Backport of #13740

inlcude AD primary group in user filter, if a group is selected. fixes #12190

fix counting of users in primary group

:lipstick:

adept to OC 7

and escape the search term

Conflicts:
	apps/user_ldap/lib/connection.php

diff --git a/apps/user_ldap/group_ldap.php b/apps/user_ldap/group_ldap.php
index cba19f3791c46ffeb11f1991620c59b3546c8abd..94aa53b8506cfd51c54298ec58e5a0e2b6cdb182 100644 (file)
--- a/apps/user_ldap/group_ldap.php
+++ b/apps/user_ldap/group_ldap.php
@@ -249,32 +249,75 @@ class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
        }
 
        /**
-        * returns a list of users that have the given group as primary group
+        * returns a filter for a "users in primary group" search or count operation
         *
         * @param string $groupDN
-        * @param $limit
-        * @param int $offset
-        * @return string[]
+        * @param string $search
+        * @return string
+        * @throws \Exception
         */
-       public function getUsersInPrimaryGroup($groupDN, $limit = -1, $offset = 0) {
+       private function prepareFilterForUsersInPrimaryGroup($groupDN, $search = '') {
                $groupID = $this->getGroupPrimaryGroupID($groupDN);
                if($groupID === false) {
-                       return array();
+                       throw new \Exception('Not a valid group');
                }
 
-               $filter = $this->access->combineFilterWithAnd(array(
-                       $this->access->connection->ldapUserFilter,
-                       'primaryGroupID=' . $groupID
-               ));
+               $filterParts = [];
+               // part for counting users (see countUsers in user backend)
+               // it is consolidated in OC 8. No big changes for OC 7.
+               $filterParts[] = \OCP\Util::mb_str_replace(
+                       '%uid', '*', $this->access->connection->ldapLoginFilter, 'UTF-8');
+               if(!empty($search)) {
+                       $search = $this->access->escapeFilterPart($search, true);
+                       $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+               }
+               $filterParts[] = 'primaryGroupID=' . $groupID;
+
+               $filter = $this->access->combineFilterWithAnd($filterParts);
 
-               $users = $this->access->fetchListOfUsers(
-                       $filter,
-                       array($this->access->connection->ldapUserDisplayName, 'dn'),
-                       $limit,
-                       $offset
-               );
+               return $filter;
+       }
+
+       /**
+        * returns a list of users that have the given group as primary group
+        *
+        * @param string $groupDN
+        * @param string $search
+        * @param int $limit
+        * @param int $offset
+        * @return string[]
+        */
+       public function getUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
+               try {
+                       $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+                       return $this->access->fetchListOfUsers(
+                               $filter,
+                               array($this->access->connection->ldapUserDisplayName, 'dn'),
+                               $limit,
+                               $offset
+                       );
+               } catch (\Exception $e) {
+                       return array();
+               }
+       }
 
-               return $users;
+       /**
+        * returns the number of users that have the given group as primary group
+        *
+        * @param string $groupDN
+        * @param string $search
+        * @param int $limit
+        * @param int $offset
+        * @return int
+        */
+       public function countUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
+               try {
+                       $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+                       $users = $this->access->countUsers($filter, array('dn'), $limit, $offset);
+                       return (int)$users;
+               } catch (\Exception $e) {
+                       return 0;
+               }
        }
 
        /**
@@ -405,6 +448,7 @@ class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
                if(!$this->groupExists($gid)) {
                        return array();
                }
+               $search = $this->access->escapeFilterPart($search, true);
                $cacheKey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
                // check for cache of the exact query
                $groupUsers = $this->access->connection->getFromCache($cacheKey);
@@ -473,7 +517,7 @@ class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
                $groupUsers = array_slice($groupUsers, $offset, $limit);
 
                //and get users that have the group as primary
-               $primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $limit, $offset);
+               $primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
                $groupUsers = array_unique(array_merge($groupUsers, $primaryUsers));
 
                $this->access->connection->writeToCache($cacheKey, $groupUsers);
@@ -512,10 +556,13 @@ class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
                }
 
                if(empty($search)) {
-                       $groupUsers = count($members);
+                       $primaryUsers = $this->countUsersInPrimaryGroup($groupDN, '');
+                       $groupUsers = count($members) + $primaryUsers;
+
                        $this->access->connection->writeToCache($cacheKey, $groupUsers);
                        return $groupUsers;
                }
+               $search = $this->access->escapeFilterPart($search, true);
                $isMemberUid =
                        (strtolower($this->access->connection->ldapGroupMemberAssocAttr)
                        === 'memberuid');
@@ -557,10 +604,9 @@ class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
                }
 
