.
* ---------------------------------------------------------------------
*/
if (!defined('GLPI_ROOT')) {
die("Sorry. You can't access this file directly");
}
use Sabre\VObject;
use Glpi\Exception\ForgetPasswordException;
use Glpi\Exception\PasswordTooWeakException;
class User extends CommonDBTM {
// From CommonDBTM
public $dohistory = true;
public $history_blacklist = ['date_mod', 'date_sync', 'last_login',
'publicbookmarkorder', 'privatebookmarkorder'];
// NAME FIRSTNAME ORDER TYPE
const REALNAME_BEFORE = 0;
const FIRSTNAME_BEFORE = 1;
const IMPORTEXTAUTHUSERS = 1024;
const READAUTHENT = 2048;
const UPDATEAUTHENT = 4096;
static $rightname = 'user';
static $undisclosedFields = [
'password',
'personal_token',
'api_token',
'cookie_token',
];
private $entities = null;
static function getTypeName($nb = 0) {
return _n('User', 'Users', $nb);
}
static function getMenuShorcut() {
return 'u';
}
static function getAdditionalMenuOptions() {
if (Session::haveRight('user', self::IMPORTEXTAUTHUSERS)) {
return [
'ldap' => [
'title' => AuthLDAP::getTypeName(Session::getPluralNumber()),
'page' => '/front/ldap.php',
],
];
}
return false;
}
function canViewItem() {
if (Session::canViewAllEntities()
|| Session::haveAccessToOneOfEntities($this->getEntities())) {
return true;
}
return false;
}
function canCreateItem() {
// Will be created from form, with selected entity/profile
if (isset($this->input['_profiles_id']) && ($this->input['_profiles_id'] > 0)
&& Profile::currentUserHaveMoreRightThan([$this->input['_profiles_id']])
&& isset($this->input['_entities_id'])
&& Session::haveAccessToEntity($this->input['_entities_id'])) {
return true;
}
// Will be created with default value
if (Session::haveAccessToEntity(0) // Access to root entity (required when no default profile)
|| (Profile::getDefault() > 0)) {
return true;
}
if (($_SESSION['glpiactive_entity'] > 0)
&& (Profile::getDefault() == 0)) {
echo "
".
__('You must define a default profile to create a new user')."
";
}
return false;
}
function canUpdateItem() {
$entities = Profile_User::getUserEntities($this->fields['id'], false);
if (Session::canViewAllEntities()
|| Session::haveAccessToOneOfEntities($entities)) {
return true;
}
return false;
}
function canDeleteItem() {
if (Session::canViewAllEntities()
|| Session::haveAccessToAllOfEntities($this->getEntities())) {
return true;
}
return false;
}
function canPurgeItem() {
return $this->canDeleteItem();
}
function isEntityAssign() {
// glpi_users.entities_id is only a pref.
return false;
}
/**
* Compute preferences for the current user mixing config and user data.
*
* @return void
*/
function computePreferences() {
global $CFG_GLPI;
if (isset($this->fields['id'])) {
foreach ($CFG_GLPI['user_pref_field'] as $f) {
if (is_null($this->fields[$f])) {
$this->fields[$f] = $CFG_GLPI[$f];
}
}
}
/// Specific case for show_count_on_tabs : global config can forbid
if ($CFG_GLPI['show_count_on_tabs'] == -1) {
$this->fields['show_count_on_tabs'] = 0;
}
}
/**
* Load minimal session for user.
*
* @param integer $entities_id Entity to use
* @param boolean $is_recursive Whether to load entities recursivly or not
*
* @return void
*
* @since 0.83.7
*/
function loadMinimalSession($entities_id, $is_recursive) {
global $CFG_GLPI;
if (isset($this->fields['id']) && !isset($_SESSION["glpiID"])) {
Session::destroy();
Session::start();
$_SESSION["glpiID"] = $this->fields['id'];
$_SESSION["glpi_use_mode"] = Session::NORMAL_MODE;
$_SESSION["glpiactive_entity"] = $entities_id;
$_SESSION["glpiactive_entity_recursive"] = $is_recursive;
if ($is_recursive) {
$entities = getSonsOf("glpi_entities", $entities_id);
} else {
$entities = [$entities_id];
}
$_SESSION['glpiactiveentities'] = $entities;
$_SESSION['glpiactiveentities_string'] = "'".implode("', '", $entities)."'";
$this->computePreferences();
foreach ($CFG_GLPI['user_pref_field'] as $field) {
if (isset($this->fields[$field])) {
$_SESSION["glpi$field"] = $this->fields[$field];
}
}
Session::loadGroups();
Session::loadLanguage();
}
}
function getTabNameForItem(CommonGLPI $item, $withtemplate = 0) {
switch ($item->getType()) {
case __CLASS__ :
$ong = [];
$ong[1] = __('Used items');
$ong[2] = __('Managed items');
return $ong;
case 'Preference' :
return __('Main');
}
return '';
}
static function displayTabContentForItem(CommonGLPI $item, $tabnum = 1, $withtemplate = 0) {
global $CFG_GLPI;
switch ($item->getType()) {
case __CLASS__ :
$item->showItems($tabnum==2);
return true;
case 'Preference' :
$user = new self();
$user->showMyForm($CFG_GLPI['root_doc']."/front/preference.php",
Session::getLoginUserID());
return true;
}
return false;
}
function defineTabs($options = []) {
$ong = [];
$this->addDefaultFormTab($ong);
$this->addImpactTab($ong, $options);
$this->addStandardTab('Profile_User', $ong, $options);
$this->addStandardTab('Group_User', $ong, $options);
$this->addStandardTab('Config', $ong, $options);
$this->addStandardTab(__CLASS__, $ong, $options);
$this->addStandardTab('Ticket', $ong, $options);
$this->addStandardTab('Item_Problem', $ong, $options);
$this->addStandardTab('Change_Item', $ong, $options);
$this->addStandardTab('Document_Item', $ong, $options);
$this->addStandardTab('Reservation', $ong, $options);
$this->addStandardTab('Auth', $ong, $options);
$this->addStandardTab('Link', $ong, $options);
$this->addStandardTab('Certificate_Item', $ong, $options);
$this->addStandardTab('Log', $ong, $options);
return $ong;
}
function post_getEmpty() {
global $CFG_GLPI;
$this->fields["is_active"] = 1;
if (isset($CFG_GLPI["language"])) {
$this->fields['language'] = $CFG_GLPI["language"];
} else {
$this->fields['language'] = "en_GB";
}
}
function pre_deleteItem() {
global $DB;
$entities = $this->getEntities();
$view_all = Session::canViewAllEntities();
// Have right on all entities ?
$all = true;
if (!$view_all) {
foreach ($entities as $ent) {
if (!Session::haveAccessToEntity($ent)) {
$all = false;
}
}
}
if ($all) { // Mark as deleted
return true;
}
// only delete profile
foreach ($entities as $ent) {
if (Session::haveAccessToEntity($ent)) {
$all = false;
$DB->delete(
'glpi_profiles_users', [
'users_id' => $this->fields['id'],
'entities_id' => $ent
]
);
}
return false;
}
}
function cleanDBonPurge() {
global $DB;
// ObjectLock does not extends CommonDBConnexity
$ol = new ObjectLock();
$ol->deleteByCriteria(['users_id' => $this->fields['id']]);
// Reminder does not extends CommonDBConnexity
$r = new Reminder();
$r->deleteByCriteria(['users_id' => $this->fields['id']]);
// Delete private bookmark
$ss = new SavedSearch();
$ss->deleteByCriteria(
[
'users_id' => $this->fields['id'],
'is_private' => 1,
]
);
// Set no user to public bookmark
$DB->update(
SavedSearch::getTable(), [
'users_id' => 0
], [
'users_id' => $this->fields['id']
]
);
// Set no user to consumables
$DB->update(
'glpi_consumables', [
'items_id' => 0,
'itemtype' => 'NULL',
'date_out' => 'NULL'
], [
'items_id' => $this->fields['id'],
'itemtype' => 'User'
]
);
$this->deleteChildrenAndRelationsFromDb(
[
Certificate_Item::class,
Change_User::class,
Group_User::class,
KnowbaseItem_User::class,
Problem_User::class,
Profile_User::class,
ProjectTaskTeam::class,
ProjectTeam::class,
Reminder_User::class,
RSSFeed_User::class,
SavedSearch_User::class,
Ticket_User::class,
UserEmail::class,
]
);
if ($this->fields['id'] > 0) { // Security
// DisplayPreference does not extends CommonDBConnexity
$dp = new DisplayPreference();
$dp->deleteByCriteria(['users_id' => $this->fields['id']]);
}
$this->dropPictureFiles($this->fields['picture']);
// Ticket rules use various _users_id_*
Rule::cleanForItemAction($this, '_users_id%');
Rule::cleanForItemCriteria($this, '_users_id%');
// Alert does not extends CommonDBConnexity
$alert = new Alert();
$alert->cleanDBonItemDelete($this->getType(), $this->fields['id']);
}
/**
* Retrieve a user from the database using its login.
