '';
459	}
460
461
462	/**
463	* List the current set of contact records
464	*
465	* @param array List of cols to show
466	* @param int Only return this number of records
467	*
468	* @return array Indexed list of contact records, each a hash array
469	*/
470	function list_records($cols=null, $subset=0)
471	{
472	if ($this->prop['searchonly'] && empty($this->filter) && !$this->group_id)
473	{
474	$this->result = new rcube_result_set(0);
475	$this->result->searchonly = true;
476	return $this->result;
477	}
478
479	// fetch group members recursively
480	if ($this->group_id && $this->group_data['dn'])
481	{
482	$entries = $this->list_group_members($this->group_data['dn']);
483
484	// make list of entries unique and sort it
485	$seen = array();
486	foreach ($entries as $i => $rec) {
487	if ($seen[$rec['dn']]++)
488	unset($entries[$i]);
489	}
490	usort($entries, array($this, '_entry_sort_cmp'));
491
492	$entries['count'] = count($entries);
493	$this->result = new rcube_result_set($entries['count'], ($this->list_page-1) * $this->page_size);
494	}
495	else
496	{
497	// add general filter to query
498	if (!empty($this->prop['filter']) && empty($this->filter))
499	$this->set_search_set($this->prop['filter']);
500
501	// exec LDAP search if no result resource is stored
502	if ($this->conn && !$this->ldap_result)
503	$this->_exec_search();
504
505	// count contacts for this user
506	$this->result = $this->count();
507
508	// we have a search result resource
509	if ($this->ldap_result && $this->result->count > 0)
510	{
511	// sorting still on the ldap server
512	if ($this->sort_col && $this->prop['scope'] !== 'base' && !$this->vlv_active)
513	ldap_sort($this->conn, $this->ldap_result, $this->sort_col);
514
515	// get all entries from the ldap server
516	$entries = ldap_get_entries($this->conn, $this->ldap_result);
517	}
518
519	} // end else
520
521	// start and end of the page
522	$start_row = $this->vlv_active ? 0 : $this->result->first;
523	$start_row = $subset < 0 ? $start_row + $this->page_size + $subset : $start_row;
524	$last_row = $this->result->first + $this->page_size;
525	$last_row = $subset != 0 ? $start_row + abs($subset) : $last_row;
526
527	// filter entries for this page
528	for ($i = $start_row; $i < min($entries['count'], $last_row); $i++)
529	$this->result->add($this->_ldap2result($entries[$i]));
530
531	return $this->result;
532	}
533
534	/**
535	* Get all members of the given group
536	*
537	* @param string Group DN
538	* @param array Group entries (if called recursively)
539	* @return array Accumulated group members
540	*/
541	function list_group_members($dn, $count = false, $entries = null)
542	{
543	$group_members = array();
544
545	// fetch group object
546	if (empty($entries)) {
547	$result = @ldap_read($this->conn, $dn, '(objectClass=*)', array('dn','objectClass','member','uniqueMember','memberURL'));
548	if ($result === false)
549	{
550	$this->_debug("S: ".ldap_error($this->conn));
551	return $group_members;
552	}
553
554	$entries = @ldap_get_entries($this->conn, $result);
555	}
556
557	for ($i=0; $i < $entries['count']; $i++)
558	{
559	$entry = $entries[$i];
560
561	if (empty($entry['objectclass']))
562	continue;
563
564	foreach ((array)$entry['objectclass'] as $objectclass)
565	{
566	switch (strtolower($objectclass)) {
567	case "group":
568	case "groupofnames":
569	case "kolabgroupofnames":
570	$group_members = array_merge($group_members, $this->_list_group_members($dn, $entry, 'member', $count));
571	break;
572	case "groupofuniquenames":
573	case "kolabgroupofuniquenames":
574	$group_members = array_merge($group_members, $this->_list_group_members($dn, $entry, 'uniquemember', $count));
575	break;
576	case "groupofurls":
577	$group_members = array_merge($group_members, $this->_list_group_memberurl($dn, $entry, $count));
578	break;
579	}
580	}
581
582	if ($this->prop['sizelimit'] && count($group_members) > $this->prop['sizelimit'])
583	break;
584	}
585
586	return array_filter($group_members);
587	}
588
589	/**
590	* Fetch members of the given group entry from server
591	*
592	* @param string Group DN
593	* @param array Group entry
594	* @param string Member attribute to use
595	* @return array Accumulated group members
596	*/
597	private function _list_group_members($dn, $entry, $attr, $count)
598	{
599	// Use the member attributes to return an array of member ldap objects
600	// NOTE that the member attribute is supposed to contain a DN
601	$group_members = array();
602	if (empty($entry[$attr]))
603	return $group_members;
604
605	// read these attributes for all members
606	$attrib = $count ? array('dn') : array_values($this->fieldmap);
607	$attrib[] = 'objectClass';
608	$attrib[] = 'member';
609	$attrib[] = 'uniqueMember';
610	$attrib[] = 'memberURL';
611
612	for ($i=0; $i < $entry[$attr]['count']; $i++)
613	{
614	if (empty($entry[$attr][$i]))
615	continue;
616
617	$result = @ldap_read($this->conn, $entry[$attr][$i], '(objectclass=*)',
618	$attrib, 0, (int)$this->prop['sizelimit'], (int)$this->prop['timelimit']);
619
620	$members = @ldap_get_entries($this->conn, $result);
621	if ($members == false)
622	{
623	$this->_debug("S: ".ldap_error($this->conn));
624	$members = array();
625	}
626
627	// for nested groups, call recursively
628	$nested_group_members = $this->list_group_members($entry[$attr][$i], $count, $members);
629
630	unset($members['count']);
631	$group_members = array_merge($group_members, array_filter($members), $nested_group_members);
632	}
633
634	return $group_members;
635	}
636
637	/**
638	* List members of group class groupOfUrls
639	*
640	* @param string Group DN
641	* @param array Group entry
642	* @param boolean True if only used for counting
643	* @return array Accumulated group members
644	*/
645	private function _list_group_memberurl($dn, $entry, $count)
646	{
647	$group_members = array();
648
649	for ($i=0; $i < $entry['memberurl']['count']; $i++)
650	{
651	// extract components from url
652	if (!preg_match('!ldap:///([^\?]+)\?\?(\w+)\?(.*)$!', $entry['memberurl'][$i], $m))
653	continue;
654
655	// add search filter if any
656	$filter = $this->filter ? '(&(' . $m[3] . ')(' . $this->filter . '))' : $m[3];
