From 2454909e83537ec8d3134f1241e55663419520ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20H=C3=A4rdeman?= Date: Mon, 23 Aug 2021 09:37:46 +0200 Subject: [PATCH 1/6] [change-password] Set plugins to default to off --- plugins/change-password/index.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plugins/change-password/index.php b/plugins/change-password/index.php index 9c354c80b..a27521536 100644 --- a/plugins/change-password/index.php +++ b/plugins/change-password/index.php @@ -99,7 +99,8 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin $result[] = \RainLoop\Plugins\Property::NewInstance("driver_{$name}_enabled") ->SetLabel('Enable ' . $class::NAME) ->SetType(\RainLoop\Enumerations\PluginPropertyType::BOOL) - ->SetDescription($class::DESCRIPTION); + ->SetDescription($class::DESCRIPTION) + ->SetDefaultValue(false); $result[] = \RainLoop\Plugins\Property::NewInstance("driver_{$name}_allowed_emails") ->SetLabel('Allowed emails') ->SetType(\RainLoop\Enumerations\PluginPropertyType::STRING_TEXT) From ba2b903d6739b7fa9870bb98824b028a2ce1ee23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20H=C3=A4rdeman?= Date: Mon, 23 Aug 2021 09:42:04 +0200 Subject: [PATCH 2/6] [change-password] Use LDAP URI format instead of host/name ldap_connect(, ) is deprecated and ldap_connect() format makes it possible to use ldaps. --- plugins/change-password/drivers/ldap.php | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/plugins/change-password/drivers/ldap.php b/plugins/change-password/drivers/ldap.php index f021c27be..4203bdeee 100644 --- a/plugins/change-password/drivers/ldap.php +++ b/plugins/change-password/drivers/ldap.php @@ -7,8 +7,7 @@ class ChangePasswordDriverLDAP DESCRIPTION = 'Change passwords in LDAP.'; private - $sHostName = 'localhost', - $iHostPort = 389, + $sLdapUri = 'ldap://localhost:389', $sUserDnFormat = '', $sPasswordField = 'userPassword', $sPasswordEncType = 'SHA'; @@ -21,8 +20,7 @@ class ChangePasswordDriverLDAP function __construct(\RainLoop\Config\Plugin $oConfig, \MailSo\Log\Logger $oLogger) { $this->oLogger = $oLogger; - $this->sHostName = \trim($oConfig->Get('plugin', 'ldap_hostname', '')); - $this->iHostPort = (int) $oConfig->Get('plugin', 'ldap_port', 389); + $this->sLdapUri = \trim($oConfig->Get('plugin', 'ldap_uri', '')); $this->sUserDnFormat = \trim($oConfig->Get('plugin', 'ldap_user_dn_format', '')); $this->sPasswordField = \trim($oConfig->Get('plugin', 'ldap_password_field', '')); $this->sPasswordEncType = \trim($oConfig->Get('plugin', 'ldap_password_enc_type', '')); @@ -37,11 +35,8 @@ class ChangePasswordDriverLDAP public static function configMapping() : array { return array( - \RainLoop\Plugins\Property::NewInstance('ldap_hostname')->SetLabel('Hostname') - ->SetDefaultValue('localhost'), - \RainLoop\Plugins\Property::NewInstance('ldap_port')->SetLabel('Port') - ->SetType(\RainLoop\Enumerations\PluginPropertyType::INT) - ->SetDefaultValue(389), + \RainLoop\Plugins\Property::NewInstance('ldap_uri')->SetLabel('LDAP URI') + ->SetDefaultValue('ldap://localhost:389'), \RainLoop\Plugins\Property::NewInstance('ldap_user_dn_format')->SetLabel('User DN format') ->SetDescription('LDAP user dn format. Supported tokens: {email}, {email:user}, {email:domain}, {login}, {domain}, {domain:dc}, {imap:login}, {imap:host}, {imap:port}, {gecos}') ->SetDefaultValue('uid={imap:login},ou=Users,{domain:dc}'), @@ -70,7 +65,7 @@ class ChangePasswordDriverLDAP '{gecos}' => \function_exists('posix_getpwnam') ? \posix_getpwnam($oAccount->Login()) : '' )); - $oCon = \ldap_connect($this->sHostName, $this->iHostPort); + $oCon = \ldap_connect($this->sLdapUri); if (!$oCon) { return false; } From aee1d7841bf7c63ca252dbc8f972b9e961d0715f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20H=C3=A4rdeman?= Date: Mon, 23 Aug 2021 10:02:00 +0200 Subject: [PATCH 3/6] [change-password] Make use of StartTLS configurable This makes the use of all three kinds of connections possible (ldap://, ldap:// + TLS, ldaps://). ldap_start_tls will fail with ldaps://. --- plugins/change-password/drivers/ldap.