*
* @param string $name Login of the user
*
* @return boolean
*/
function getFromDBbyName($name) {
return $this->getFromDBByCrit(['name' => $name]);
}
/**
* Retrieve a user from the database using its login.
*
* @param string $name Login of the user
* @param integer $authtype Auth type (see Auth constants)
* @param integer $auths_id ID of auth server
*
* @return boolean
*/
function getFromDBbyNameAndAuth($name, $authtype, $auths_id) {
return $this->getFromDBByCrit([
'name' => $name,
'authtype' => $authtype,
'auths_id' => $auths_id
]);
}
/**
* Retrieve a user from the database using value of the sync field.
*
* @param string $value Value of the sync field
*
* @return boolean
*/
function getFromDBbySyncField($value) {
return $this->getFromDBByCrit(['sync_field' => $value]);
}
/**
* Retrieve a user from the database using it's dn.
*
* @since 0.84
*
* @param string $user_dn dn of the user
*
* @return boolean
*/
function getFromDBbyDn($user_dn) {
return $this->getFromDBByCrit(['user_dn' => $user_dn]);
}
/**
* Retrieve a user from the database using its email.
*
* @since 9.3 Can pass condition as a parameter
*
* @param string $email user email
* @param array $condition add condition
*
* @return boolean
*/
function getFromDBbyEmail($email, $condition = []) {
global $DB;
$crit = [
'SELECT' => $this->getTable() . '.id',
'FROM' => $this->getTable(),
'LEFT JOIN' => [
'glpi_useremails' => [
'FKEY' => [
$this->getTable() => 'id',
'glpi_useremails' => 'users_id'
]
]
],
'WHERE' => ['glpi_useremails.email' => $email] + $condition
];
$iter = $DB->request($crit);
if ($iter->numrows()==1) {
$row = $iter->next();
return $this->getFromDB($row['id']);
}
return false;
}
/**
* Get the default email of the user.
*
* @return string
*/
function getDefaultEmail() {
if (!isset($this->fields['id'])) {
return '';
}
return UserEmail::getDefaultForUser($this->fields['id']);
}
/**
* Get all emails of the user.
*
* @return string[]
*/
function getAllEmails() {
if (!isset($this->fields['id'])) {
return [];
}
return UserEmail::getAllForUser($this->fields['id']);
}
/**
* Check if the email is attached to the current user.
*
* @param string $email
*
* @return boolean
*/
function isEmail($email) {
if (!isset($this->fields['id'])) {
return false;
}
return UserEmail::isEmailForUser($this->fields['id'], $email);
}
/**
* Retrieve a user from the database using its personal token.
*
* @param string $token user token
* @param string $field the field storing the token
*
* @return boolean
*/
function getFromDBbyToken($token, $field = 'personal_token') {
$fields = ['personal_token', 'api_token'];
if (!in_array($field, $fields)) {
Toolbox::logWarning('User::getFromDBbyToken() can only be called with $field parameter with theses values: \'' . implode('\', \'', $fields) . '\'');
return false;
}
return $this->getFromDBByCrit([$this->getTable() . ".$field" => $token]);
}
function prepareInputForAdd($input) {
global $DB;
if (isset($input['_stop_import'])) {
return false;
}
if (!Auth::isValidLogin(stripslashes($input['name']))) {
Session::addMessageAfterRedirect(__('The login is not valid. Unable to add the user.'),
false, ERROR);
return false;
}
// avoid xss (picture field is autogenerated)
if (isset($input['picture'])) {
$input['picture'] = 'NULL';
}
if (!isset($input["authtype"])) {
$input["authtype"] = Auth::DB_GLPI;
}
if (!isset($input["auths_id"])) {
$input["auths_id"] = 0;
}
// Check if user does not exists
$iterator = $DB->request([
'FROM' => $this->getTable(),
'WHERE' => [
'name' => $input['name'],
'authtype' => $input['authtype'],
'auths_id' => $input['auths_id']
],
'LIMIT' => 1
]);
if (count($iterator)) {
Session::addMessageAfterRedirect(__('Unable to add. The user already exists.'),
false, ERROR);
return false;
}
if (isset($input["password2"])) {
if (empty($input["password"])) {
unset ($input["password"]);
} else {
if ($input["password"] == $input["password2"]) {
if (Config::validatePassword($input["password"])) {
$input["password"]
= Auth::getPasswordHash(Toolbox::unclean_cross_side_scripting_deep(stripslashes($input["password"])));
$input['password_last_update'] = $_SESSION['glpi_currenttime'];
} else {
unset($input["password"]);
}
unset($input["password2"]);
} else {
Session::addMessageAfterRedirect(__('Error: the two passwords do not match'),
false, ERROR);
return false;
}
}
}
if (isset($input["_extauth"])) {
$input["password"] = "";
}
// Force DB default values : not really needed
if (!isset($input["is_active"])) {
$input["is_active"] = 1;
}
if (!isset($input["is_deleted"])) {
$input["is_deleted"] = 0;
}
if (!isset($input["entities_id"])) {
$input["entities_id"] = 0;
}
if (!isset($input["profiles_id"])) {
$input["profiles_id"] = 0;
}
return $input;
}
public function prepareInputForClone($input) {
if (isset($input['name'])) {
$suffix = 1;
$possibleName = $input['name'].$suffix;
while ($this->getFromDBbyName($possibleName)) {
$suffix++;
$possibleName = $input['name'].$suffix;
}
$input['name'] = $possibleName;
}
return $input;
}
function post_addItem() {
$this->updateUserEmails();
$this->syncLdapGroups();
$this->syncDynamicEmails();
$this->applyGroupsRules();
$rulesplayed = $this->applyRightRules();
$picture = $this->syncLdapPhoto();
//add picture in user fields
if (!empty($picture)) {
$this->update(['id' => $this->fields['id'],
'picture' => $picture]);
}
// Add default profile
if (!$rulesplayed) {
$affectation = [];
if (isset($this->input['_profiles_id']) && $this->input['_profiles_id']
&& Profile::currentUserHaveMoreRightThan([$this->input['_profiles_id']])
) {
$profile = $this->input['_profiles_id'];
// Choosen in form, so not dynamic
$affectation['is_dynamic'] = 0;
} else {
$profile = Profile::getDefault();
// Default right as dynamic. If dynamic rights are set it will disappear.