657	$func = $m[2] == 'sub' ? 'ldap_search' : ($m[2] == 'base' ? 'ldap_read' : 'ldap_list');
658
659	$attrib = $count ? array('dn') : array_values($this->fieldmap);
660	if ($result = @$func($this->conn, $m[1], $filter,
661	$attrib, 0, (int)$this->prop['sizelimit'], (int)$this->prop['timelimit'])
662	) {
663	$this->_debug("S: ".ldap_count_entries($this->conn, $result)." record(s) for ".$m[1]);
664	}
665	else {
666	$this->_debug("S: ".ldap_error($this->conn));
667	return $group_members;
668	}
669
670	$entries = @ldap_get_entries($this->conn, $result);
671	for ($j = 0; $j < $entries['count']; $j++)
672	{
673	if ($nested_group_members = $this->list_group_members($entries[$j]['dn'], $count))
674	$group_members = array_merge($group_members, $nested_group_members);
675	else
676	$group_members[] = $entries[$j];
677	}
678	}
679
680	return $group_members;
681	}
682
683	/**
684	* Callback for sorting entries
685	*/
686	function _entry_sort_cmp($a, $b)
687	{
688	return strcmp($a[$this->sort_col][0], $b[$this->sort_col][0]);
689	}
690
691
692	/**
693	* Search contacts
694	*
695	* @param mixed $fields The field name of array of field names to search in
696	* @param mixed $value Search value (or array of values when $fields is array)
697	* @param int $mode Matching mode:
698	* 0 - partial (abc),
699	* 1 - strict (=),
700	* 2 - prefix (abc*)
701	* @param boolean $select True if results are requested, False if count only
702	* @param boolean $nocount (Not used)
703	* @param array $required List of fields that cannot be empty
704	*
705	* @return array Indexed list of contact records and 'count' value
706	*/
707	function search($fields, $value, $mode=0, $select=true, $nocount=false, $required=array())
708	{
709	$mode = intval($mode);
710
711	// special treatment for ID-based search
712	if ($fields == 'ID' \|\| $fields == $this->primary_key)
713	{
714	$ids = !is_array($value) ? explode(',', $value) : $value;
715	$result = new rcube_result_set();
716	foreach ($ids as $id)
717	{
718	if ($rec = $this->get_record($id, true))
719	{
720	$result->add($rec);
721	$result->count++;
722	}
723	}
724	return $result;
725	}
726
727	// use VLV pseudo-search for autocompletion
728	if ($this->prop['vlv_search'] && $this->conn && join(',', (array)$fields) == 'email,name')
729	{
730	// add general filter to query
731	if (!empty($this->prop['filter']) && empty($this->filter))
732	$this->set_search_set($this->prop['filter']);
733
734	// set VLV controls with encoded search string
735	$this->_vlv_set_controls($this->prop, $this->list_page, $this->page_size, $value);
736
737	$function = $this->_scope2func($this->prop['scope']);
738	$this->ldap_result = @$function($this->conn, $this->base_dn, $this->filter ? $this->filter : '(objectclass=*)',
739	array_values($this->fieldmap), 0, $this->page_size, (int)$this->prop['timelimit']);
740
741	$this->result = new rcube_result_set(0);
742
743	if (!$this->ldap_result) {
744	$this->_debug("S: ".ldap_error($this->conn));
745	return $this->result;
746	}
747
748	$this->_debug("S: ".ldap_count_entries($this->conn, $this->ldap_result)." record(s)");
749
750	// get all entries of this page and post-filter those that really match the query
751	$search = mb_strtolower($value);
752	$entries = ldap_get_entries($this->conn, $this->ldap_result);
753
754	for ($i = 0; $i < $entries['count']; $i++) {
755	$rec = $this->_ldap2result($entries[$i]);
756	foreach (array('email', 'name') as $f) {
757	$val = mb_strtolower($rec[$f]);
758	switch ($mode) {
759	case 1:
760	$got = ($val == $search);
761	break;
762	case 2:
763	$got = ($search == substr($val, 0, strlen($search)));
764	break;
765	default:
766	$got = (strpos($val, $search) !== false);
767	break;
768	}
769
770	if ($got) {
771	$this->result->add($rec);
772	$this->result->count++;
773	break;
774	}
775	}
776	}
777
778	return $this->result;
779	}
780
781	// use AND operator for advanced searches
782	$filter = is_array($value) ? '(&' : '(\|';
783	// set wildcards
784	$wp = $ws = '';
785	if (!empty($this->prop['fuzzy_search']) && $mode != 1) {
786	$ws = '*';
787	if (!$mode) {
788	$wp = '*';
789	}
790	}
791
792	if ($fields == '*')
793	{
794	// search_fields are required for fulltext search
795	if (empty($this->prop['search_fields']))
796	{
797	$this->set_error(self::ERROR_SEARCH, 'nofulltextsearch');
798	$this->result = new rcube_result_set();
799	return $this->result;
800	}
801	if (is_array($this->prop['search_fields']))
802	{
803	foreach ($this->prop['search_fields'] as $field) {
804	$filter .= "($field=$wp" . $this->_quote_string($value) . "$ws)";
805	}
806	}
807	}
808	else
809	{
810	foreach ((array)$fields as $idx => $field) {
811	$val = is_array($value) ? $value[$idx] : $value;
812	if ($f = $this->_map_field($field)) {
813	$filter .= "($f=$wp" . $this->_quote_string($val) . "$ws)";
814	}
815	}
816	}
817	$filter .= ')';
818
819	// add required (non empty) fields filter
820	$req_filter = '';
821	foreach ((array)$required as $field)
822	if ($f = $this->_map_field($field))
823	$req_filter .= "($f=*)";
824
825	if (!empty($req_filter))
826	$filter = '(&' . $req_filter . $filter . ')';
827
828	// avoid double-wildcard if $value is empty
829	$filter = preg_replace('/\+/', '', $filter);
830
831	// add general filter to query
832	if (!empty($this->prop['filter']))
833	$filter = '(&(' . preg_replace('/^\(\|\)$/', '', $this->prop['filter']) . ')' . $filter . ')';
834
835	// set filter string and execute search
836	$this->set_search_set($filter);
837	$this->_exec_search();
838
839	if ($select)
840	$this->list_records();
841	else
842	$this->result = $this->count();
843
844	return $this->result;
845	}
846
847
848	/**
849	* Count number of available contacts in database
850	*
851	* @return object rcube_result_set Resultset with values for 'count' and 'first'
852	*/
853	function count()
854	{
855	$count = 0;
856	if ($this->conn && $this->ldap_result) {
857	$count = $this->vlv_active ? $this->vlv_count : ldap_count_entries($this->conn, $this->ldap_result);
858	}
859	else if ($this->group_id && $this->group_data['dn']) {
860	$count = count($this->list_group_members($this->group_data['dn'], true));
861	}
862	else if ($this->conn) {
863	// We have a connection but no result set, attempt to get one.