                //and get users that have the group as primary
-               $primaryUsers = $this->getUsersInPrimaryGroup($groupDN);
-               $groupUsers = array_unique(array_merge($groupUsers, $primaryUsers));
+               $primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
 
-               return count($groupUsers);
+               return count($groupUsers) + $primaryUsers;
        }
 
        /**
@@ -623,6 +669,7 @@ class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
                if(!$this->enabled) {
                        return array();
                }
+               $search = $this->access->escapeFilterPart($search, true);
                $pagingSize = $this->access->connection->ldapPagingSize;
                if ((! $this->access->connection->hasPagedResultSupport)
                        || empty($pagingSize)) {

diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php
index a38f6be00e0502e88231143f15031530866d4707..9ed8a0e7b6979c02bb192ca616f6ee639adf3eff 100644 (file)
--- a/apps/user_ldap/lib/access.php
+++ b/apps/user_ldap/lib/access.php
@@ -1069,7 +1069,7 @@ class Access extends LDAPUtility implements user\IUserTools {
        /**
        * escapes (user provided) parts for LDAP filter
        * @param string $input, the provided value
-       * @param bool $allowAsterisk wether in * at the beginning should be preserved
+       * @param bool $allowAsterisk whether in * at the beginning should be preserved
        * @return string the escaped string
        */
        public function escapeFilterPart($input, $allowAsterisk = false) {

diff --git a/apps/user_ldap/lib/connection.php b/apps/user_ldap/lib/connection.php
index 34a1cb39f9cd39be356fda6133aecf78457b1892..e560c22040d5b109845cc05c92b8815a05e4a8aa 100644 (file)
--- a/apps/user_ldap/lib/connection.php
+++ b/apps/user_ldap/lib/connection.php
@@ -30,7 +30,10 @@ namespace OCA\user_ldap\lib;
  * @property string ldapUserFilter
  * @property string ldapUserDisplayName
  * @property boolean hasPagedResultSupport
+ * @property string[] ldapBaseUsers
  * @property int|string ldapPagingSize holds an integer
+ * @property string ldapLoginFilter
+ * @property string ldapGroupMemberAssocAttr
  */
 class Connection extends LDAPUtility {
        private $ldapConnectionRes = null;

diff --git a/apps/user_ldap/lib/wizard.php b/apps/user_ldap/lib/wizard.php
index 0480e5b6b646b9d52d10637455dfd017866d1b89..a2b86843ea5b553f3d9a1d5e51f0a785f1e12d35 100644 (file)
--- a/apps/user_ldap/lib/wizard.php
+++ b/apps/user_ldap/lib/wizard.php
@@ -804,13 +804,23 @@ class Wizard extends LDAPUtility {
                                                }
                                                $base = $this->configuration->ldapBase[0];
                                                foreach($cns as $cn) {
-                                                       $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, array('dn'));
+                                                       $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, array('dn', 'primaryGroupToken'));
                                                        if(!$this->ldap->isResource($rr)) {
                                                                continue;
                                                        }
                                                        $er = $this->ldap->firstEntry($cr, $rr);
+                                                       $attrs = $this->ldap->getAttributes($cr, $er);
                                                        $dn = $this->ldap->getDN($cr, $er);
-                                                       $filter .= '(memberof=' . $dn . ')';
+                                                       if(empty($dn)) {
+                                                               continue;
+                                                       }
+                                                       $filterPart = '(memberof=' . $dn . ')';
+                                                       if(isset($attrs['primaryGroupToken'])) {
+                                                               $pgt = $attrs['primaryGroupToken'][0];
+                                                               $primaryFilterPart = '(primaryGroupID=' . $pgt .')';
+                                                               $filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
+                                                       }
+                                                       $filter .= $filterPart;
                                                }
                                                $filter .= ')';
                                        }

diff --git a/apps/user_ldap/tests/group_ldap.php b/apps/user_ldap/tests/group_ldap.php
index 8066bce02e3787b9147bcf6fd3e859ffc435a094..b29449d286e8dde9366a40fe98ff543503a150f8 100644 (file)
--- a/apps/user_ldap/tests/group_ldap.php
+++ b/apps/user_ldap/tests/group_ldap.php
@@ -77,10 +77,15 @@ class Test_Group_Ldap extends \PHPUnit_Framework_TestCase {
                        ->method('readAttribute')
                        ->will($this->returnValue(array('u11', 'u22', 'u33', 'u34')));
 
+               // for primary groups
+               $access->expects($this->once())
+                       ->method('countUsers')
+                       ->will($this->returnValue(2));
+
                $groupBackend = new GroupLDAP($access);
                $users = $groupBackend->countUsersInGroup('group');
 
-               $this->assertSame(4, $users);
+               $this->assertSame(6, $users);
        }
 
        public function testCountWithSearchString() {