$affectation['is_dynamic'] = 1;
}
if ($profile) {
if (isset($this->input["_entities_id"])) {
// entities_id (user's pref) always set in prepareInputForAdd
// use _entities_id for default right
$affectation["entities_id"] = $this->input["_entities_id"];
} else if (isset($_SESSION['glpiactive_entity'])) {
$affectation["entities_id"] = $_SESSION['glpiactive_entity'];
} else {
$affectation["entities_id"] = 0;
}
if (isset($this->input["_is_recursive"])) {
$affectation["is_recursive"] = $this->input["_is_recursive"];
} else {
$affectation["is_recursive"] = 0;
}
$affectation["profiles_id"] = $profile;
$affectation["users_id"] = $this->fields["id"];
$right = new Profile_User();
$right->add($affectation);
}
}
}
function prepareInputForUpdate($input) {
global $CFG_GLPI;
// avoid xss (picture name is autogenerated when uploading/synchronising the picture)
unset($input['picture']);
//picture manually uploaded by user
if (isset($input["_blank_picture"]) && $input["_blank_picture"]) {
self::dropPictureFiles($this->fields['picture']);
$input['picture'] = 'NULL';
} else {
$newPicture = false;
if (!isAPI()) {
if (isset($input["_picture"][0]) && !empty($input["_picture"][0])) {
$input["_picture"] = $input["_picture"][0];
}
}
if (isset($input["_picture"]) && !empty($input["_picture"])) {
$newPicture = true;
}
if ($newPicture) {
$fullpath = GLPI_TMP_DIR."/".$input["_picture"];
if (Toolbox::getMime($fullpath, 'image')) {
// Unlink old picture (clean on changing format)
self::dropPictureFiles($this->fields['picture']);
// Move uploaded file
$filename = uniqid($this->fields['id'].'_');
$sub = substr($filename, -2); /* 2 hex digit */
// output images with possible transparency to png, other to jpg
$extension = strtolower(pathinfo($fullpath, PATHINFO_EXTENSION));
$extension = in_array($extension, ['png', 'gif'])
? 'png'
: 'jpg';
@mkdir(GLPI_PICTURE_DIR . "/$sub");
$picture_path = GLPI_PICTURE_DIR . "/$sub/${filename}.$extension";
self::dropPictureFiles("$sub/${filename}.$extension");
if (Document::isImage($fullpath)
&& Document::renameForce($fullpath, $picture_path)) {
Session::addMessageAfterRedirect(__('The file is valid. Upload is successful.'));
// For display
$input['picture'] = "$sub/${filename}.$extension";
//prepare a thumbnail
$thumb_path = GLPI_PICTURE_DIR . "/$sub/${filename}_min.$extension";
Toolbox::resizePicture($picture_path, $thumb_path);
} else {
Session::addMessageAfterRedirect(__('Potential upload attack or file too large. Moving temporary file failed.'),
false, ERROR);
}
} else {
Session::addMessageAfterRedirect(__('The file is not an image file.'),
false, ERROR);
}
} else {
//ldap jpegphoto synchronisation.
$picture = $this->syncLdapPhoto();
if (!empty($picture)) {
$input['picture'] = $picture;
}
}
}
if (isset($input["password2"])) {
// Empty : do not update
if (empty($input["password"])) {
unset($input["password"]);
} else {
if ($input["password"] == $input["password2"]) {
// Check right : my password of user with lesser rights
if (isset($input['id'])
&& !Auth::checkPassword($input['password'], $this->fields['password']) // Validate that password is not same as previous
&& Config::validatePassword($input["password"])
&& (($input['id'] == Session::getLoginUserID())
|| $this->currentUserHaveMoreRightThan($input['id'])
// Permit to change password with token and email
|| (($input['password_forget_token'] == $this->fields['password_forget_token'])
&& (abs(strtotime($_SESSION["glpi_currenttime"])
-strtotime($this->fields['password_forget_token_date'])) < DAY_TIMESTAMP)
&& $this->isEmail($input['email'])))) {
$input["password"]
= Auth::getPasswordHash(Toolbox::unclean_cross_side_scripting_deep(stripslashes($input["password"])));
$input['password_last_update'] = $_SESSION["glpi_currenttime"];
} else {
unset($input["password"]);
}
unset($input["password2"]);
} else {
Session::addMessageAfterRedirect(__('Error: the two passwords do not match'),
false, ERROR);
return false;
}
}
} else if (isset($input["password"])) { // From login
unset($input["password"]);
}
// blank password when authtype changes
if (isset($input["authtype"])
&& $input["authtype"] != Auth::DB_GLPI
&& $input["authtype"] != $this->getField('authtype')) {
$input["password"] = "";
}
// Update User in the database
if (!isset($input["id"])
&& isset($input["name"])) {
if ($this->getFromDBbyName($input["name"])) {
$input["id"] = $this->fields["id"];
}
}
if (isset($input["entities_id"])
&& (Session::getLoginUserID() == $input['id'])) {
$_SESSION["glpidefault_entity"] = $input["entities_id"];
}
// Security on default profile update
if (isset($input['profiles_id'])) {
if (!in_array($input['profiles_id'], Profile_User::getUserProfiles($input['id']))) {
unset($input['profiles_id']);
}
}
// Security on default entity update
if (isset($input['entities_id'])) {
if (!in_array($input['entities_id'], Profile_User::getUserEntities($input['id']))) {
unset($input['entities_id']);
}
}
// Security on default group update
if (isset($input['groups_id'])
&& !Group_User::isUserInGroup($input['id'], $input['groups_id'])) {
unset($input['groups_id']);
}
if (isset($input['_reset_personal_token'])
&& $input['_reset_personal_token']) {
$input['personal_token'] = self::getUniqueToken('personal_token');
$input['personal_token_date'] = $_SESSION['glpi_currenttime'];
}
if (isset($input['_reset_api_token'])
&& $input['_reset_api_token']) {
$input['api_token'] = self::getUniqueToken('api_token');
$input['api_token_date'] = $_SESSION['glpi_currenttime'];
}
// Manage preferences fields
if (Session::getLoginUserID() == $input['id']) {
if (isset($input['use_mode'])
&& ($_SESSION['glpi_use_mode'] != $input['use_mode'])) {
$_SESSION['glpi_use_mode'] = $input['use_mode'];
unset($_SESSION['glpimenu']); // Force menu regeneration
//Session::loadLanguage();
}
}
foreach ($CFG_GLPI['user_pref_field'] as $f) {
if (isset($input[$f])) {
if (Session::getLoginUserID() == $input['id']) {
if ($_SESSION["glpi$f"] != $input[$f]) {
$_SESSION["glpi$f"] = $input[$f];
// reinit translations
if ($f == 'language') {
$_SESSION['glpi_dropdowntranslations'] = DropdownTranslation::getAvailableTranslations($_SESSION["glpilanguage"]);
unset($_SESSION['glpimenu']);
}
}
}
if ($input[$f] == $CFG_GLPI[$f]) {
$input[$f] = "NULL";
}
}
}
if (isset($input['language']) && GLPI_DEMO_MODE) {
unset($input['language']);
}
if (array_key_exists('timezone', $input) && empty($input['timezone'])) {
$input['timezone'] = 'NULL';
}
return $input;
}
function post_updateItem($history = 1) {
//handle timezone change for current user
if ($this->fields['id'] == Session::getLoginUserID()) {
if (null == $this->fields['timezone'] || 'null' === strtolower($this->fields['timezone'])) {
unset($_SESSION['glpi_tz']);
} else {
$_SESSION['glpi_tz'] = $this->fields['timezone'];
}
}
$this->updateUserEmails();
$this->syncLdapGroups();
$this->syncDynamicEmails();
$this->applyGroupsRules();
$this->applyRightRules();
if (in_array('password', $this->updates)) {
$alert = new Alert();
$alert->deleteByCriteria(
[
'itemtype' => $this->getType(),
'items_id' => $this->fields['id'],
],
true
);
}
}
/**
* Apply rules to determine dynamic rights of the user.