864	if (empty($this->filter)) {
865	// The filter is not set, set it.
866	$this->filter = $this->prop['filter'];
867	}
868
869	$count = (int) $this->_exec_search(true);
870	}
871
872	return new rcube_result_set($count, ($this->list_page-1) * $this->page_size);
873	}
874
875
876	/**
877	* Return the last result set
878	*
879	* @return object rcube_result_set Current resultset or NULL if nothing selected yet
880	*/
881	function get_result()
882	{
883	return $this->result;
884	}
885
886
887	/**
888	* Get a specific contact record
889	*
890	* @param mixed Record identifier
891	* @param boolean Return as associative array
892	*
893	* @return mixed Hash array or rcube_result_set with all record fields
894	*/
895	function get_record($dn, $assoc=false)
896	{
897	$res = null;
898	if ($this->conn && $dn)
899	{
900	$dn = self::dn_decode($dn);
901
902	$this->_debug("C: Read [dn: $dn] [(objectclass=*)]");
903
904	if ($this->ldap_result = @ldap_read($this->conn, $dn, '(objectclass=*)', array_values($this->fieldmap)))
905	$entry = ldap_first_entry($this->conn, $this->ldap_result);
906	else
907	$this->_debug("S: ".ldap_error($this->conn));
908
909	if ($entry && ($rec = ldap_get_attributes($this->conn, $entry)))
910	{
911	$this->_debug("S: OK"/* . print_r($rec, true)*/);
912
913	$rec = array_change_key_case($rec, CASE_LOWER);
914
915	// Add in the dn for the entry.
916	$rec['dn'] = $dn;
917	$res = $this->_ldap2result($rec);
918	$this->result = new rcube_result_set(1);
919	$this->result->add($res);
920	}
921	}
922
923	return $assoc ? $res : $this->result;
924	}
925
926
927	/**
928	* Check the given data before saving.
929	* If input not valid, the message to display can be fetched using get_error()
930	*
931	* @param array Assoziative array with data to save
932	* @param boolean Try to fix/complete record automatically
933	* @return boolean True if input is valid, False if not.
934	*/
935	public function validate(&$save_data, $autofix = false)
936	{
937	// check for name input
938	if (empty($save_data['name'])) {
939	$this->set_error(self::ERROR_VALIDATE, 'nonamewarning');
940	return false;
941	}
942
943	// Verify that the required fields are set.
944	$missing = null;
945	$ldap_data = $this->_map_data($save_data);
946	foreach ($this->prop['required_fields'] as $fld) {
947	if (!isset($ldap_data[$fld])) {
948	$missing[$fld] = 1;
949	}
950	}
951
952	if ($missing) {
953	// try to complete record automatically
954	if ($autofix) {
955	$reverse_map = array_flip($this->fieldmap);
956	$name_parts = preg_split('/[\s,.]+/', $save_data['name']);
957	if ($missing['sn']) {
958	$sn_field = $reverse_map['sn'];
959	$save_data[$sn_field] = array_pop ($name_parts);
960	}
961	if ($missing[($fn_field = $this->fieldmap['firstname'])]) {
962	$save_data['firstname'] = array_shift($name_parts);
963	}
964
965	return $this->validate($save_data, false);
966	}
967
968	// TODO: generate message saying which fields are missing
969	$this->set_error(self::ERROR_VALIDATE, 'formincomplete');
970	return false;
971	}
972
973	// validate e-mail addresses
974	return parent::validate($save_data, $autofix);
975	}
976
977
978	/**
979	* Create a new contact record
980	*
981	* @param array Hash array with save data
982	*
983	* @return encoded record ID on success, False on error
984	*/
985	function insert($save_cols)
986	{
987	// Map out the column names to their LDAP ones to build the new entry.
988	$newentry = $this->_map_data($save_cols);
989	$newentry['objectClass'] = $this->prop['LDAP_Object_Classes'];
990
991	// Verify that the required fields are set.
992	$missing = null;
993	foreach ($this->prop['required_fields'] as $fld) {
994	if (!isset($newentry[$fld])) {
995	$missing[] = $fld;
996	}
997	}
998
999	// abort process if requiered fields are missing
1000	// TODO: generate message saying which fields are missing
1001	if ($missing) {
1002	$this->set_error(self::ERROR_VALIDATE, 'formincomplete');
1003	return false;
1004	}
1005
1006	// Build the new entries DN.
1007	$dn = $this->prop['LDAP_rdn'].'='.$this->_quote_string($newentry[$this->prop['LDAP_rdn']], true).','.$this->base_dn;
1008
1009	$this->_debug("C: Add [dn: $dn]: ".print_r($newentry, true));
1010
1011	$res = ldap_add($this->conn, $dn, $newentry);
1012	if ($res === FALSE) {
1013	$this->_debug("S: ".ldap_error($this->conn));
1014	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1015	return false;
1016	} // end if
1017
1018	$this->_debug("S: OK");
1019
1020	$dn = self::dn_encode($dn);
1021
1022	// add new contact to the selected group
1023	if ($this->group_id)
1024	$this->add_to_group($this->group_id, $dn);
1025
1026	return $dn;
1027	}
1028
1029
1030	/**
1031	* Update a specific contact record
1032	*
1033	* @param mixed Record identifier
1034	* @param array Hash array with save data
1035	*
1036	* @return boolean True on success, False on error
1037	*/
1038	function update($id, $save_cols)
1039	{
1040	$record = $this->get_record($id, true);
1041	$result = $this->get_result();
1042	$record = $result->first();
1043
1044	$newdata = array();
1045	$replacedata = array();
1046	$deletedata = array();
1047
1048	$ldap_data = $this->_map_data($save_cols);
1049	$old_data = $record['_raw_attrib'];
1050
1051	foreach ($this->fieldmap as $col => $fld) {
1052	$val = $ldap_data[$fld];
1053	if ($fld) {
1054	// remove empty array values
1055	if (is_array($val))
1056	$val = array_filter($val);
1057	// The field does exist compare it to the ldap record.
1058	if ($old_data[$fld] != $val) {
1059	// Changed, but find out how.
1060	if (!isset($old_data[$fld])) {
1061	// Field was not set prior, need to add it.
1062	$newdata[$fld] = $val;
1063	}
1064	else if ($val == '') {
1065	// Field supplied is empty, verify that it is not required.
1066	if (!in_array($fld, $this->prop['required_fields'])) {
1067	// It is not, safe to clear.
1068	$deletedata[$fld] = $old_data[$fld];
1069	}
1070	} // end elseif
1071	else {
1072	// The data was modified, save it out.