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/plugins/change-password/drivers/ldap.php b/plugins/change-password/drivers/ldap.php index 4203bdeee..fa8247bb4 100644 --- a/plugins/change-password/drivers/ldap.php +++ b/plugins/change-password/drivers/ldap.php @@ -8,6 +8,7 @@ class ChangePasswordDriverLDAP private $sLdapUri = 'ldap://localhost:389', + $bUseStartTLS = True, $sUserDnFormat = '', $sPasswordField = 'userPassword', $sPasswordEncType = 'SHA'; @@ -21,6 +22,7 @@ class ChangePasswordDriverLDAP { $this->oLogger = $oLogger; $this->sLdapUri = \trim($oConfig->Get('plugin', 'ldap_uri', '')); + $this->bUseStartTLS = (bool) \trim($oConfig->Get('plugin', 'ldap_use_start_tls', '')); $this->sUserDnFormat = \trim($oConfig->Get('plugin', 'ldap_user_dn_format', '')); $this->sPasswordField = \trim($oConfig->Get('plugin', 'ldap_password_field', '')); $this->sPasswordEncType = \trim($oConfig->Get('plugin', 'ldap_password_enc_type', '')); @@ -37,6 +39,9 @@ class ChangePasswordDriverLDAP return array( \RainLoop\Plugins\Property::NewInstance('ldap_uri')->SetLabel('LDAP URI') ->SetDefaultValue('ldap://localhost:389'), + \RainLoop\Plugins\Property::NewInstance('ldap_use_start_tls')->SetLabel('Use StartTLS') + ->SetType(\RainLoop\Enumerations\PluginPropertyType::BOOL) + ->SetDefaultValue(True), \RainLoop\Plugins\Property::NewInstance('ldap_user_dn_format')->SetLabel('User DN format') ->SetDescription('LDAP user dn format. Supported tokens: {email}, {email:user}, {email:domain}, {login}, {domain}, {domain:dc}, {imap:login}, {imap:host}, {imap:port}, {gecos}') ->SetDefaultValue('uid={imap:login},ou=Users,{domain:dc}'), @@ -77,8 +82,10 @@ class ChangePasswordDriverLDAP 'LDAP' ); } - else if (!\ldap_start_tls($oCon)) { - $this->oLogger->Write("ldap_start_tls failed: ".$oCon, \MailSo\Log\Enumerations\Type::WARNING, 'LDAP'); + + if ($this->bUseStartTLS && !@\ldap_start_tls($oCon)) + { + throw new \Exception('ldap_start_tls error '.\ldap_errno($oCon).': '.\ldap_error($oCon)); } if (!\ldap_bind($oCon, $sUserDn, $sPrevPassword)) { From 1d65ec534557a1e859795f308a70716ed5597f2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20H=C3=A4rdeman?= Date: Mon, 23 Aug 2021 10:05:04 +0200 Subject: [PATCH 4/6] [change-password] Document LDAP URI option --- plugins/change-password/drivers/ldap.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plugins/change-password/drivers/ldap.php b/plugins/change-password/drivers/ldap.php index fa8247bb4..e61febd81 100644 --- a/plugins/change-password/drivers/ldap.php +++ b/plugins/change-password/drivers/ldap.php @@ -38,7 +38,8 @@ class ChangePasswordDriverLDAP { return array( \RainLoop\Plugins\Property::NewInstance('ldap_uri')->SetLabel('LDAP URI') - ->SetDefaultValue('ldap://localhost:389'), + ->SetDefaultValue('ldap://localhost:389') + ->SetDescription('LDAP server URI(s), space separated'), \RainLoop\Plugins\Property::NewInstance('ldap_use_start_tls')->SetLabel('Use StartTLS') ->SetType(\RainLoop\Enumerations\PluginPropertyType::BOOL) ->SetDefaultValue(True), From 6c5106dbd266c64272e27d25a9f73c34b06072fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20H=C3=A4rdeman?= Date: Mon, 23 Aug 2021 13:02:07 +0200 Subject: [PATCH 5/6] [change-password] Fix password change js Not sure what rl.hash.set() is supposed to do, but it is undefined, which causes an exeption, which in turn provides an error message even when the password was successfully changed. --- plugins/change-password/js/ChangePasswordUserSettings.js | 1 - 1 file changed, 1 deletion(-) diff --git a/plugins/change-password/js/ChangePasswordUserSettings.js b/plugins/change-password/js/ChangePasswordUserSettings.js index 738bd2741..15a15e751 100644 --- a/plugins/change-password/js/ChangePasswordUserSettings.js +++ b/plugins/change-password/js/ChangePasswordUserSettings.js @@ -117,7 +117,6 @@ this.newPassword(''); this.newPassword2(''); this.passwordUpdateSuccess(true); - rl.hash.set(); rl.settings.set('AuthAccountHash', data.Result); } } From 0728a26e95d2e78ecad7eebcfb6fd9191c8073a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20H=C3=A4rdeman?= Date: Mon, 23 Aug 2021 14:03:27 +0200 Subject: [PATCH 6/6] [change-password] Bump version --- plugins/change-password/index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/change-password/index.php b/plugins/change-password/index.php index a27521536..6e27553a8 100644 --- a/plugins/change-password/index.php +++ b/plugins/change-password/index.php @@ -6,7 +6,7 @@ class ChangePasswordPlugin extends \RainLoop\Plugins\AbstractPlugin { const NAME = 'Change Password', - VERSION = '2.2', + VERSION = '2.3', RELEASE = '2021-07-20', REQUIRED = '2.5.0', CATEGORY = 'Security',