*
* @return boolean true if rules are applied, false otherwise
*/
function applyRightRules() {
$return = false;
if (isset($this->fields['_ruleright_process'])
|| isset($this->input['_ruleright_process'])) {
$dynamic_profiles = Profile_User::getForUser($this->fields["id"], true);
if (isset($this->fields["id"])
&& ($this->fields["id"] > 0)
&& isset($this->input["_ldap_rules"])
&& count($this->input["_ldap_rules"])) {
//and add/update/delete only if it's necessary !
if (isset($this->input["_ldap_rules"]["rules_entities_rights"])) {
$entities_rules = $this->input["_ldap_rules"]["rules_entities_rights"];
} else {
$entities_rules = [];
}
if (isset($this->input["_ldap_rules"]["rules_entities"])) {
$entities = $this->input["_ldap_rules"]["rules_entities"];
} else {
$entities = [];
}
if (isset($this->input["_ldap_rules"]["rules_rights"])) {
$rights = $this->input["_ldap_rules"]["rules_rights"];
} else {
$rights = [];
}
$retrieved_dynamic_profiles = [];
//For each affectation -> write it in DB
foreach ($entities_rules as $entity) {
//Multiple entities assignation
if (is_array($entity[0])) {
foreach ($entity[0] as $ent) {
$retrieved_dynamic_profiles[] = [
'entities_id' => $ent,
'profiles_id' => $entity[1],
'is_recursive' => $entity[2],
'users_id' => $this->fields['id'],
'is_dynamic' => 1,
];
}
} else {
$retrieved_dynamic_profiles[] = [
'entities_id' => $entity[0],
'profiles_id' => $entity[1],
'is_recursive' => $entity[2],
'users_id' => $this->fields['id'],
'is_dynamic' => 1,
];
}
}
if ((count($entities) > 0)
&& (count($rights) == 0)) {
if ($def_prof = Profile::getDefault()) {
$rights[] = $def_prof;
}
}
if ((count($rights) > 0)
&& (count($entities) > 0)) {
foreach ($rights as $right) {
foreach ($entities as $entity) {
$retrieved_dynamic_profiles[] = [
'entities_id' => $entity[0],
'profiles_id' => $right,
'is_recursive' => $entity[1],
'users_id' => $this->fields['id'],
'is_dynamic' => 1,
];
}
}
}
// Compare retrived profiles to existing ones : clean arrays to do purge and add
if (count($retrieved_dynamic_profiles)) {
foreach ($retrieved_dynamic_profiles as $keyretr => $retr_profile) {
$found = false;
foreach ($dynamic_profiles as $keydb => $db_profile) {
// Found existing profile : unset values in array
if (!$found
&& ($db_profile['entities_id'] == $retr_profile['entities_id'])
&& ($db_profile['profiles_id'] == $retr_profile['profiles_id'])
&& ($db_profile['is_recursive'] == $retr_profile['is_recursive'])) {
unset($retrieved_dynamic_profiles[$keyretr]);
unset($dynamic_profiles[$keydb]);
}
}
}
}
// Add new dynamic profiles
if (count($retrieved_dynamic_profiles)) {
$right = new Profile_User();
foreach ($retrieved_dynamic_profiles as $keyretr => $retr_profile) {
$right->add($retr_profile);
}
}
//Unset all the temporary tables
unset($this->input["_ldap_rules"]);
$return = true;
}
// Delete old dynamic profiles
if (count($dynamic_profiles)) {
$right = new Profile_User();
foreach ($dynamic_profiles as $keydb => $db_profile) {
$right->delete($db_profile);
}
}
}
return $return;
}
/**
* Synchronise LDAP group of the user.
*
* @return void
*/
function syncLdapGroups() {
global $DB;
// input["_groups"] not set when update from user.form or preference
if (isset($this->fields["authtype"])
&& isset($this->input["_groups"])
&& (($this->fields["authtype"] == Auth::LDAP)
|| Auth::isAlternateAuth($this->fields['authtype']))) {
if (isset($this->fields["id"]) && ($this->fields["id"] > 0)) {
$authtype = Auth::getMethodsByID($this->fields["authtype"], $this->fields["auths_id"]);
if (count($authtype)) {
// Clean groups
$this->input["_groups"] = array_unique ($this->input["_groups"]);
// Delete not available groups like to LDAP
$iterator = $DB->request([
'SELECT' => [
'glpi_groups_users.id',
'glpi_groups_users.groups_id',
'glpi_groups_users.is_dynamic'
],
'FROM' => 'glpi_groups_users',
'LEFT JOIN' => [
'glpi_groups' => [
'FKEY' => [
'glpi_groups_users' => 'groups_id',
'glpi_groups' => 'id'
]
]
],
'WHERE' => [
'glpi_groups_users.users_id' => $this->fields['id']
]
]);
$groupuser = new Group_User();
while ($data = $iterator->next()) {
if (in_array($data["groups_id"], $this->input["_groups"])) {
// Delete found item in order not to add it again
unset($this->input["_groups"][array_search($data["groups_id"],
$this->input["_groups"])]);
} else if ($data['is_dynamic']) {
$groupuser->delete(['id' => $data["id"]]);
}
}
//If the user needs to be added to one group or more
if (count($this->input["_groups"]) > 0) {
foreach ($this->input["_groups"] as $group) {
$groupuser->add(['users_id' => $this->fields["id"],
'groups_id' => $group,
'is_dynamic' => 1]);
}
unset ($this->input["_groups"]);
}
}
}
}
}
/**
* Synchronize picture (photo) of the user.
*
* @since 0.85
*
* @return string|boolean Filename to be stored in user picture field, false if no picture found
*/
function syncLdapPhoto() {
if (isset($this->fields["authtype"])
&& (($this->fields["authtype"] == Auth::LDAP)
|| ($this->fields["authtype"] == Auth::NOT_YET_AUTHENTIFIED
&& !empty($this->fields["auths_id"]))
|| Auth::isAlternateAuth($this->fields['authtype']))) {
if (isset($this->fields["id"]) && ($this->fields["id"] > 0)) {
$config_ldap = new AuthLDAP();
$ds = false;
//connect ldap server
if ($config_ldap->getFromDB($this->fields['auths_id'])) {
$ds = $config_ldap->connect();
}
if ($ds) {
//get picture fields
$picture_field = $config_ldap->fields['picture_field'];
if (empty($picture_field)) {
return false;
}
//get picture content in ldap
$info = AuthLDAP::getUserByDn($ds, $this->fields['user_dn'],
[$picture_field], false);
//getUserByDn returns an array. If the picture is empty,
//$info[$picture_field][0] is null
if (!isset($info[$picture_field][0]) || empty($info[$picture_field][0])) {
return "";
}
//prepare paths
$img = array_pop($info[$picture_field]);
$filename = uniqid($this->fields['id'].'_');
$sub = substr($filename, -2); /* 2 hex digit */
$file = GLPI_PICTURE_DIR . "/$sub/${filename}.jpg";
if (array_key_exists('picture', $this->fields)) {
$oldfile = GLPI_PICTURE_DIR . "/" . $this->fields["picture"];
} else {
$oldfile = null;
}
// update picture if not exist or changed
if (empty($this->fields["picture"])
|| !file_exists($oldfile)
|| sha1_file($oldfile) !== sha1($img)) {
if (!is_dir(GLPI_PICTURE_DIR . "/$sub")) {
mkdir(GLPI_PICTURE_DIR . "/$sub");
}
//save picture
$outjpeg = fopen($file, 'wb');
fwrite($outjpeg, $img);
fclose ($outjpeg);
//save thumbnail
$thumb = GLPI_PICTURE_DIR . "/$sub/${filename}_min.jpg";
Toolbox::resizePicture($file, $thumb);
return "$sub/${filename}.jpg";
}
return $this->fields["picture"];
}
}
}
return false;
}
/**
* Update emails of the user.
* Uses _useremails set from UI, not _emails set from LDAP.