1073	$replacedata[$fld] = $val;
1074	}
1075	} // end if
1076	} // end if
1077	} // end foreach
1078
1079	$dn = self::dn_decode($id);
1080
1081	// Update the entry as required.
1082	if (!empty($deletedata)) {
1083	// Delete the fields.
1084	$this->_debug("C: Delete [dn: $dn]: ".print_r($deletedata, true));
1085	if (!ldap_mod_del($this->conn, $dn, $deletedata)) {
1086	$this->_debug("S: ".ldap_error($this->conn));
1087	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1088	return false;
1089	}
1090	$this->_debug("S: OK");
1091	} // end if
1092
1093	if (!empty($replacedata)) {
1094	// Handle RDN change
1095	if ($replacedata[$this->prop['LDAP_rdn']]) {
1096	$newdn = $this->prop['LDAP_rdn'].'='
1097	.$this->_quote_string($replacedata[$this->prop['LDAP_rdn']], true)
1098	.','.$this->base_dn;
1099	if ($dn != $newdn) {
1100	$newrdn = $this->prop['LDAP_rdn'].'='
1101	.$this->_quote_string($replacedata[$this->prop['LDAP_rdn']], true);
1102	unset($replacedata[$this->prop['LDAP_rdn']]);
1103	}
1104	}
1105	// Replace the fields.
1106	if (!empty($replacedata)) {
1107	$this->_debug("C: Replace [dn: $dn]: ".print_r($replacedata, true));
1108	if (!ldap_mod_replace($this->conn, $dn, $replacedata)) {
1109	$this->_debug("S: ".ldap_error($this->conn));
1110	return false;
1111	}
1112	$this->_debug("S: OK");
1113	} // end if
1114	} // end if
1115
1116	if (!empty($newdata)) {
1117	// Add the fields.
1118	$this->_debug("C: Add [dn: $dn]: ".print_r($newdata, true));
1119	if (!ldap_mod_add($this->conn, $dn, $newdata)) {
1120	$this->_debug("S: ".ldap_error($this->conn));
1121	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1122	return false;
1123	}
1124	$this->_debug("S: OK");
1125	} // end if
1126
1127	// Handle RDN change
1128	if (!empty($newrdn)) {
1129	$this->_debug("C: Rename [dn: $dn] [dn: $newrdn]");
1130	if (!ldap_rename($this->conn, $dn, $newrdn, NULL, TRUE)) {
1131	$this->_debug("S: ".ldap_error($this->conn));
1132	return false;
1133	}
1134	$this->_debug("S: OK");
1135
1136	$dn = self::dn_encode($dn);
1137	$newdn = self::dn_encode($newdn);
1138
1139	// change the group membership of the contact
1140	if ($this->groups)
1141	{
1142	$group_ids = $this->get_record_groups($dn);
1143	foreach ($group_ids as $group_id)
1144	{
1145	$this->remove_from_group($group_id, $dn);
1146	$this->add_to_group($group_id, $newdn);
1147	}
1148	}
1149
1150	return $newdn;
1151	}
1152
1153	return true;
1154	}
1155
1156
1157	/**
1158	* Mark one or more contact records as deleted
1159	*
1160	* @param array Record identifiers
1161	* @param boolean Remove record(s) irreversible (unsupported)
1162	*
1163	* @return boolean True on success, False on error
1164	*/
1165	function delete($ids, $force=true)
1166	{
1167	if (!is_array($ids)) {
1168	// Not an array, break apart the encoded DNs.
1169	$ids = explode(',', $ids);
1170	} // end if
1171
1172	foreach ($ids as $id) {
1173	$dn = self::dn_decode($id);
1174	$this->_debug("C: Delete [dn: $dn]");
1175	// Delete the record.
1176	$res = ldap_delete($this->conn, $dn);
1177	if ($res === FALSE) {
1178	$this->_debug("S: ".ldap_error($this->conn));
1179	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1180	return false;
1181	} // end if
1182	$this->_debug("S: OK");
1183
1184	// remove contact from all groups where he was member
1185	if ($this->groups) {
1186	$dn = self::dn_encode($dn);
1187	$group_ids = $this->get_record_groups($dn);
1188	foreach ($group_ids as $group_id) {
1189	$this->remove_from_group($group_id, $dn);
1190	}
1191	}
1192	} // end foreach
1193
1194	return count($ids);
1195	}
1196
1197
1198	/**
1199	* Execute the LDAP search based on the stored credentials
1200	*/
1201	private function _exec_search($count = false)
1202	{
1203	if ($this->ready)
1204	{
1205	$filter = $this->filter ? $this->filter : '(objectclass=*)';
1206	$function = $this->_scope2func($this->prop['scope'], $ns_function);
1207
1208	$this->_debug("C: Search [$filter][dn: $this->base_dn]");
1209
1210	// when using VLV, we get the total count by...
