Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(user_ldap): Do not map groups we do not know if they match filter #45364

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

fix(user_ldap): Do not map groups we do not know if they match filter #45364

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions apps/user_ldap/lib/Access.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,18 +440,19 @@ public function username2dn($name) {
*
* @param string $fdn the dn of the group object
* @param string $ldapName optional, the display name of the object
* @param bool $autoMapping Should the group be mapped if not yet mapped
* @return string|false with the name to use in Nextcloud, false on DN outside of search DN
* @throws \Exception
*/
public function dn2groupname($fdn, $ldapName = null) {
public function dn2groupname($fdn, $ldapName = null, bool $autoMapping = true) {
//To avoid bypassing the base DN settings under certain circumstances
//with the group support, check whether the provided DN matches one of
//the given Bases
if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
return false;
}

return $this->dn2ocname($fdn, $ldapName, false);
return $this->dn2ocname($fdn, $ldapName, false, autoMapping:$autoMapping);
}

/**
Expand Down Expand Up @@ -481,10 +482,11 @@ public function dn2username($fdn, $ldapName = null) {
* @param bool $isUser optional, whether it is a user object (otherwise group assumed)
* @param bool|null $newlyMapped
* @param array|null $record
* @param bool $autoMapping Should the group be mapped if not yet mapped
* @return false|string with with the name to use in Nextcloud
* @throws \Exception
*/
public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, ?array $record = null) {
public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, ?array $record = null, bool $autoMapping = true) {
static $intermediates = [];
if (isset($intermediates[($isUser ? 'user-' : 'group-') . $fdn])) {
return false; // is a known intermediate
Expand Down Expand Up @@ -521,6 +523,11 @@ public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped
return false;
}

if (!$autoMapping) {
/* If no auto mapping, stop there */
return false;
}

if (is_null($ldapName)) {
$ldapName = $this->readAttribute($fdn, $nameAttribute, $filter);
if (!isset($ldapName[0]) || empty($ldapName[0])) {
Expand Down
2 changes: 1 addition & 1 deletion apps/user_ldap/lib/Group_LDAP.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1219,7 +1219,7 @@ protected function filterValidGroups(array $listOfGroups): array {
continue;
}
$name = $item[$this->access->connection->ldapGroupDisplayName][0] ?? null;
$gid = $this->access->dn2groupname($dn, $name);
$gid = $this->access->dn2groupname($dn, $name, false);
if (!$gid) {
continue;
}
Expand Down
Loading