*
* @return void
*/
function updateUserEmails() {
// Update emails (use _useremails set from UI, not _emails set from LDAP)
$userUpdated = false;
if (isset($this->input['_useremails']) && count($this->input['_useremails'])) {
$useremail = new UserEmail();
foreach ($this->input['_useremails'] as $id => $email) {
$email = trim($email);
// existing email
if ($id > 0) {
$params = ['id' => $id];
// empty email : delete
if (strlen($email) == 0) {
$deleted = $useremail->delete($params);
$userUpdated = $userUpdated || $deleted;
} else { // Update email
$params['email'] = $email;
$params['is_default'] = $this->input['_default_email'] == $id ? 1 : 0;
$existingUserEmail = new UserEmail();
$existingUserEmail->getFromDB($id);
if ($params['email'] == $existingUserEmail->fields['email']
&& $params['is_default'] == $existingUserEmail->fields['is_default']) {
// Do not update if email has not changed
continue;
}
$updated = $useremail->update($params);
$userUpdated = $userUpdated || $updated;
}
} else { // New email
$email_input = ['email' => $email,
'users_id' => $this->fields['id']];
if (isset($this->input['_default_email'])
&& ($this->input['_default_email'] == $id)) {
$email_input['is_default'] = 1;
} else {
$email_input['is_default'] = 0;
}
$added = $useremail->add($email_input);
$userUpdated = $userUpdated || $added;
}
}
}
if ($userUpdated) {
// calling $this->update() here leads to loss in $this->input
$user = new User();
$user->update(['id' => $this->fields['id'], 'date_mod' => $_SESSION['glpi_currenttime']]);
}
}
/**
* Synchronise Dynamics emails of the user.
* Uses _emails (set from getFromLDAP), not _usermails set from UI.
*
* @return void
*/
function syncDynamicEmails() {
global $DB;
$userUpdated = false;
// input["_emails"] not set when update from user.form or preference
if (isset($this->fields["authtype"])
&& isset($this->input["_emails"])
&& (($this->fields["authtype"] == Auth::LDAP)
|| Auth::isAlternateAuth($this->fields['authtype'])
|| ($this->fields["authtype"] == Auth::MAIL))) {
if (isset($this->fields["id"]) && ($this->fields["id"] > 0)) {
$authtype = Auth::getMethodsByID($this->fields["authtype"], $this->fields["auths_id"]);
if (count($authtype)
|| $this->fields["authtype"] == Auth::EXTERNAL) {
// Clean emails
// Do a case insensitive comparison as it seems that some LDAP servers
// may return same email with different case sensitivity.
$unique_emails = [];
foreach ($this->input["_emails"] as $email) {
if (!in_array(strtolower($email), array_map('strtolower', $unique_emails))) {
$unique_emails[] = $email;
}
}
$this->input["_emails"] = $unique_emails;
// Delete not available groups like to LDAP
$iterator = $DB->request([
'SELECT' => [
'id',
'users_id',
'email',
'is_dynamic'
],
'FROM' => 'glpi_useremails',
'WHERE' => ['users_id' => $this->fields['id']]
]);
$useremail = new UserEmail();
while ($data = $iterator->next()) {
// Do a case insensitive comparison as email may be stored with a different case
$i = array_search(strtolower($data["email"]), array_map('strtolower', $this->input["_emails"]));
if ($i !== false) {
// Delete found item in order not to add it again
unset($this->input["_emails"][$i]);
} else if ($data['is_dynamic']) {
// Delete not found email
$deleted = $useremail->delete(['id' => $data["id"]]);
$userUpdated = $userUpdated || $deleted;
}
}
//If the email need to be added
if (count($this->input["_emails"]) > 0) {
foreach ($this->input["_emails"] as $email) {
$added = $useremail->add(['users_id' => $this->fields["id"],
'email' => $email,
'is_dynamic' => 1]);
$userUpdated = $userUpdated || $added;
}
unset ($this->input["_emails"]);
}
}
}
}
if ($userUpdated) {
// calling $this->update() here leads to loss in $this->input
$user = new User();
$user->update(['id' => $this->fields['id'], 'date_mod' => $_SESSION['glpi_currenttime']]);
}
}
protected function computeFriendlyName() {
global $CFG_GLPI;
if (isset($this->fields["id"]) && ($this->fields["id"] > 0)) {
//computeFriendlyName should not add ID
$bkp_conf = $CFG_GLPI['is_ids_visible'];
$CFG_GLPI['is_ids_visible'] = 0;
$bkp_sessconf = (isset($_SESSION['glpiis_ids_visible']) ? $_SESSION["glpiis_ids_visible"] : 0);
$_SESSION["glpiis_ids_visible"] = 0;
$name = formatUserName($this->fields["id"],
$this->fields["name"],
(isset($this->fields["realname"]) ? $this->fields["realname"] : ''),
(isset($this->fields["firstname"]) ? $this->fields["firstname"] : ''));
$CFG_GLPI['is_ids_visible'] = $bkp_conf;
$_SESSION["glpiis_ids_visible"] = $bkp_sessconf;
return $name;
}
return '';
}
/**
* Function that tries to load the user membership from LDAP
* by searching in the attributes of the User.
*
* @param resource $ldap_connection LDAP connection
* @param array $ldap_method LDAP method
* @param string $userdn Basedn of the user
* @param string $login User login
*
* @return string|boolean Basedn of the user / false if not found
*/
private function getFromLDAPGroupVirtual($ldap_connection, array $ldap_method, $userdn, $login) {
global $DB;
// Search in DB the ldap_field we need to search for in LDAP
$iterator = $DB->request([
'SELECT' => 'ldap_field',
'DISTINCT' => true,
'FROM' => 'glpi_groups',
'WHERE' => ['NOT' => ['ldap_field' => '']],
'ORDER' => 'ldap_field'
]);
$group_fields = [];
while ($data = $iterator->next()) {
$group_fields[] = Toolbox::strtolower($data["ldap_field"]);
}
if (count($group_fields)) {
//Need to sort the array because edirectory don't like it!
sort($group_fields);
// If the groups must be retrieve from the ldap user object
$sr = @ ldap_read($ldap_connection, $userdn, "objectClass=*", $group_fields);
$v = AuthLDAP::get_entries_clean($ldap_connection, $sr);
for ($i=0; $i < $v['count']; $i++) {
//Try to find is DN in present and needed: if yes, then extract only the OU from it
if ((($ldap_method["group_field"] == 'dn') || in_array('ou', $group_fields))
&& isset($v[$i]['dn'])) {
$v[$i]['ou'] = [];
for ($tmp=$v[$i]['dn']; count($tmptab = explode(',', $tmp, 2))==2; $tmp=$tmptab[1]) {
$v[$i]['ou'][] = $tmptab[1];
}
// Search in DB for group with ldap_group_dn
if (($ldap_method["group_field"] == 'dn')
&& (count($v[$i]['ou']) > 0)) {
$group_iterator = $DB->request([
'SELECT' => 'id',
'FROM' => 'glpi_groups',
'WHERE' => ['ldap_group_dn' => Toolbox::addslashes_deep($v[$i]['ou'])]
]);
while ($group = $group_iterator->next()) {
$this->fields["_groups"][] = $group['id'];
}
}
// searching with ldap_field='OU' and ldap_value is also possible
$v[$i]['ou']['count'] = count($v[$i]['ou']);
}
// For each attribute retrieve from LDAP, search in the DB
foreach ($group_fields as $field) {
if (isset($v[$i][$field])
&& isset($v[$i][$field]['count'])
&& ($v[$i][$field]['count'] > 0)) {
unset($v[$i][$field]['count']);
$lgroups = [];
foreach (Toolbox::addslashes_deep($v[$i][$field]) as $lgroup) {
$lgroups[] = [
new \QueryExpression($DB::quoteValue($lgroup).
" LIKE ".