1211	if (!$count && $function != 'ldap_read' && $this->prop['vlv'] && !$this->group_id) {
1212	// ...either reading numSubOrdinates attribute
1213	if ($this->prop['numsub_filter'] && ($result_count = @$ns_function($this->conn, $this->base_dn, $this->prop['numsub_filter'], array('numSubOrdinates'), 0, 0, 0))) {
1214	$counts = ldap_get_entries($this->conn, $result_count);
1215	for ($this->vlv_count = $j = 0; $j < $counts['count']; $j++)
1216	$this->vlv_count += $counts[$j]['numsubordinates'][0];
1217	$this->_debug("D: total numsubordinates = " . $this->vlv_count);
1218	}
1219	else if (!function_exists('ldap_parse_virtuallist_control')) // ...or by fetching all records dn and count them
1220	$this->vlv_count = $this->_exec_search(true);
1221
1222	$this->vlv_active = $this->_vlv_set_controls($this->prop, $this->list_page, $this->page_size);
1223	}
1224
1225	// only fetch dn for count (should keep the payload low)
1226	$attrs = $count ? array('dn') : array_values($this->fieldmap);
1227	if ($this->ldap_result = @$function($this->conn, $this->base_dn, $filter,
1228	$attrs, 0, (int)$this->prop['sizelimit'], (int)$this->prop['timelimit'])
1229	) {
1230	// when running on a patched PHP we can use the extended functions to retrieve the total count from the LDAP search result
1231	if ($this->vlv_active && function_exists('ldap_parse_virtuallist_control')) {
1232	if (ldap_parse_result($this->conn, $this->ldap_result,
1233	$errcode, $matcheddn, $errmsg, $referrals, $serverctrls)
1234	) {
1235	ldap_parse_virtuallist_control($this->conn, $serverctrls,
1236	$last_offset, $this->vlv_count, $vresult);
1237	$this->_debug("S: VLV result: last_offset=$last_offset; content_count=$this->vlv_count");
1238	}
1239	else {
1240	$this->_debug("S: ".($errmsg ? $errmsg : ldap_error($this->conn)));
1241	}
1242	}
1243
1244	$entries_count = ldap_count_entries($this->conn, $this->ldap_result);
1245	$this->_debug("S: $entries_count record(s)");
1246
1247	return $count ? $entries_count : true;
1248	}
1249	else {
1250	$this->_debug("S: ".ldap_error($this->conn));
1251	}
1252	}
1253
1254	return false;
1255	}
1256
1257	/**
1258	* Choose the right PHP function according to scope property
1259	*/
1260	private function _scope2func($scope, &$ns_function = null)
1261	{
1262	switch ($scope) {
1263	case 'sub':
1264	$function = $ns_function = 'ldap_search';
1265	break;
1266	case 'base':
1267	$function = $ns_function = 'ldap_read';
1268	break;
1269	default:
1270	$function = 'ldap_list';
1271	$ns_function = 'ldap_read';
1272	break;
1273	}
1274
1275	return $function;
1276	}
1277
1278	/**
1279	* Set server controls for Virtual List View (paginated listing)
1280	*/
1281	private function _vlv_set_controls($prop, $list_page, $page_size, $search = null)
1282	{
1283	$sort_ctrl = array('oid' => "1.2.840.113556.1.4.473", 'value' => $this->_sort_ber_encode((array)$prop['sort']));
1284	$vlv_ctrl = array('oid' => "2.16.840.1.113730.3.4.9", 'value' => $this->_vlv_ber_encode(($offset = ($list_page-1) * $page_size + 1), $page_size, $search), 'iscritical' => true);
1285
1286	$sort = (array)$prop['sort'];
1287	$this->_debug("C: set controls sort=" . join(' ', unpack('H'.(strlen($sort_ctrl['value'])*2), $sort_ctrl['value'])) . " ($sort[0]);"
1288	. " vlv=" . join(' ', (unpack('H'.(strlen($vlv_ctrl['value'])*2), $vlv_ctrl['value']))) . " ($offset/$page_size)");
1289
1290	if (!ldap_set_option($this->conn, LDAP_OPT_SERVER_CONTROLS, array($sort_ctrl, $vlv_ctrl))) {
1291	$this->_debug("S: ".ldap_error($this->conn));
1292	$this->set_error(self::ERROR_SEARCH, 'vlvnotsupported');
1293	return false;
1294	}
1295
1296	return true;
1297	}
1298
1299
1300	/**
1301	* Converts LDAP entry into an array
1302	*/
1303	private function _ldap2result($rec)
1304	{
1305	$out = array();
1306
1307	if ($rec['dn'])
1308	$out[$this->primary_key] = self::dn_encode($rec['dn']);
1309
1310	foreach ($this->fieldmap as $rf => $lf)
1311	{
1312	for ($i=0; $i < $rec[$lf]['count']; $i++) {
1313	if (!($value = $rec[$lf][$i]))
1314	continue;
1315
1316	list($col, $subtype) = explode(':', $rf);
1317	$out['_raw_attrib'][$lf][$i] = $value;
1318
1319	if ($rf == 'email' && $this->mail_domain && !strpos($value, '@'))
1320	$out[$rf][] = sprintf('%s@%s', $value, $this->mail_domain);
1321	else if (in_array($col, array('street','zipcode','locality','country','region')))
1322	$out['address'.($subtype?':':'').$subtype][$i][$col] = $value;
1323	else if ($rec[$lf]['count'] > 1)
1324	$out[$rf][] = $value;
1325	else
1326	$out[$rf] = $value;
1327	}
1328
1329	// Make sure name fields aren't arrays (#1488108)
1330	if (is_array($out[$rf]) && in_array($rf, array('name', 'surname', 'firstname', 'middlename', 'nickname'))) {
1331	$out[$rf] = $out['_raw_attrib'][$lf] = $out[$rf][0];
1332	}
1333	}
1334
1335	return $out;
1336	}
1337
1338
1339	/**
1340	* Return real field name (from fields map)
1341	*/
1342	private function _map_field($field)
1343	{
1344	return $this->fieldmap[$field];
1345	}
1346
1347
1348	/**
1349	* Convert a record data set into LDAP field attributes
1350	*/
1351	private function _map_data($save_cols)
1352	{
1353	// flatten composite fields first
1354	foreach ($this->coltypes as $col => $colprop) {
1355	if (is_array($colprop['childs']) && ($values = $this->get_col_values($col, $save_cols, false))) {
1356	foreach ($values as $subtype => $childs) {
1357	$subtype = $subtype ? ':'.$subtype : '';
1358	foreach ($childs as $i => $child_values) {
1359	foreach ((array)$child_values as $childcol => $value) {
1360	$save_cols[$childcol.$subtype][$i] = $value;
1361	}
1362	}
1363	}
1364	}
1365	}
1366
1367	$ldap_data = array();
1368	foreach ($this->fieldmap as $col => $fld) {
1369	$val = $save_cols[$col];
1370	if (is_array($val))
1371	$val = array_filter($val); // remove empty entries
1372	if ($fld && $val) {
1373	// The field does exist, add it to the entry.
1374	$ldap_data[$fld] = $val;
1375	}
1376	}
1377
1378	return $ldap_data;
1379	}
1380
1381
1382	/**
1383	* Returns unified attribute name (resolving aliases)
1384	*/
1385	private static function _attr_name($name)
1386	{
1387	// list of known attribute aliases
1388	$aliases = array(
1389	'gn' => 'givenname',
1390	'rfc822mailbox' => 'email',
1391	'userid' => 'uid',
1392	'emailaddress' => 'email',
1393	'pkcs9email' => 'email',
1394	);
1395	return isset($aliases[$name]) ? $aliases[$name] : $name;
1396	}
1397
1398
1399	/**
1400	* Prints debug info to the log
1401	*/
1402	private function _debug($str)
1403	{
1404	if ($this->debug)
1405	write_log('ldap', $str);
1406	}
1407
1408
1409	/**
1410	* Activate/deactivate debug mode
1411	*
1412	* @param boolean $dbg True if LDAP commands should be logged
1413	* @access public
1414	*/
1415	function set_debug($dbg = true)
1416	{
1417	$this->debug = $dbg;
1418	}
1419
1420
1421	/**
1422	* Quotes attribute value string
1423	*
1424	* @param string $str Attribute value
1425	* @param bool $dn True if the attribute is a DN
1426	*
1427	* @return string Quoted string
1428	*/
1429	private static function _quote_string($str, $dn=false)
1430	{
1431	// take firt entry if array given
1432	if (is_array($str))
1433	$str = reset($str);
1434
1435	if ($dn)
1436	$replace = array(','=>'\2c', '='=>'\3d', '+'=>'\2b', '<'=>'\3c',
1437	'>'=>'\3e', ';'=>'\3b', '\\'=>'\5c', '"'=>'\22', '#'=>'\23');
1438	else
1439	$replace = array('*'=>'\2a', '('=>'\28', ')'=>'\29', '\\'=>'\5c',
1440	'/'=>'\2f');
1441
1442	return strtr($str, $replace);
1443	}
1444
1445
1446	/**
1447	* Setter for the current group
1448	* (empty, has to be re-implemented by extending class)
1449	*/
1450	function set_group($group_id)
1451	{
1452	if ($group_id)
1453	{
1454	if (($group_cache = $this->cache->get('groups')) === null)
1455	$group_cache = $this->_fetch_groups();
1456
1457	$this->group_id = $group_id;
1458	$this->group_data = $group_cache[$group_id];
1459	}
1460	else
1461	{
1462	$this->group_id = 0;
1463	$this->group_data = null;
1464	}
1465	}
1466
1467	/**
1468	* List all active contact groups of this source
1469	*
1470	* @param string Optional search string to match group name
1471	* @return array Indexed list of contact groups, each a hash array
1472	*/
1473	function list_groups($search = null)
1474	{
1475	if (!$this->groups)
1476	return array();
1477
1478	// use cached list for searching
1479	$this->cache->expunge();
1480	if (!$search \|\| ($group_cache = $this->cache->get('groups')) === null)
1481	$group_cache = $this->_fetch_groups();
1482
1483	$groups = array();
1484	if ($search) {
1485	$search = mb_strtolower($search);
1486	foreach ($group_cache as $group) {
1487	if (strpos(mb_strtolower($group['name']), $search) !== false)
1488	$groups[] = $group;
1489	}
1490	}
1491	else
1492	$groups = $group_cache;
1493
1494	return array_values($groups);
1495	}
1496
1497	/**
1498	* Fetch groups from server
1499	*/
1500	private function _fetch_groups($vlv_page = 0)
1501	{
1502	$base_dn = $this->groups_base_dn;
1503	$filter = $this->prop['groups']['filter'];
1504	$name_attr = $this->prop['groups']['name_attr'];
1505	$email_attr = $this->prop['groups']['email_attr'] ? $this->prop['groups']['email_attr'] : 'mail';
1506	$sort_attrs = $this->prop['groups']['sort'] ? (array)$this->prop['groups']['sort'] : array($name_attr);
1507	$sort_attr = $sort_attrs[0];
1508
1509	$this->_debug("C: Search [$filter][dn: $base_dn]");
1510
1511	// use vlv to list groups
1512	if ($this->prop['groups']['vlv']) {
1513	$page_size = 200;
1514	if (!$this->prop['groups']['sort'])
1515	$this->prop['groups']['sort'] = $sort_attrs;
1516	$vlv_active = $this->_vlv_set_controls($this->prop['groups'], $vlv_page+1, $page_size);
1517	}
1518
1519	$function = $this->_scope2func($this->prop['groups']['scope'], $ns_function);
1520	$res = @$function($this->conn, $base_dn, $filter, array_unique(array('dn', 'objectClass', $name_attr, $email_attr, $sort_attr)));
1521	if ($res === false)
1522	{
1523	$this->_debug("S: ".ldap_error($this->conn));
1524	return array();
1525	}
1526
1527	$ldap_data = ldap_get_entries($this->conn, $res);
1528	$this->_debug("S: ".ldap_count_entries($this->conn, $res)." record(s)");
1529
1530	$groups = array();
1531	$group_sortnames = array();
1532	$group_count = $ldap_data["count"];
1533	for ($i=0; $i < $group_count; $i++)
1534	{
1535	$group_name = is_array($ldap_data[$i][$name_attr]) ? $ldap_data[$i][$name_attr][0] : $ldap_data[$i][$name_attr];
1536	$group_id = self::dn_encode($group_name);
1537	$groups[$group_id]['ID'] = $group_id;
1538	$groups[$group_id]['dn'] = $ldap_data[$i]['dn'];
1539	$groups[$group_id]['name'] = $group_name;
1540	$groups[$group_id]['member_attr'] = $this->prop['member_attr'];
1541
1542	// check objectClass attributes of group and act accordingly
1543	for ($j=0; $j < $ldap_data[$i]['objectclass']['count']; $j++) {
1544	switch (strtolower($ldap_data[$i]['objectclass'][$j])) {
1545	case 'group':
1546	case 'groupofnames':
1547	case 'kolabgroupofnames':
1548	$groups[$group_id]['member_attr'] = 'member';
1549	break;
1550
1551	case 'groupofuniquenames':
1552	case 'kolabgroupofuniquenames':
1553	$groups[$group_id]['member_attr'] = 'uniqueMember';
1554	break;
1555	}
1556	}
1557
1558	// list email attributes of a group
1559	for ($j=0; $ldap_data[$i][$email_attr] && $j < $ldap_data[$i][$email_attr]['count']; $j++) {
1560	if (strpos($ldap_data[$i][$email_attr][$j], '@') > 0)
1561	$groups[$group_id]['email'][] = $ldap_data[$i][$email_attr][$j];
1562	}
1563
1564	$group_sortnames[] = mb_strtolower($ldap_data[$i][$sort_attr][0]);
1565	}
1566
1567	// recursive call can exit here
1568	if ($vlv_page > 0)
1569	return $groups;
1570
1571	// call recursively until we have fetched all groups
1572	while ($vlv_active && $group_count == $page_size)
1573	{
1574	$next_page = $this->_fetch_groups(++$vlv_page);
1575	$groups = array_merge($groups, $next_page);
1576	$group_count = count($next_page);
1577	}
1578
1579	// when using VLV the list of groups is already sorted
1580	if (!$this->prop['groups']['vlv'])
1581	array_multisort($group_sortnames, SORT_ASC, SORT_STRING, $groups);
1582
1583	// cache this
1584	$this->cache->set('groups', $groups);
1585
1586	return $groups;
1587	}
1588
1589	/**