$DB::quoteName('ldap_value'))
];
}
$group_iterator = $DB->request([
'SELECT' => 'id',
'FROM' => 'glpi_groups',
'WHERE' => [
'ldap_field' => $field,
'OR' => $lgroups
]
]);
while ($group = $group_iterator->next()) {
$this->fields["_groups"][] = $group['id'];
}
}
}
} // for each ldapresult
} // count($group_fields)
}
/**
* Function that tries to load the user membership from LDAP
* by searching in the attributes of the Groups.
*
* @param resource $ldap_connection LDAP connection
* @param array $ldap_method LDAP method
* @param string $userdn Basedn of the user
* @param string $login User login
*
* @return boolean true if search is applicable, false otherwise
*/
private function getFromLDAPGroupDiscret($ldap_connection, array $ldap_method, $userdn, $login) {
global $DB;
// No group_member_field : unable to get group
if (empty($ldap_method["group_member_field"])) {
return false;
}
if ($ldap_method["use_dn"]) {
$user_tmp = $userdn;
} else {
//Don't add $ldap_method["login_field"]."=", because sometimes it may not work (for example with posixGroup)
$user_tmp = $login;
}
$v = $this->ldap_get_user_groups($ldap_connection, $ldap_method["basedn"],
$user_tmp,
$ldap_method["group_condition"],
$ldap_method["group_member_field"],
$ldap_method["use_dn"],
$ldap_method["login_field"]);
foreach ($v as $result) {
if (isset($result[$ldap_method["group_member_field"]])
&& is_array($result[$ldap_method["group_member_field"]])
&& (count($result[$ldap_method["group_member_field"]]) > 0)) {
$iterator = $DB->request([
'SELECT' => 'id',
'FROM' => 'glpi_groups',
'WHERE' => ['ldap_group_dn' => Toolbox::addslashes_deep($result[$ldap_method["group_member_field"]])]
]);
while ($group = $iterator->next()) {
$this->fields["_groups"][] = $group['id'];
}
}
}
return true;
}
/**
* Function that tries to load the user informations from LDAP.
*
* @param resource $ldap_connection LDAP connection
* @param array $ldap_method LDAP method
* @param string $userdn Basedn of the user
* @param string $login User Login
* @param boolean $import true for import, false for update
*
* @return boolean true if found / false if not
*/
function getFromLDAP($ldap_connection, array $ldap_method, $userdn, $login, $import = true) {
global $DB, $CFG_GLPI;
// we prevent some delay...
if (empty($ldap_method["host"])) {
return false;
}
if (is_resource($ldap_connection)) {
//Set all the search fields
$this->fields['password'] = "";
$fields = AuthLDAP::getSyncFields($ldap_method);
//Hook to allow plugin to request more attributes from ldap
$fields = Plugin::doHookFunction("retrieve_more_field_from_ldap", $fields);
$fields = array_filter($fields);
$f = self::getLdapFieldNames($fields);
$sr = @ ldap_read($ldap_connection, $userdn, "objectClass=*", $f);
$v = AuthLDAP::get_entries_clean($ldap_connection, $sr);
if (!is_array($v)
|| ( count($v) == 0)
|| empty($v[0][$fields['name']][0])) {
return false;
}
//Store user's dn
$this->fields['user_dn'] = addslashes($userdn);
//Store date_sync
$this->fields['date_sync'] = $_SESSION['glpi_currenttime'];
// Empty array to ensure than syncDynamicEmails will be done
$this->fields["_emails"] = [];
// force authtype as we retrieve this user by ldap (we could have login with SSO)
$this->fields["authtype"] = Auth::LDAP;
foreach ($fields as $k => $e) {
$val = AuthLDAP::getFieldValue(
[$e => self::getLdapFieldValue($e, $v)],
$e
);
if (empty($val)) {
switch ($k) {
case "language" :
// Not set value : managed but user class
break;
case "usertitles_id" :
case "usercategories_id" :
case 'locations_id' :
case 'users_id_supervisor' :
$this->fields[$k] = 0;
break;
default :
$this->fields[$k] = "";
}
} else {
$val = Toolbox::addslashes_deep($val);
switch ($k) {
case "email1" :
case "email2" :
case "email3" :
case "email4" :
// Manage multivaluable fields
if (!empty($v[0][$e])) {
foreach ($v[0][$e] as $km => $m) {
if (!preg_match('/count/', $km)) {
$this->fields["_emails"][] = addslashes($m);
}
}
// Only get them once if duplicated
$this->fields["_emails"] = array_unique($this->fields["_emails"]);
}
break;
case "language" :
$language = Config::getLanguage($val);
if ($language != '') {
$this->fields[$k] = $language;
}
break;
case "usertitles_id" :
$this->fields[$k] = Dropdown::importExternal('UserTitle', $val);
break;
case 'locations_id' :
// use import to build the location tree
$this->fields[$k] = Dropdown::import('Location',
['completename' => $val,
'entities_id' => 0,
'is_recursive' => 1]);
break;
case "usercategories_id" :
$this->fields[$k] = Dropdown::importExternal('UserCategory', $val);
break;
case 'users_id_supervisor':
$this->fields[$k] = self::getIdByField('user_dn', $val, false);
break;
default :
$this->fields[$k] = $val;
}
}
}
// Empty array to ensure than syncLdapGroups will be done
$this->fields["_groups"] = [];
///The groups are retrieved by looking into an ldap user object
if (($ldap_method["group_search_type"] == 0)
|| ($ldap_method["group_search_type"] == 2)) {
$this->getFromLDAPGroupVirtual($ldap_connection, $ldap_method, $userdn, $login);
}
///The groups are retrived by looking into an ldap group object
if (($ldap_method["group_search_type"] == 1)
|| ($ldap_method["group_search_type"] == 2)) {
$this->getFromLDAPGroupDiscret($ldap_connection, $ldap_method, $userdn, $login);
}
///Only process rules if working on the master database
if (!$DB->isSlave()) {
//Instanciate the affectation's rule
$rule = new RuleRightCollection();
//Process affectation rules :
//we don't care about the function's return because all
//the datas are stored in session temporary
if (isset($this->fields["_groups"])) {
$groups = $this->fields["_groups"];
} else {
$groups = [];
}
$this->fields = $rule->processAllRules($groups, Toolbox::stripslashes_deep($this->fields), [
'type' => Auth::LDAP,
'ldap_server' => $ldap_method["id"],
'connection' => $ldap_connection,
'userdn' => $userdn,
'login' => $this->fields['name'],
'mail_email' => $this->fields['_emails']
]);
$this->fields['_ruleright_process'] = true;
//If rule action is ignore import
if ($import
&& isset($this->fields["_stop_import"])) {
return false;
}
//or no rights found & do not import users with no rights
if ($import
&& !$CFG_GLPI["use_noright_users_add"]) {
$ok = false;
if (isset($this->fields["_ldap_rules"])
&& count($this->fields["_ldap_rules"])) {
if (isset($this->fields["_ldap_rules"]["rules_entities_rights"])
&& count($this->fields["_ldap_rules"]["rules_entities_rights"])) {
$ok = true;
}
if (!$ok) {
$entity_count = 0;
$right_count = 0;
if (Profile::getDefault()) {
$right_count++;
}
if (isset($this->fields["_ldap_rules"]["rules_entities"])) {
$entity_count += count($this->fields["_ldap_rules"]["rules_entities"]);
}
if (isset($this->input["_ldap_rules"]["rules_rights"])) {
$right_count += count($this->fields["_ldap_rules"]["rules_rights"]);
}
if ($entity_count && $right_count) {
$ok = true;
}
}
}
if (!$ok) {
$this->fields["_stop_import"] = true;
return false;
}
}
// Add ldap result to data send to the hook
$this->fields['_ldap_result'] = $v;
$this->fields['_ldap_conn'] = $ldap_connection;
//Hook to retrieve more information for ldap
$this->fields = Plugin::doHookFunction("retrieve_more_data_from_ldap", $this->fields);
unset($this->fields['_ldap_result']);
}
return true;
}
return false;
} // getFromLDAP()
/**
* Get all groups a user belongs to.
*
* @param resource $ds ldap connection
* @param string $ldap_base_dn Basedn used
* @param string $user_dn Basedn of the user
* @param string $group_condition group search condition
* @param string $group_member_field group field member in a user object
* @param boolean $use_dn search dn of user ($login_field=$user_dn) in group_member_field
* @param string $login_field user login field
*
* @return array Groups of the user located in [0][$group_member_field] in returned array
*/
function ldap_get_user_groups($ds, $ldap_base_dn, $user_dn, $group_condition,
$group_member_field, $use_dn, $login_field) {
$groups = [];
$listgroups = [];
//User dn may contain ( or ), need to espace it!
$user_dn = str_replace(["(", ")", "\,", "\+"], ["\(", "\)", "\\\,", "\\\+"],
$user_dn);
//Only retrive cn and member attributes from groups
$attrs = ['dn'];
if (!$use_dn) {
$filter = "(& $group_condition (|($group_member_field=$user_dn)
($group_member_field=$login_field=$user_dn)))";
} else {
$filter = "(& $group_condition ($group_member_field=$user_dn))";
}
//Perform the search
$filter = Toolbox::unclean_cross_side_scripting_deep($filter);
$sr = ldap_search($ds, $ldap_base_dn, $filter, $attrs);
//Get the result of the search as an array
$info = AuthLDAP::get_entries_clean($ds, $sr);
//Browse all the groups
$info_count = count($info);
for ($i = 0; $i < $info_count; $i++) {
//Get the cn of the group and add it to the list of groups
if (isset($info[$i]["dn"]) && ($info[$i]["dn"] != '')) {
$listgroups[$i] = $info[$i]["dn"];
}
}
//Create an array with the list of groups of the user
$groups[0][$group_member_field] = $listgroups;
//Return the groups of the user
return $groups;
}
/**
* Function that tries to load the user informations from IMAP.
*
* @param array $mail_method mail method description array
* @param string $name login of the user
*
* @return boolean true if method is applicable, false otherwise
*/
function getFromIMAP(array $mail_method, $name) {
global $DB;
// we prevent some delay..
if (empty($mail_method["host"])) {
return false;
}
// some defaults...
$this->fields['password'] = "";
// Empty array to ensure than syncDynamicEmails will be done
$this->fields["_emails"] = [];
$email = '';
if (strpos($name, "@")) {
$email = $name;
} else {
$email = $name . "@" . $mail_method["host"];
}
$this->fields["_emails"][] = $email;
$this->fields['name'] = $name;
//Store date_sync
$this->fields['date_sync'] = $_SESSION['glpi_currenttime'];
// force authtype as we retrieve this user by imap (we could have login with SSO)
$this->fields["authtype"] = Auth::MAIL;
if (!$DB->isSlave()) {
//Instanciate the affectation's rule
$rule = new RuleRightCollection();
//Process affectation rules :
//we don't care about the function's return because all the datas are stored in session temporary
if (isset($this->fields["_groups"])) {
$groups = $this->fields["_groups"];
} else {
$groups = [];
}
$this->fields = $rule->processAllRules($groups, Toolbox::stripslashes_deep($this->fields), [
'type' => Auth::MAIL,
'mail_server' => $mail_method["id"],
'login' => $name,
'email' => $email]
);
$this->fields['_ruleright_process'] = true;
}
return true;
}
/**
* Function that tries to load the user informations from the SSO server.
*
* @since 0.84
*
* @return boolean true if method is applicable, false otherwise
*/
function getFromSSO() {
global $DB, $CFG_GLPI;
$a_field = [];
foreach ($CFG_GLPI as $key=>$value) {
if (!is_array($value) && !empty($value)
&& strstr($key, "_ssofield")) {
$key = str_replace('_ssofield', '', $key);
$a_field[$key] = $value;
}
}
if (count($a_field) == 0) {
return true;
}
$this->fields['_ruleright_process'] = true;
foreach ($a_field as $field=>$value) {
if (!isset($_SERVER[$value])
|| empty($_SERVER[$value])) {
switch ($field) {
case "title" :
$this->fields['usertitles_id'] = 0;
break;
case "category" :
$this->fields['usercategories_id'] = 0;
break;
default :
$this->fields[$field] = "";
}
} else {
switch ($field) {
case "email1" :
case "email2" :
case "email3" :
case "email4" :
// Manage multivaluable fields
if (!preg_match('/count/', $_SERVER[$value])) {
$this->fields["_emails"][] = addslashes($_SERVER[$value]);
}
// Only get them once if duplicated
$this->fields["_emails"] = array_unique($this->fields["_emails"]);
break;
case "language" :
$language = Config::getLanguage($_SERVER[$value]);
if ($language != '') {
$this->fields[$field] = $language;
}
break;
case "title" :
$this->fields['usertitles_id']
= Dropdown::importExternal('UserTitle', addslashes($_SERVER[$value]));
break;
case "category" :
$this->fields['usercategories_id']
= Dropdown::importExternal('UserCategory', addslashes($_SERVER[$value]));
break;
default :
$this->fields[$field] = $_SERVER[$value];
break;
}
}
}
///Only process rules if working on the master database
if (!$DB->isSlave()) {
//Instanciate the affectation's rule
$rule = new RuleRightCollection();
$this->fields = $rule->processAllRules([], Toolbox::stripslashes_deep($this->fields), [
'type' => Auth::EXTERNAL,
'email' => $this->fields["_emails"],
'login' => $this->fields["name"]
]);
//If rule action is ignore import
if (isset($this->fields["_stop_import"])) {
return false;
}
}
return true;
}
/**
* Blank passwords field of a user in the DB.
* Needed for external auth users.
*
* @return void
*/
function blankPassword() {
global $DB;
if (!empty($this->fields["name"])) {
$DB->update(
$this->getTable(), [
'password' => ''
], [
'name' => $this->fields['name']
]
);
}
}
/**
* Print a good title for user pages.
*
* @return void
*/
function title() {
global $CFG_GLPI;
$buttons = [];
$title = self::getTypeName(Session::getPluralNumber());
if (static::canCreate()) {
$buttons["user.form.php"] = __('Add user...');
$title = "";
if (Auth::useAuthExt()
&& Session::haveRight("user", self::IMPORTEXTAUTHUSERS)) {
// This requires write access because don't use entity config.
$buttons["user.form.php?new=1&ext_auth=1"] = __('... From an external source');
}
}
if (Session::haveRight("user", self::IMPORTEXTAUTHUSERS)
&& (static::canCreate() || static::canUpdate())) {
if (AuthLDAP::useAuthLdap()) {
$buttons["ldap.php"] = __('LDAP directory link');
}
}
Html::displayTitle($CFG_GLPI["root_doc"] . "/pics/users.png", self::getTypeName(Session::getPluralNumber()), $title,
$buttons);
}
/**
* Check if current user have more right than the specified one.
*
* @param integer $ID ID of the user
*
* @return boolean
*/
function currentUserHaveMoreRightThan($ID) {
$user_prof = Profile_User::getUserProfiles($ID);
return Profile::currentUserHaveMoreRightThan($user_prof);
}
/**
* Print the user form.
*
* @param integer $ID ID of the user
* @param array $options Options
* - string target Form target
* - boolean withtemplate Template or basic item
*
* @return boolean true if user found, false otherwise
*/
function showForm($ID, array $options = []) {
global $CFG_GLPI, $DB;
// Affiche un formulaire User
if (($ID != Session::getLoginUserID()) && !self::canView()) {
return false;
}
$this->initForm($ID, $options);
$ismyself = $ID == Session::getLoginUserID();
$higherrights = $this->currentUserHaveMoreRightThan($ID);
if ($ID) {
$caneditpassword = $higherrights || ($ismyself && Session::haveRight('password_update', 1));
} else {
// can edit on creation form
$caneditpassword = true;
}
$extauth = !(($this->fields["authtype"] == Auth::DB_GLPI)
|| (($this->fields["authtype"] == Auth::NOT_YET_AUTHENTIFIED)
&& !empty($this->fields["password"])));
$formtitle = $this->getTypeName(1);
if ($ID > 0) {
$formtitle .= "". __('Vcard')."";
if (Session::canImpersonate($ID)) {
$formtitle .= '';
// "impersonate" button type is set to "button" on form display to prevent it to be used
// by default (as it is the first found in current form) when pressing "enter" key.
// When clicking it, switch to "submit" type to make it submit current user form.
$impersonate_js = <<showFormHeader($options);
$rand = mt_rand();
echo "
";
echo "
";
if ($this->fields["name"] == "" ||
!empty($this->fields["password"])
|| ($this->fields["authtype"] == Auth::DB_GLPI)) {
//display login field for new records, or if this is not external auth
echo "
";
//If it's an external auth, check if the sync_field must be displayed
if ($extauth
&& $this->fields['auths_id']
&& AuthLDAP::isSyncFieldConfigured($this->fields['auths_id'])) {
$syncrand = mt_rand();
echo "
";
if ($tz_available) {
$timezones = $DB->getTimezones();
Dropdown::showFromArray(
'timezone',
$timezones, [
'value' => $this->fields["timezone"],
'display_emptychoice' => true
]
);
} else if (Session::haveRight("config", READ)) {
// Display a warning but only if user is more or less an admin
echo "";
echo $tz_warning;
}
echo "
";
}
echo "
";
if (!GLPI_DEMO_MODE) {
$activerand = mt_rand();
echo "
";
//Authentications information : auth method used and server used
//don't display is creation of a new user'
if (!empty($ID)) {
if (Session::haveRight(self::$rightname, self::READAUTHENT)) {
echo "
" . __('Authentication') . "
";
echo Auth::getMethodName($this->fields["authtype"], $this->fields["auths_id"]);
if (!empty($this->fields["date_sync"])) {
//TRANS: %s is the date of last sync
echo ' '.sprintf(__('Last synchronization on %s'),
Html::convDateTime($this->fields["date_sync"]));
}
if (!empty($this->fields["user_dn"])) {
//TRANS: %s is the user dn
echo ' '.sprintf(__('%1$s: %2$s'), __('User DN'), $this->fields["user_dn"]);
}
if ($this->fields['is_deleted_ldap']) {
echo ' '.__('User missing in LDAP directory');
}
echo "
";
if ($this->fields["last_login"]) {
printf(__('Last login on %s'), Html::convDateTime($this->fields["last_login"]));
}
echo "
";
echo "
";
}
$this->showFormButtons($options);
return true;
}
/** Print the user personnal information for check.
*
* @param integer $userid ID of the user
*
* @return void|boolean false if user is not the current user, otherwise print form
*
* @since 0.84
*/
static function showPersonalInformation($userid) {
global $CFG_GLPI;
$user = new self();
if (!$user->can($userid, READ)
&& ($userid != Session::getLoginUserID())) {
return false;
}
echo "
";
}
}
/**
* Get user by email, importing it from LDAP if not existing.
*
* @param string $email
*
* @return integer ID of user, 0 if not found nor imported
*/
static function getOrImportByEmail($email = '') {
global $DB, $CFG_GLPI;
$iterator = $DB->request([
'SELECT' => 'users_id AS id',
'FROM' => 'glpi_useremails',
'LEFT JOIN' => [
'glpi_users' => [
'FKEY' => [
'glpi_useremails' => 'users_id',
'glpi_users' => 'id'
]
]
],
'WHERE' => [
'glpi_useremails.email' => $DB->escape(stripslashes($email))
],
'ORDER' => ['glpi_users.is_active DESC', 'is_deleted ASC']
]);
//User still exists in DB
if (count($iterator)) {
$result = $iterator->next();
return $result['id'];
} else {
if ($CFG_GLPI["is_users_auto_add"]) {
//Get all ldap servers with email field configured
$ldaps = AuthLDAP::getServersWithImportByEmailActive();
//Try to find the user by his email on each ldap server
foreach ($ldaps as $ldap) {
$params = [
'method' => AuthLDAP::IDENTIFIER_EMAIL,
'value' => $email,
];
$res = AuthLDAP::ldapImportUserByServerId($params,
AuthLDAP::ACTION_IMPORT,
$ldap);
if (isset($res['id'])) {
return $res['id'];
}
}
}
}
return 0;
}
/**
* Handle user deleted in LDAP using configured policy.
*
* @param integer $users_id
*
* @return void
*/
static function manageDeletedUserInLdap($users_id) {
global $CFG_GLPI;
//The only case where users_id can be null if when a user has been imported into GLPI
//it's dn still exists, but doesn't match the connection filter anymore
//In this case, do not try to process the user
if (!$users_id) {
return;
}
//User is present in DB but not in the directory : it's been deleted in LDAP
$tmp = [
'id' => $users_id,
'is_deleted_ldap' => 1,
];
$myuser = new self();
$myuser->getFromDB($users_id);
//User is already considered as delete from ldap
if ($myuser->fields['is_deleted_ldap'] == 1) {
return;
}
switch ($CFG_GLPI['user_deleted_ldap']) {
//DO nothing
default :
case AuthLDAP::DELETED_USER_PRESERVE:
$myuser->update($tmp);
break;
//Put user in trashbin
case AuthLDAP::DELETED_USER_DELETE:
$myuser->delete($tmp);
break;
//Delete all user dynamic habilitations and groups
case AuthLDAP::DELETED_USER_WITHDRAWDYNINFO:
Profile_User::deleteRights($users_id, true);
Group_User::deleteGroups($users_id, true);
$myuser->update($tmp);
break;
//Deactivate the user
case AuthLDAP::DELETED_USER_DISABLE:
$tmp['is_active'] = 0;
$myuser->update($tmp);
break;
//Deactivate the user+ Delete all user dynamic habilitations and groups
case AuthLDAP::DELETED_USER_DISABLEANDWITHDRAWDYNINFO:
$tmp['is_active'] = 0;
$myuser->update($tmp);
Profile_User::deleteRights($users_id, true);
Group_User::deleteGroups($users_id, true);
break;
}
/*
$changes[0] = '0';
$changes[1] = '';
$changes[2] = __('Deleted user in LDAP directory');
Log::history($users_id, 'User', $changes, 0, Log::HISTORY_LOG_SIMPLE_MESSAGE);*/
}
/**
* Get user ID from its name.
*
* @param string $name User name
*
* @return integer
*/
static function getIdByName($name) {
return self::getIdByField('name', $name);
}
/**
* Get user ID from a field
*
* @since 0.84
*
* @param string $field Field name
* @param string $value Field value
*
* @return integer
*/
static function getIdByField($field, $value, $escape = true) {
global $DB;
if ($escape) {
$value = addslashes($value);
}
$iterator = $DB->request([
'SELECT' => 'id',
'FROM' => self::getTable(),
'WHERE' => [$field => $value]
]);
if (count($iterator) == 1) {
$row = $iterator->next();
return (int)$row['id'];
}
return false;
}
/**
* Show password update form for current user.
*
* @param array $error_messages
*
* @return void
*/
public function showPasswordUpdateForm(array $error_messages = []) {
global $CFG_GLPI;
echo '
![\"".__s('Picture')."\"](".
User::getThumbnailURLForPicture($this->fields[)
";
// echo "![](".self::getURLForPicture($this->fields["picture"]).")
";
echo "![\"".__s('Picture')."\"](".
User::getURLForPicture($this->fields[)
";
$full_picture .= "![](\"{$CFG_GLPI['root_doc']}/pics/warning_min.png\")
";
echo $tz_warning;
}
echo "