1590	* Get group properties such as name and email address(es)
1591	*
1592	* @param string Group identifier
1593	* @return array Group properties as hash array
1594	*/
1595	function get_group($group_id)
1596	{
1597	if (($group_cache = $this->cache->get('groups')) === null)
1598	$group_cache = $this->_fetch_groups();
1599
1600	$group_data = $group_cache[$group_id];
1601	unset($group_data['dn'], $group_data['member_attr']);
1602
1603	return $group_data;
1604	}
1605
1606	/**
1607	* Create a contact group with the given name
1608	*
1609	* @param string The group name
1610	* @return mixed False on error, array with record props in success
1611	*/
1612	function create_group($group_name)
1613	{
1614	$base_dn = $this->groups_base_dn;
1615	$new_dn = "cn=$group_name,$base_dn";
1616	$new_gid = self::dn_encode($group_name);
1617	$member_attr = $this->prop['groups']['member_attr'];
1618	$name_attr = $this->prop['groups']['name_attr'];
1619
1620	$new_entry = array(
1621	'objectClass' => $this->prop['groups']['object_classes'],
1622	$name_attr => $group_name,
1623	$member_attr => '',
1624	);
1625
1626	$this->_debug("C: Add [dn: $new_dn]: ".print_r($new_entry, true));
1627
1628	$res = ldap_add($this->conn, $new_dn, $new_entry);
1629	if ($res === false)
1630	{
1631	$this->_debug("S: ".ldap_error($this->conn));
1632	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1633	return false;
1634	}
1635
1636	$this->_debug("S: OK");
1637	$this->cache->remove('groups');
1638
1639	return array('id' => $new_gid, 'name' => $group_name);
1640	}
1641
1642	/**
1643	* Delete the given group and all linked group members
1644	*
1645	* @param string Group identifier
1646	* @return boolean True on success, false if no data was changed
1647	*/
1648	function delete_group($group_id)
1649	{
1650	if (($group_cache = $this->cache->get('groups')) === null)
1651	$group_cache = $this->_fetch_groups();
1652
1653	$base_dn = $this->groups_base_dn;
1654	$group_name = $group_cache[$group_id]['name'];
1655	$del_dn = "cn=$group_name,$base_dn";
1656
1657	$this->_debug("C: Delete [dn: $del_dn]");
1658
1659	$res = ldap_delete($this->conn, $del_dn);
1660	if ($res === false)
1661	{
1662	$this->_debug("S: ".ldap_error($this->conn));
1663	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1664	return false;
1665	}
1666
1667	$this->_debug("S: OK");
1668	$this->cache->remove('groups');
1669
1670	return true;
1671	}
1672
1673	/**
1674	* Rename a specific contact group
1675	*
1676	* @param string Group identifier
1677	* @param string New name to set for this group
1678	* @param string New group identifier (if changed, otherwise don't set)
1679	* @return boolean New name on success, false if no data was changed
1680	*/
1681	function rename_group($group_id, $new_name, &$new_gid)
1682	{
1683	if (($group_cache = $this->cache->get('groups')) === null)
1684	$group_cache = $this->_fetch_groups();
1685
1686	$base_dn = $this->groups_base_dn;
1687	$group_name = $group_cache[$group_id]['name'];
1688	$old_dn = "cn=$group_name,$base_dn";
1689	$new_rdn = "cn=$new_name";
1690	$new_gid = self::dn_encode($new_name);
1691
1692	$this->_debug("C: Rename [dn: $old_dn] [dn: $new_rdn]");
1693
1694	$res = ldap_rename($this->conn, $old_dn, $new_rdn, NULL, TRUE);
1695	if ($res === false)
1696	{
1697	$this->_debug("S: ".ldap_error($this->conn));
1698	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1699	return false;
1700	}
1701
1702	$this->_debug("S: OK");
1703	$this->cache->remove('groups');
1704
1705	return $new_name;
1706	}
1707
1708	/**
1709	* Add the given contact records the a certain group
1710	*
1711	* @param string Group identifier
1712	* @param array List of contact identifiers to be added
1713	* @return int Number of contacts added
1714	*/
1715	function add_to_group($group_id, $contact_ids)
1716	{
1717	if (($group_cache = $this->cache->get('groups')) === null)
1718	$group_cache = $this->_fetch_groups();
1719
1720	if (!is_array($contact_ids))
1721	$contact_ids = explode(',', $contact_ids);
1722
1723	$base_dn = $this->groups_base_dn;
1724	$group_name = $group_cache[$group_id]['name'];
1725	$member_attr = $group_cache[$group_id]['member_attr'];
1726	$group_dn = "cn=$group_name,$base_dn";
1727
1728	$new_attrs = array();
1729	foreach ($contact_ids as $id)
1730	$new_attrs[$member_attr][] = self::dn_decode($id);
1731
1732	$this->_debug("C: Add [dn: $group_dn]: ".print_r($new_attrs, true));
1733
1734	$res = ldap_mod_add($this->conn, $group_dn, $new_attrs);
1735	if ($res === false)
1736	{
1737	$this->_debug("S: ".ldap_error($this->conn));
1738	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1739	return 0;
1740	}
1741
1742	$this->_debug("S: OK");
1743	$this->cache->remove('groups');
1744
1745	return count($new_attrs['member']);
1746	}
1747
1748	/**
1749	* Remove the given contact records from a certain group
1750	*
1751	* @param string Group identifier
1752	* @param array List of contact identifiers to be removed
1753	* @return int Number of deleted group members
1754	*/
1755	function remove_from_group($group_id, $contact_ids)
1756	{
1757	if (($group_cache = $this->cache->get('groups')) === null)
1758	$group_cache = $this->_fetch_groups();
1759
1760	$base_dn = $this->groups_base_dn;
1761	$group_name = $group_cache[$group_id]['name'];
1762	$member_attr = $group_cache[$group_id]['member_attr'];
1763	$group_dn = "cn=$group_name,$base_dn";
1764
1765	$del_attrs = array();
1766	foreach (explode(",", $contact_ids) as $id)
1767	$del_attrs[$member_attr][] = self::dn_decode($id);
1768
1769	$this->_debug("C: Delete [dn: $group_dn]: ".print_r($del_attrs, true));
1770
1771	$res = ldap_mod_del($this->conn, $group_dn, $del_attrs);
1772	if ($res === false)
1773	{
1774	$this->_debug("S: ".ldap_error($this->conn));
1775	$this->set_error(self::ERROR_SAVING, 'errorsaving');
1776	return 0;
1777	}
1778
1779	$this->_debug("S: OK");
1780	$this->cache->remove('groups');
1781
1782	return count($del_attrs['member']);
1783	}
1784
1785	/**
1786	* Get group assignments of a specific contact record
1787	*
1788	* @param mixed Record identifier
1789	*
1790	* @return array List of assigned groups as ID=>Name pairs
1791	* @since 0.5-beta
1792	*/
1793	function get_record_groups($contact_id)
1794	{
1795	if (!$this->groups)
1796	return array();
1797
1798	$base_dn = $this->groups_base_dn;
1799	$contact_dn = self::dn_decode($contact_id);
1800	$name_attr = $this->prop['groups']['name_attr'];
1801	$member_attr = $this->prop['member_attr'];
1802	$add_filter = '';
1803	if ($member_attr != 'member' && $member_attr != 'uniqueMember')
1804	$add_filter = "($member_attr=$contact_dn)";
1805	$filter = strtr("(\|(member=$contact_dn)(uniqueMember=$contact_dn)$add_filter)", array('\\' => '\\\\'));
1806
1807	$this->_debug("C: Search [$filter][dn: $base_dn]");
1808
1809	$res = @ldap_search($this->conn, $base_dn, $filter, array($name_attr));
1810	if ($res === false)
1811	{
1812	$this->_debug("S: ".ldap_error($this->conn));
1813	return array();
1814	}
1815	$ldap_data = ldap_get_entries($this->conn, $res);
1816	$this->_debug("S: ".ldap_count_entries($this->conn, $res)." record(s)");
1817
1818	$groups = array();
1819	for ($i=0; $i<$ldap_data["count"]; $i++)
1820	{
1821	$group_name = $ldap_data[$i][$name_attr][0];
1822	$group_id = self::dn_encode($group_name);
1823	$groups[$group_id] = $group_id;
1824	}
1825	return $groups;
1826	}
1827
1828
1829	/**
1830	* Generate BER encoded string for Virtual List View option
1831	*
1832	* @param integer List offset (first record)
1833	* @param integer Records per page
1834	* @return string BER encoded option value
1835	*/
1836	private function _vlv_ber_encode($offset, $rpp, $search = '')
1837	{
1838	# this string is ber-encoded, php will prefix this value with:
1839	# 04 (octet string) and 10 (length of 16 bytes)
1840	# the code behind this string is broken down as follows:
1841	# 30 = ber sequence with a length of 0e (14) bytes following
1842	# 02 = type integer (in two's complement form) with 2 bytes following (beforeCount): 01 00 (ie 0)
1843	# 02 = type integer (in two's complement form) with 2 bytes following (afterCount): 01 18 (ie 25-1=24)
1844	# a0 = type context-specific/constructed with a length of 06 (6) bytes following
1845	# 02 = type integer with 2 bytes following (offset): 01 01 (ie 1)
1846	# 02 = type integer with 2 bytes following (contentCount): 01 00
1847
1848	# whith a search string present:
1849	# 81 = type context-specific/constructed with a length of 04 (4) bytes following (the length will change here)
1850	# 81 indicates a user string is present where as a a0 indicates just a offset search
1851	# 81 = type context-specific/constructed with a length of 06 (6) bytes following
1852
1853	# the following info was taken from the ISO/IEC 8825-1:2003 x.690 standard re: the
1854	# encoding of integer values (note: these values are in
1855	# two-complement form so since offset will never be negative bit 8 of the
1856	# leftmost octet should never by set to 1):
1857	# 8.3.2: If the contents octets of an integer value encoding consist
1858	# of more than one octet, then the bits of the first octet (rightmost) and bit 8
1859	# of the second (to the left of first octet) octet:
1860	# a) shall not all be ones; and
1861	# b) shall not all be zero
1862
1863	if ($search)
1864	{
1865	$search = preg_replace('/[^-[:alpha:] ,.()0-9]+/', '', $search);
1866	$ber_val = self::_string2hex($search);
1867	$str = self::_ber_addseq($ber_val, '81');
1868	}
1869	else
1870	{
1871	# construct the string from right to left
1872	$str = "020100"; # contentCount
1873
1874	$ber_val = self::_ber_encode_int($offset); // returns encoded integer value in hex format
1875
1876	// calculate octet length of $ber_val
1877	$str = self::_ber_addseq($ber_val, '02') . $str;
1878
1879	// now compute length over $str
1880	$str = self::_ber_addseq($str, 'a0');
1881	}
1882
1883	// now tack on records per page
1884	$str = "020100" . self::_ber_addseq(self::_ber_encode_int($rpp-1), '02') . $str;
1885
1886	// now tack on sequence identifier and length
1887	$str = self::_ber_addseq($str, '30');
1888
1889	return pack('H'.strlen($str), $str);
1890	}
1891
1892
1893	/**
1894	* create ber encoding for sort control
1895	*
1896	* @param array List of cols to sort by
1897	* @return string BER encoded option value
1898	*/
1899	private function _sort_ber_encode($sortcols)
1900	{
1901	$str = '';
1902	foreach (array_reverse((array)$sortcols) as $col) {
1903	$ber_val = self::_string2hex($col);
1904
1905	# 30 = ber sequence with a length of octet value
1906	# 04 = octet string with a length of the ascii value
1907	$oct = self::_ber_addseq($ber_val, '04');
1908	$str = self::_ber_addseq($oct, '30') . $str;
1909	}
1910
1911	// now tack on sequence identifier and length
1912	$str = self::_ber_addseq($str, '30');
1913
1914	return pack('H'.strlen($str), $str);
1915	}
1916
1917	/**
1918	* Add BER sequence with correct length and the given identifier
1919	*/
1920	private static function _ber_addseq($str, $identifier)
1921	{
1922	$len = dechex(strlen($str)/2);
1923	if (strlen($len) % 2 != 0)
1924	$len = '0'.$len;
1925
1926	return $identifier . $len . $str;
1927	}
1928
1929	/**
1930	* Returns BER encoded integer value in hex format
1931	*/
1932	private static function _ber_encode_int($offset)
1933	{
1934	$val = dechex($offset);
1935	$prefix = '';
1936
1937	// check if bit 8 of high byte is 1
1938	if (preg_match('/^[89abcdef]/', $val))
1939	$prefix = '00';
1940
1941	if (strlen($val)%2 != 0)
1942	$prefix .= '0';
1943
1944	return $prefix . $val;
1945	}
1946
1947	/**
1948	* Returns ascii string encoded in hex
1949	*/
1950	private static function _string2hex($str)
1951	{
1952	$hex = '';
1953	for ($i=0; $i < strlen($str); $i++)
1954	$hex .= dechex(ord($str[$i]));
1955	return $hex;
1956	}
1957
1958	/**
1959	* HTML-safe DN string encoding
1960	*
1961	* @param string $str DN string
1962	*
1963	* @return string Encoded HTML identifier string
1964	*/
1965	static function dn_encode($str)
1966	{
1967	// @TODO: to make output string shorter we could probably
1968	// remove dc=* items from it
1969	return rtrim(strtr(base64_encode($str), '+/', '-_'), '=');
1970	}
1971
1972	/**
1973	* Decodes DN string encoded with _dn_encode()
1974	*
1975	* @param string $str Encoded HTML identifier string
1976	*
1977	* @return string DN string
1978	*/
1979	static function dn_decode($str)
1980	{
1981	$str = str_pad(strtr($str, '-_', '+/'), strlen($str) % 4, '=', STR_PAD_RIGHT);
1982	return base64_decode($str);
1983	}
1984	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: