Merge branch 'master' into encryption_enable_public_upload

Conflicts:
	apps/files_encryption/lib/helper.php
	apps/files_encryption/lib/keymanager.php
	apps/files_encryption/lib/stream.php
	apps/files_encryption/lib/util.php
	apps/files_encryption/tests/keymanager.php

28 files changed, 406 insertions, 61 deletions

diff --git a/apps/user_ldap/ajax/wizard.php b/apps/user_ldap/ajax/wizard.php
index e580c097867..ad75a384369 100644
--- a/apps/user_ldap/ajax/wizard.php
+++ b/apps/user_ldap/ajax/wizard.php
@@ -53,8 +53,11 @@ switch($action) {
 	case 'determineGroupsForGroups':
 	case 'determineAttributes':
 	case 'getUserListFilter':
+	case 'getLoginFilterMode':
 	case 'getUserLoginFilter':
+	case 'getUserFilterMode':
 	case 'getGroupFilter':
+	case 'getGroupFilterMode':
 	case 'countUsers':
 	case 'countGroups':
 		try {
@@ -87,6 +90,9 @@ switch($action) {
 			exit;
 		}
 		$configuration->saveConfiguration();
+		//clear the cache on save
+		$connection = new \OCA\user_ldap\lib\Connection($ldapWrapper, $prefix);
+		$connection->clearCache();
 		OCP\JSON::success();
 		break;
 	default:
diff --git a/apps/user_ldap/group_proxy.php b/apps/user_ldap/group_proxy.php
index acc563c9532..4404bd7fe3a 100644
--- a/apps/user_ldap/group_proxy.php
+++ b/apps/user_ldap/group_proxy.php
@@ -67,16 +67,17 @@ class Group_Proxy extends lib\Proxy implements \OCP\GroupInterface {
 	 * @param $gid string, the gid connected to the request
 	 * @param $method string, the method of the group backend that shall be called
 	 * @param $parameters an array of parameters to be passed
+	 * @param $passOnWhen the result matches this variable
 	 * @return mixed, the result of the method or false
 	 */
-	protected function callOnLastSeenOn($gid, $method, $parameters) {
+	protected function callOnLastSeenOn($gid, $method, $parameters, $passOnWhen) {
 		$cacheKey = $this->getGroupCacheKey($gid);;
 		$prefix = $this->getFromCache($cacheKey);
 		//in case the uid has been found in the past, try this stored connection first
 		if(!is_null($prefix)) {
 			if(isset($this->backends[$prefix])) {
 				$result = call_user_func_array(array($this->backends[$prefix], $method), $parameters);
-				if(!$result) {
+				if($result === $passOnWhen) {
 					//not found here, reset cache to null if group vanished
 					//because sometimes methods return false with a reason
 					$groupExists = call_user_func_array(
diff --git a/apps/user_ldap/js/settings.js b/apps/user_ldap/js/settings.js
index 2fa0ed066c4..5b5f2030635 100644
--- a/apps/user_ldap/js/settings.js
+++ b/apps/user_ldap/js/settings.js
@@ -120,7 +120,7 @@ var LdapConfiguration = {
 	clearMappings: function(mappingSubject) {
 		$.post(
 			OC.filePath('user_ldap','ajax','clearMappings.php'),
-			'ldap_clear_mapping='+mappingSubject,
+			'ldap_clear_mapping='+encodeURIComponent(mappingSubject),
 			function(result) {
 				if(result.status == 'success') {
 					OC.dialogs.info(
@@ -143,6 +143,8 @@ var LdapWizard = {
 	saveBlacklist: {},
 	userFilterGroupSelectState: 'enable',
 	spinner: '<img class="wizSpinner" src="'+ OC.imagePath('core', 'loading.gif') +'">',
+	filterModeAssisted: 0,
+	filterModeRaw: 1,
 
 	ajax: function(param, fnOnSuccess, fnOnError) {
 		$.post(
@@ -160,10 +162,7 @@ var LdapWizard = {
 
 	applyChanges: function (result) {
 		for (id in result.changes) {
-			if(!$.isArray(result.changes[id])) {
-				//no need to blacklist multiselect
-				LdapWizard.saveBlacklist[id] = true;
-			}
+			LdapWizard.blacklistAdd(id);
 			if(id.indexOf('count') > 0) {
 				$('#'+id).text(result.changes[id]);
 			} else {
@@ -195,6 +194,25 @@ var LdapWizard = {
 		}
 	},
 
+
+	blacklistAdd: function(id) {
+		obj = $('#'+id);
+		if(!(obj[0].hasOwnProperty('multiple') && obj[0]['multiple'] == true)) {
+			//no need to blacklist multiselect
+			LdapWizard.saveBlacklist[id] = true;
+			return true;
+		}
+		return false;
+	},
+
+	blacklistRemove: function(id) {
+		if(LdapWizard.saveBlacklist.hasOwnProperty(id)) {
+			delete LdapWizard.saveBlacklist[id];
+			return true;
+		}
+		return false;
+	},
+
 	checkBaseDN: function() {
 		host = $('#ldap_host').val();
 		port = $('#ldap_port').val();
@@ -204,7 +222,8 @@ var LdapWizard = {
 		//FIXME: determine base dn with anonymous access
 		if(host && port && user && pass) {
 			param = 'action=guessBaseDN'+
-					'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+					'&ldap_serverconfig_chooser='+
+					encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 			LdapWizard.showSpinner('#ldap_base');
 			$('#ldap_base').prop('disabled', 'disabled');
@@ -232,7 +251,8 @@ var LdapWizard = {
 
 		if(host && !port) {
 			param = 'action=guessPortAndTLS'+
-					'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+					'&ldap_serverconfig_chooser='+
+					encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 			LdapWizard.showSpinner('#ldap_port');
 			$('#ldap_port').prop('disabled', 'disabled');
@@ -256,6 +276,12 @@ var LdapWizard = {
 	},
 
 	composeFilter: function(type) {
+		subject = type.charAt(0).toUpperCase() + type.substr(1);
+		if(!$('#raw'+subject+'FilterContainer').hasClass('invisible')) {
+			//Raw filter editing, i.e. user defined filter, don't compose
+			return;
+		}
+
 		if(type == 'user') {
 			action = 'getUserListFilter';
 		} else if(type == 'login') {
@@ -265,7 +291,8 @@ var LdapWizard = {
 		}
 
 		param = 'action='+action+
-				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 		LdapWizard.ajax(param,
 			function(result) {
@@ -323,7 +350,8 @@ var LdapWizard = {
 
 	_countThings: function(method) {
 		param = 'action='+method+
-				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 		LdapWizard.ajax(param,
 			function(result) {
@@ -345,7 +373,8 @@ var LdapWizard = {
 
 	detectGroupMemberAssoc: function() {
 		param = 'action=determineGroupMemberAssoc'+
-				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 		LdapWizard.ajax(param,
 			function(result) {
@@ -359,7 +388,8 @@ var LdapWizard = {
 
 	findAttributes: function() {
 		param = 'action=determineAttributes'+
-				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 		LdapWizard.showSpinner('#ldap_loginfilter_attributes');
 		LdapWizard.ajax(param,
@@ -374,7 +404,9 @@ var LdapWizard = {
 				LdapWizard.hideSpinner('#ldap_loginfilter_attributes');
 				LdapWizard.applyChanges(result);
 				$('#ldap_loginfilter_attributes').multiselect('refresh');
-				$('#ldap_loginfilter_attributes').multiselect('enable');
+				if($('#rawLoginFilterContainer').hasClass('invisible')) {
+					$('#ldap_loginfilter_attributes').multiselect('enable');
+				}
 			},
 			function (result) {
 				//deactivate if no attributes found
@@ -390,8 +422,9 @@ var LdapWizard = {
 		if(type != 'Users' && type != 'Groups') {
 			return false;
 		}
-		param = 'action=determineGroupsFor'+type+
-				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+		param = 'action=determineGroupsFor'+encodeURIComponent(type)+
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 		LdapWizard.showSpinner('#'+multisel);
 		LdapWizard.ajax(param,
@@ -405,7 +438,11 @@ var LdapWizard = {
 				LdapWizard.hideSpinner('#'+multisel);
 				LdapWizard.applyChanges(result);
 				$('#'+multisel).multiselect('refresh');
-				$('#'+multisel).multiselect('enable');
+				part = type.slice(0, -1);
+				if($('#raw' + part + 'FilterContainer').hasClass('invisible')) {
+					//enable only when raw filter editing is not turned on
+					$('#'+multisel).multiselect('enable');
+				}
 			},
 			function (result) {
 				LdapWizard.hideSpinner('#'+multisel);
@@ -418,8 +455,9 @@ var LdapWizard = {
 		if(type != 'User' && type != 'Group') {
 			return false;
 		}
-		param = 'action=determine'+type+'ObjectClasses'+
-				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
+		param = 'action=determine'+encodeURIComponent(type)+'ObjectClasses'+
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
 
 		LdapWizard.showSpinner('#'+multisel);
 		LdapWizard.ajax(param,
@@ -485,15 +523,15 @@ var LdapWizard = {
 	},
 
 	initGroupFilter: function() {
+		LdapWizard.regardFilterMode('Group');
 		LdapWizard.findObjectClasses('ldap_groupfilter_objectclass', 'Group');
 		LdapWizard.findAvailableGroups('ldap_groupfilter_groups', 'Groups');
-		LdapWizard.composeFilter('group');
 		LdapWizard.countGroups();
 	},
 
 	initLoginFilter: function() {
+		LdapWizard.regardFilterMode('Login');
 		LdapWizard.findAttributes();
-		LdapWizard.composeFilter('login');
 	},
 
 	initMultiSelect: function(object, id, caption) {
@@ -509,9 +547,9 @@ var LdapWizard = {
 	},
 
 	initUserFilter: function() {
+		LdapWizard.regardFilterMode('User');
 		LdapWizard.findObjectClasses('ldap_userfilter_objectclass', 'User');
 		LdapWizard.findAvailableGroups('ldap_userfilter_groups', 'Users');
-		LdapWizard.composeFilter('user');
 		LdapWizard.countUsers();
 	},
 
@@ -566,9 +604,36 @@ var LdapWizard = {
 		}
 	},
 
+	regardFilterMode: function(subject) {
+		param = 'action=get'+encodeURIComponent(subject)+'FilterMode'+
+				'&ldap_serverconfig_chooser='+
+				encodeURIComponent($('#ldap_serverconfig_chooser').val());
+
+		LdapWizard.ajax(param,
+			function(result) {
+				property = 'ldap' + subject + 'FilterMode';
+				mode = result.changes[property];
+				if(mode == LdapWizard.filterModeRaw
+					&& $('#raw'+subject+'FilterContainer').hasClass('invisible')) {
+					LdapWizard['toggleRaw'+subject+'Filter']();
+				} else if(mode == LdapWizard.filterModeAssisted
+					&& !$('#raw'+subject+'FilterContainer').hasClass('invisible')) {
+					LdapWizard['toggleRaw'+subject+'Filter']();
+				} else {
+					c = $('#raw'+subject+'FilterContainer').hasClass('invisible');
+				}
+			},
+			function (result) {
+				//on error case get back to default i.e. Assisted
+				if(!$('#raw'+subject+'FilterContainer').hasClass('invisible')) {
+					LdapWizard['toggleRaw'+subject+'Filter']();
+				}
+			}
+		);
+	},
+
 	save: function(inputObj) {
-		if(LdapWizard.saveBlacklist.hasOwnProperty(inputObj.id)) {
-			delete LdapWizard.saveBlacklist[inputObj.id];
+		if(LdapWizard.blacklistRemove(inputObj.id)) {
 			return;
 		}
 		if($(inputObj).is('input[type=checkbox]')
@@ -601,8 +666,8 @@ var LdapWizard = {
 	},
 
 	_save: function(object, value) {
-		param = 'cfgkey='+object.id+
-				'&cfgval='+value+
+		param = 'cfgkey='+encodeURIComponent(object.id)+
+				'&cfgval='+encodeURIComponent(value)+
 				'&action=save'+
 				'&ldap_serverconfig_chooser='+$('#ldap_serverconfig_chooser').val();
 
@@ -632,7 +697,9 @@ var LdapWizard = {
 		}
 	},
 
-	toggleRawFilter: function(container, moc, mg, stateVar) {
+	toggleRawFilter: function(container, moc, mg, stateVar, modeKey) {
+		//moc = multiselect objectclass
+		//mg = mutliselect groups
 		if($(container).hasClass('invisible')) {
 			$(container).removeClass('invisible');
 			$(moc).multiselect('disable');
@@ -642,26 +709,62 @@ var LdapWizard = {
 				LdapWizard[stateVar] = 'enable';
 			}
 			$(mg).multiselect('disable');
+			LdapWizard._save({ id: modeKey }, LdapWizard.filterModeRaw);
 		} else {
 			$(container).addClass('invisible');
 			$(mg).multiselect(LdapWizard[stateVar]);
 			$(moc).multiselect('enable');
+			LdapWizard._save({ id: modeKey }, LdapWizard.filterModeAssisted);
+			if(moc.indexOf('user') >= 0) {
+				LdapWizard.blacklistRemove('ldap_userlist_filter');
+				LdapWizard.composeFilter('user');
+			} else {
+				LdapWizard.blacklistRemove('ldap_group_filter');
+				LdapWizard.composeFilter('group');
+			}
 		}
 	},
 
 	toggleRawGroupFilter: function() {
+		LdapWizard.blacklistRemove('ldap_group_filter');
 		LdapWizard.toggleRawFilter('#rawGroupFilterContainer',
 								   '#ldap_groupfilter_objectclass',
 								   '#ldap_groupfilter_groups',
-								   'groupFilterGroupSelectState'
+								   'groupFilterGroupSelectState',
+								   'ldapGroupFilterMode'
   								);
 	},
 
+	toggleRawLoginFilter: function() {
+		LdapWizard.blacklistRemove('ldap_login_filter');
+		container = '#rawLoginFilterContainer';
+		if($(container).hasClass('invisible')) {
+			$(container).removeClass('invisible');
+			action = 'disable';
+			property = 'disabled';
+			mode = LdapWizard.filterModeRaw;
+		} else {
+			$(container).addClass('invisible');
+			action = 'enable';
+			property = false;
+			mode = LdapWizard.filterModeAssisted;
+		}
+		$('#ldap_loginfilter_attributes').multiselect(action);
+		$('#ldap_loginfilter_email').prop('disabled', property);
+		$('#ldap_loginfilter_username').prop('disabled', property);
+		LdapWizard._save({ id: 'ldapLoginFilterMode' }, mode);
+		if(action == 'enable') {
+			LdapWizard.composeFilter('login');
+		}
+	},
+
 	toggleRawUserFilter: function() {
+		LdapWizard.blacklistRemove('ldap_userlist_filter');
 		LdapWizard.toggleRawFilter('#rawUserFilterContainer',
 								   '#ldap_userfilter_objectclass',
 								   '#ldap_userfilter_groups',
-								   'userFilterGroupSelectState'
+								   'userFilterGroupSelectState',
+								   'ldapUserFilterMode'
   								);
 	},
 
@@ -722,6 +825,7 @@ $(document).ready(function() {
 	$('.lwautosave').change(function() { LdapWizard.save(this); });
 	$('#toggleRawUserFilter').click(LdapWizard.toggleRawUserFilter);
 	$('#toggleRawGroupFilter').click(LdapWizard.toggleRawGroupFilter);
+	$('#toggleRawLoginFilter').click(LdapWizard.toggleRawLoginFilter);
 	LdapConfiguration.refreshConfig();
 	$('.ldap_action_continue').click(function(event) {
 		event.preventDefault();
diff --git a/apps/user_ldap/l10n/ca.php b/apps/user_ldap/l10n/ca.php
index 2c5358d6c77..bcc0a6ed872 100644
--- a/apps/user_ldap/l10n/ca.php
+++ b/apps/user_ldap/l10n/ca.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "s'han eliminat els mapatges",
 "Success" => "Èxit",
 "Error" => "Error",
+"Configuration OK" => "Configuració correcte",
+"Configuration incorrect" => "Configuració incorrecte",
+"Configuration incomplete" => "Configuració incompleta",
 "Select groups" => "Selecciona els grups",
 "Select object classes" => "Seleccioneu les classes dels objectes",
 "Select attributes" => "Seleccioneu els atributs",
diff --git a/apps/user_ldap/l10n/cs_CZ.php b/apps/user_ldap/l10n/cs_CZ.php
index 306889781c4..b429e41281b 100644
--- a/apps/user_ldap/l10n/cs_CZ.php
+++ b/apps/user_ldap/l10n/cs_CZ.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "mapování zrušeno",
 "Success" => "Úspěch",
 "Error" => "Chyba",
+"Configuration OK" => "Konfigurace v pořádku",
+"Configuration incorrect" => "Nesprávná konfigurace",
+"Configuration incomplete" => "Nekompletní konfigurace",
 "Select groups" => "Vyberte skupiny",
 "Select object classes" => "Výběr objektových tříd",
 "Select attributes" => "Výběr atributů",
@@ -26,12 +29,18 @@ $TRANSLATIONS = array(
 "_%s group found_::_%s groups found_" => array("nalezena %s skupina","nalezeny %s skupiny","nalezeno %s skupin"),
 "_%s user found_::_%s users found_" => array("nalezen %s uživatel","nalezeni %s uživatelé","nalezeno %s uživatelů"),
 "Invalid Host" => "Neplatný hostitel",
+"Could not find the desired feature" => "Nelze nalézt požadovanou vlastnost",
 "Save" => "Uložit",
 "Test Configuration" => "Vyzkoušet nastavení",
 "Help" => "Nápověda",
+"Limit the access to %s to groups meeting this criteria:" => "Omezit přístup k %s uživatelům splňujícím tyto podmínky:",
 "only those object classes:" => "pouze tyto objektové třídy:",
 "only from those groups:" => "pouze z těchto skupin:",
+"Edit raw filter instead" => "Edituj filtr přímo",
+"Raw LDAP filter" => "Původní filtr LDAP",
+"The filter specifies which LDAP groups shall have access to the %s instance." => "Filtr určuje, kteří uživatelé LDAP mají mít přístup k %s instanci.",
 "groups found" => "nalezené skupiny",
+"What attribute shall be used as login name:" => "Který atribut má být použit jako přihlašovací jméno:",
 "LDAP Username:" => "LDAP uživatelské jméno",
 "LDAP Email Address:" => "LDAP e-mailová adresa:",
 "Other Attributes:" => "Další atributy",
@@ -46,6 +55,7 @@ $TRANSLATIONS = array(
 "One Base DN per line" => "Jedna základní DN na řádku",
 "You can specify Base DN for users and groups in the Advanced tab" => "V rozšířeném nastavení můžete určit základní DN pro uživatele a skupiny",
 "Limit the access to %s to users meeting this criteria:" => "Omezit přístup k %s uživatelům splňujícím tyto podmínky:",
+"The filter specifies which LDAP users shall have access to the %s instance." => "Filtr určuje, kteří uživatelé LDAP mají mít přístup k %s instanci.",
 "users found" => "nalezení uživatelé",
 "Back" => "Zpět",
 "Continue" => "Pokračovat",
diff --git a/apps/user_ldap/l10n/de.php b/apps/user_ldap/l10n/de.php
index 15eefd842c2..2aeb5e595bc 100644
--- a/apps/user_ldap/l10n/de.php
+++ b/apps/user_ldap/l10n/de.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "Zuordnungen gelöscht",
 "Success" => "Erfolgreich",
 "Error" => "Fehler",
+"Configuration OK" => "Konfiguration OK",
+"Configuration incorrect" => "Konfiguration nicht korrekt",
+"Configuration incomplete" => "Konfiguration nicht vollständig",
 "Select groups" => "Wähle Gruppen aus",
 "Select object classes" => "Objekt-Klassen auswählen",
 "Select attributes" => "Attribute auswählen",
diff --git a/apps/user_ldap/l10n/de_DE.php b/apps/user_ldap/l10n/de_DE.php
index 0da5307d935..b43ac9048c1 100644
--- a/apps/user_ldap/l10n/de_DE.php
+++ b/apps/user_ldap/l10n/de_DE.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "Zuordnungen gelöscht",
 "Success" => "Erfolg",
 "Error" => "Fehler",
+"Configuration OK" => "Konfiguration OK",
+"Configuration incorrect" => "Konfiguration nicht korrekt",
+"Configuration incomplete" => "Konfiguration nicht vollständig",
 "Select groups" => "Wähle Gruppen",
 "Select object classes" => "Objekt-Klassen auswählen",
 "Select attributes" => "Attribute auswählen",
diff --git a/apps/user_ldap/l10n/el.php b/apps/user_ldap/l10n/el.php
index 2cd93a4f07f..6a0fc107cff 100644
--- a/apps/user_ldap/l10n/el.php
+++ b/apps/user_ldap/l10n/el.php
@@ -1,5 +1,6 @@
 <?php
 $TRANSLATIONS = array(
+"Failed to clear the mappings." => "Αποτυχία εκκαθάρισης των αντιστοιχιών.",
 "Failed to delete the server configuration" => "Αποτυχία διαγραφής ρυθμίσεων διακομιστή",
 "The configuration is valid and the connection could be established!" => "Οι ρυθμίσεις είναι έγκυρες και η σύνδεση μπορεί να πραγματοποιηθεί!",
 "The configuration is valid, but the Bind failed. Please check the server settings and credentials." => "Οι ρυθμίσεις είναι έγκυρες, αλλά απέτυχε η σύνδεση. Παρακαλώ ελέγξτε τις ρυθμίσεις του διακομιστή και τα διαπιστευτήρια.",
@@ -7,6 +8,7 @@ $TRANSLATIONS = array(
 "Take over settings from recent server configuration?" => "Πάρτε πάνω από τις πρόσφατες ρυθμίσεις διαμόρφωσης του διακομιστή?",
 "Keep settings?" => "Διατήρηση ρυθμίσεων;",
 "Cannot add server configuration" => "Αδυναμία προσθήκης ρυθμίσεων διακομιστή",
+"mappings cleared" => "αντιστοιχίες εκκαθαρίστηκαν",
 "Success" => "Επιτυχία",
 "Error" => "Σφάλμα",
 "Select groups" => "Επιλέξτε ομάδες",
@@ -31,6 +33,7 @@ $TRANSLATIONS = array(
 "You can specify Base DN for users and groups in the Advanced tab" => "Μπορείτε να καθορίσετε το Base DN για χρήστες και ομάδες από την καρτέλα Προηγμένες ρυθμίσεις",
 "Back" => "Επιστροφή",
 "Continue" => "Συνέχεια",
+"<b>Warning:</b> Apps user_ldap and user_webdavauth are incompatible. You may experience unexpected behavior. Please ask your system administrator to disable one of them." => "<b>Προσοχή:</b> Οι εφαρμογές user_ldap και user_webdavauth είναι ασύμβατες. Μπορεί να αντιμετωπίσετε απρόβλεπτη συμπεριφορά. Παρακαλώ ζητήστε από τον διαχειριστή συστήματος να απενεργοποιήσει μία από αυτές.",
 "<b>Warning:</b> The PHP LDAP module is not installed, the backend will not work. Please ask your system administrator to install it." => "<b>Προσοχή:</b> Το άρθρωμα PHP LDAP δεν είναι εγκατεστημένο και το σύστημα υποστήριξης δεν θα δουλέψει. Παρακαλώ ζητήστε από τον διαχειριστή συστήματος να το εγκαταστήσει.",
 "Connection Settings" => "Ρυθμίσεις Σύνδεσης",
 "Configuration Active" => "Ενεργοποιηση ρυθμισεων",
@@ -61,6 +64,8 @@ $TRANSLATIONS = array(
 "in bytes" => "σε bytes",
 "Email Field" => "Email τυπος",
 "User Home Folder Naming Rule" => "Χρήστης Προσωπικόςφάκελος Ονομασία Κανόνας ",
-"Leave empty for user name (default). Otherwise, specify an LDAP/AD attribute." => "Αφήστε το κενό για το όνομα χρήστη (προεπιλογή). Διαφορετικά, συμπληρώστε μία ιδιότητα LDAP/AD."
+"Leave empty for user name (default). Otherwise, specify an LDAP/AD attribute." => "Αφήστε το κενό για το όνομα χρήστη (προεπιλογή). Διαφορετικά, συμπληρώστε μία ιδιότητα LDAP/AD.",
+"Internal Username" => "Εσωτερικό Όνομα Χρήστη",
+"Internal Username Attribute:" => "Ιδιότητα Εσωτερικού Ονόματος Χρήστη:"
 );
 $PLURAL_FORMS = "nplurals=2; plural=(n != 1);";
diff --git a/apps/user_ldap/l10n/en_GB.php b/apps/user_ldap/l10n/en_GB.php
index 325256bc8c2..fb54dcb1b13 100644
--- a/apps/user_ldap/l10n/en_GB.php
+++ b/apps/user_ldap/l10n/en_GB.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "mappings cleared",
 "Success" => "Success",
 "Error" => "Error",
+"Configuration OK" => "Configuration OK",
+"Configuration incorrect" => "Configuration incorrect",
+"Configuration incomplete" => "Configuration incomplete",
 "Select groups" => "Select groups",
 "Select object classes" => "Select object classes",
 "Select attributes" => "Select attributes",
diff --git a/apps/user_ldap/l10n/es.php b/apps/user_ldap/l10n/es.php
index 804cc9e4f16..ab219e73d8b 100644
--- a/apps/user_ldap/l10n/es.php
+++ b/apps/user_ldap/l10n/es.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "Asignaciones borradas",
 "Success" => "Éxito",
 "Error" => "Error",
+"Configuration OK" => "Configuración OK",
+"Configuration incorrect" => "Configuración Incorrecta",
+"Configuration incomplete" => "Configuración incompleta",
 "Select groups" => "Seleccionar grupos",
 "Select object classes" => "Seleccionar la clase de objeto",
 "Select attributes" => "Seleccionar atributos",
diff --git a/apps/user_ldap/l10n/et_EE.php b/apps/user_ldap/l10n/et_EE.php
index cf19b062dff..9dda17c3b78 100644
--- a/apps/user_ldap/l10n/et_EE.php
+++ b/apps/user_ldap/l10n/et_EE.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "vastendused puhastatud",
 "Success" => "Korras",
 "Error" => "Viga",
+"Configuration OK" => "Seadistus on korras",
+"Configuration incorrect" => "Seadistus on vigane",
+"Configuration incomplete" => "Seadistus on puudulik",
 "Select groups" => "Vali grupid",
 "Select object classes" => "Vali objekti klassid",
 "Select attributes" => "Vali atribuudid",
diff --git a/apps/user_ldap/l10n/fr.php b/apps/user_ldap/l10n/fr.php
index d53f78eb36f..64d9dcc47cc 100644
--- a/apps/user_ldap/l10n/fr.php
+++ b/apps/user_ldap/l10n/fr.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "associations supprimées",
 "Success" => "Succès",
 "Error" => "Erreur",
+"Configuration OK" => "Configuration OK",
+"Configuration incorrect" => "Configuration incorrecte",
+"Configuration incomplete" => "Configuration incomplète",
 "Select groups" => "Sélectionnez les groupes",
 "Select object classes" => "Sélectionner les classes d'objet",
 "Select attributes" => "Sélectionner les attributs",
diff --git a/apps/user_ldap/l10n/gl.php b/apps/user_ldap/l10n/gl.php
index 6d7f8e334be..3f19b0cf223 100644
--- a/apps/user_ldap/l10n/gl.php
+++ b/apps/user_ldap/l10n/gl.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "limpadas as asignacións",
 "Success" => "Correcto",
 "Error" => "Erro",
+"Configuration OK" => "Configuración correcta",
+"Configuration incorrect" => "Configuración incorrecta",
+"Configuration incomplete" => "Configuración incompleta",
 "Select groups" => "Seleccionar grupos",
 "Select object classes" => "Seleccione as clases de obxectos",
 "Select attributes" => "Seleccione os atributos",
diff --git a/apps/user_ldap/l10n/it.php b/apps/user_ldap/l10n/it.php
index 97ca14e0a85..599a6da48a4 100644
--- a/apps/user_ldap/l10n/it.php
+++ b/apps/user_ldap/l10n/it.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "associazioni cancellate",
 "Success" => "Riuscito",
 "Error" => "Errore",
+"Configuration OK" => "Configurazione corretta",
+"Configuration incorrect" => "Configurazione non corretta",
+"Configuration incomplete" => "Configurazione incompleta",
 "Select groups" => "Seleziona i gruppi",
 "Select object classes" => "Seleziona le classi di oggetti",
 "Select attributes" => "Seleziona gli attributi",
diff --git a/apps/user_ldap/l10n/nl.php b/apps/user_ldap/l10n/nl.php
index 9acd9c088c8..b2e8f173673 100644
--- a/apps/user_ldap/l10n/nl.php
+++ b/apps/user_ldap/l10n/nl.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "vertaaltabel leeggemaakt",
 "Success" => "Succes",
 "Error" => "Fout",
+"Configuration OK" => "Configuratie OK",
+"Configuration incorrect" => "Configuratie onjuist",
+"Configuration incomplete" => "Configuratie incompleet",
 "Select groups" => "Selecteer groepen",
 "Select object classes" => "Selecteer objectklasse",
 "Select attributes" => "Selecteer attributen",
diff --git a/apps/user_ldap/l10n/pt_BR.php b/apps/user_ldap/l10n/pt_BR.php
index cf047b2c88c..940a55489a9 100644
--- a/apps/user_ldap/l10n/pt_BR.php
+++ b/apps/user_ldap/l10n/pt_BR.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "mapeamentos limpos",
 "Success" => "Sucesso",
 "Error" => "Erro",
+"Configuration OK" => "Configuração OK",
+"Configuration incorrect" => "Configuração incorreta",
+"Configuration incomplete" => "Configuração incompleta",
 "Select groups" => "Selecionar grupos",
 "Select object classes" => "Selecione classes de objetos",
 "Select attributes" => "Selecione os atributos",
diff --git a/apps/user_ldap/l10n/ru.php b/apps/user_ldap/l10n/ru.php
index f908fa3cc70..f70ecdcf1f5 100644
--- a/apps/user_ldap/l10n/ru.php
+++ b/apps/user_ldap/l10n/ru.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "Соответствия очищены",
 "Success" => "Успешно",
 "Error" => "Ошибка",
+"Configuration OK" => "Конфигурация в порядке",
+"Configuration incorrect" => "Конфигурация неправильна",
+"Configuration incomplete" => "Конфигурация не завершена",
 "Select groups" => "Выберите группы",
 "Select object classes" => "Выберите объектные классы",
 "Select attributes" => "Выберите атрибуты",
diff --git a/apps/user_ldap/l10n/sl.php b/apps/user_ldap/l10n/sl.php
index 81bc8c9b70c..616be979d06 100644
--- a/apps/user_ldap/l10n/sl.php
+++ b/apps/user_ldap/l10n/sl.php
@@ -1,48 +1,74 @@
 <?php
 $TRANSLATIONS = array(
-"Failed to clear the mappings." => "Preslikav ni bilo mogoče izbrisati",
+"Failed to clear the mappings." => "Čiščenje preslikav je spodletelo.",
 "Failed to delete the server configuration" => "Brisanje nastavitev strežnika je spodletelo.",
 "The configuration is valid and the connection could be established!" => "Nastavitev je veljavna, zato je povezavo mogoče vzpostaviti!",
-"The configuration is valid, but the Bind failed. Please check the server settings and credentials." => "Nastavitev je veljavna, vendar pa je vez Bind spodletela. Preveriti je treba nastavitve strežnika in ustreznost poveril.",
+"The configuration is valid, but the Bind failed. Please check the server settings and credentials." => "Nastavitev je veljavna, vendar pa je vez spodletela. Preveriti je treba nastavitve strežnika in ustreznost poveril.",
+"The configuration is invalid. Please have a look at the logs for further details." => "Nastavitev ni veljavna. Več podrobnosti o napaki je zabeleženih v dnevniku.",
+"No action specified" => "Ni določenega dejanja",
+"No configuration specified" => "Ni določenih nastavitev",
+"No data specified" => "Ni navedenih podatkov",
+" Could not set configuration %s" => "Ni mogoče uveljaviti nastavitev %s",
 "Deletion failed" => "Brisanje je spodletelo.",
-"Take over settings from recent server configuration?" => "Ali naj se prevzame nastavitve nedavne nastavitve strežnika?",
-"Keep settings?" => "Ali nas se nastavitve ohranijo?",
+"Take over settings from recent server configuration?" => "Ali naj bodo prevzete nedavne nastavitve strežnika?",
+"Keep settings?" => "Ali naj se nastavitve ohranijo?",
 "Cannot add server configuration" => "Ni mogoče dodati nastavitev strežnika",
-"mappings cleared" => "Preslikave so izbrisane",
+"mappings cleared" => "preslikave so izbrisane",
 "Success" => "Uspešno končano.",
 "Error" => "Napaka",
+"Configuration OK" => "Nastavitev je ustrezna",
+"Configuration incorrect" => "Nastavitev ni ustrezna",
+"Configuration incomplete" => "Nastavitev je nepopolna",
 "Select groups" => "Izberi skupine",
+"Select object classes" => "Izbor razredov predmeta",
 "Select attributes" => "Izbor atributov",
 "Connection test succeeded" => "Preizkus povezave je uspešno končan.",
 "Connection test failed" => "Preizkus povezave je spodletel.",
 "Do you really want to delete the current Server Configuration?" => "Ali res želite izbrisati trenutne nastavitve strežnika?",
 "Confirm Deletion" => "Potrdi brisanje",
-"_%s group found_::_%s groups found_" => array("","","",""),
-"_%s user found_::_%s users found_" => array("","","",""),
+"_%s group found_::_%s groups found_" => array("%s najdena skupina","%s najdeni skupini","%s najdene skupine","%s najdenih skupin"),
+"_%s user found_::_%s users found_" => array("%s najden uporabnik","%s najdena uporabnika","%s najdeni uporabniki","%s najdenih uporabnikov"),
 "Invalid Host" => "Neveljaven gostitelj",
+"Could not find the desired feature" => "Želene zmožnosti ni mogoče najti",
 "Save" => "Shrani",
 "Test Configuration" => "Preizkusne nastavitve",
 "Help" => "Pomoč",
+"Limit the access to %s to groups meeting this criteria:" => "Omeji dostop %s do skupin glede na kriterij:",
+"only those object classes:" => "le razredi predmeta:",
+"only from those groups:" => "le iz skupin:",
+"Edit raw filter instead" => "Uredi surov filter",
+"Raw LDAP filter" => "Surovi filter LDAP",
+"The filter specifies which LDAP groups shall have access to the %s instance." => "Filter določa, katere skupine LDAP bodo imele dostop do %s.",
+"groups found" => "najdenih skupin",
+"What attribute shall be used as login name:" => "Kateri atribut naj bo uporabljen kot prijavno ime:",
+"LDAP Username:" => "Uporabniško ime LDAP:",
+"LDAP Email Address:" => "Elektronski naslov LDAP:",
+"Other Attributes:" => "Drugi atributi:",
 "Add Server Configuration" => "Dodaj nastavitve strežnika",
 "Host" => "Gostitelj",
 "You can omit the protocol, except you require SSL. Then start with ldaps://" => "Protokol je lahko izpuščen, če ni posebej zahtevan SSL. V tem primeru se mora naslov začeti z ldaps://",
 "Port" => "Vrata",
-"User DN" => "Uporabnik DN",
-"The DN of the client user with which the bind shall be done, e.g. uid=agent,dc=example,dc=com. For anonymous access, leave DN and Password empty." => "DN uporabnikovega odjemalca, s katerim naj se opravi vezava, npr. uid=agent,dc=example,dc=com. Za brezimni dostop sta polji DN in geslo prazni.",
+"User DN" => "Uporabnikovo enolično ime",
+"The DN of the client user with which the bind shall be done, e.g. uid=agent,dc=example,dc=com. For anonymous access, leave DN and Password empty." => "Enolično ime uporabnikovega odjemalca, s katerim naj se opravi vezava, npr. uid=agent,dc=example,dc=com. Za brezimni dostop sta polji prikaznega imena in gesla prazni.",
 "Password" => "Geslo",
-"For anonymous access, leave DN and Password empty." => "Za brezimni dostop sta polji DN in geslo prazni.",
-"One Base DN per line" => "En osnovni DN na vrstico",
-"You can specify Base DN for users and groups in the Advanced tab" => "Osnovni DN za uporabnike in skupine lahko določite v zavihku naprednih možnosti.",
+"For anonymous access, leave DN and Password empty." => "Za brezimni dostop naj bosta polji imena in gesla prazni.",
+"One Base DN per line" => "Eno osnovno enolično ime na vrstico",
+"You can specify Base DN for users and groups in the Advanced tab" => "Osnovno enolično ime za uporabnike in skupine lahko določite v zavihku naprednih možnosti.",
+"Limit the access to %s to users meeting this criteria:" => "Omeji dostop do %s uporabnikom, za katere velja kriterij:",
+"The filter specifies which LDAP users shall have access to the %s instance." => "Filter določa, kateri uporabniki LDAP bodo imeli dostop do %s.",
+"users found" => "najdenih uporabnikov",
 "Back" => "Nazaj",
 "Continue" => "Nadaljuj",
+"<b>Warning:</b> Apps user_ldap and user_webdavauth are incompatible. You may experience unexpected behavior. Please ask your system administrator to disable one of them." => "<b>Opozorilo:</b> določili user_ldap in user_webdavauth sta  neskladni, kar lahko vpliva na delovanje sistema. O napaki pošljite poročilo skrbniku sistema in opozorite, da je treba eno izmed možnosti onemogočiti.",
 "<b>Warning:</b> The PHP LDAP module is not installed, the backend will not work. Please ask your system administrator to install it." => "<b>Opozorilo:</b> modul PHP LDAP mora biti nameščen, sicer vmesnik ne bo deloval. Paket je treba namestiti.",
 "Connection Settings" => "Nastavitve povezave",
 "Configuration Active" => "Dejavna nastavitev",
 "When unchecked, this configuration will be skipped." => "Neizbrana možnost preskoči nastavitev.",
 "User Login Filter" => "Filter prijav uporabnikov",
+"Defines the filter to apply, when login is attempted. %%uid replaces the username in the login action. Example: \"uid=%%uid\"" => "Določi filter, ki bo uveljavljen ob poskusu prijave. %%uid zamenja uporabniško ime pri prijavi, na primer: \"uid=%%uid\"",
 "Backup (Replica) Host" => "Varnostna kopija (replika) podatkov gostitelja",
 "Give an optional backup host. It must be a replica of the main LDAP/AD server." => "Podati je treba izbirno varnostno kopijo gostitelja. Ta mora biti natančna replika strežnika LDAP/AD.",
-"Backup (Replica) Port" => "Varnostna kopija (replika) podatka vrat",
+"Backup (Replica) Port" => "Vrata varnostne kopije (replike)",
 "Disable Main Server" => "Onemogoči glavni strežnik",
 "Case insensitve LDAP server (Windows)" => "Strežnik LDAP ne upošteva velikosti črk (Windows)",
 "Turn off SSL certificate validation." => "Onemogoči določanje veljavnosti potrdila SSL.",
@@ -50,14 +76,16 @@ $TRANSLATIONS = array(
 "in seconds. A change empties the cache." => "v sekundah. Sprememba izprazni predpomnilnik.",
 "Directory Settings" => "Nastavitve mape",
 "User Display Name Field" => "Polje za uporabnikovo prikazano ime",
+"The LDAP attribute to use to generate the user's display name." => "Atribut LDAP za uporabo pri ustvarjanju prikaznega imena uporabnika.",
 "Base User Tree" => "Osnovno uporabniško drevo",
-"One User Base DN per line" => "Eno osnovno uporabniško ime DN na vrstico",
-"User Search Attributes" => "Uporabi atribute iskanja",
+"One User Base DN per line" => "Eno osnovno uporabniško ime na vrstico",
+"User Search Attributes" => "Uporabnikovi atributi iskanja",
 "Optional; one attribute per line" => "Izbirno; en atribut na vrstico",
 "Group Display Name Field" => "Polje za prikazano ime skupine",
+"The LDAP attribute to use to generate the groups's display name." => "Atribut LDAP za uporabo pri ustvarjanju prikaznega imena skupine.",
 "Base Group Tree" => "Osnovno drevo skupine",
-"One Group Base DN per line" => "Eno osnovno ime skupine DN na vrstico",
-"Group Search Attributes" => "Atributi iskanja skupine",
+"One Group Base DN per line" => "Eno osnovno ime skupine na vrstico",
+"Group Search Attributes" => "Skupinski atributi iskanja",
 "Group-Member association" => "Povezava član-skupina",
 "Special Attributes" => "Posebni atributi",
 "Quota Field" => "Polje količinske omejitve",
@@ -66,10 +94,12 @@ $TRANSLATIONS = array(
 "Email Field" => "Polje elektronske pošte",
 "User Home Folder Naming Rule" => "Pravila poimenovanja uporabniške osebne mape",
 "Leave empty for user name (default). Otherwise, specify an LDAP/AD attribute." => "Pustite prazno za uporabniško ime (privzeto), sicer navedite atribut LDAP/AD.",
-"Internal Username" => "Interno uporabniško ime",
-"Internal Username Attribute:" => "Atribut Interno uporabniško ime",
+"Internal Username" => "Programsko uporabniško ime",
+"Internal Username Attribute:" => "Programski atribut uporabniškega imena:",
 "Override UUID detection" => "Prezri zaznavo UUID",
-"Username-LDAP User Mapping" => "Preslikava uporabniško ime - LDAP-uporabnik",
+"UUID Attribute for Users:" => "Atribut UUID za uporabnike:",
+"UUID Attribute for Groups:" => "Atribut UUID za skupine:",
+"Username-LDAP User Mapping" => "Uporabniška preslikava Uporabniško_ime-LDAP",
 "Clear Username-LDAP User Mapping" => "Izbriši preslikavo Uporabniškega imena in LDAP-uporabnika",
 "Clear Groupname-LDAP Group Mapping" => "Izbriši preslikavo Skupine in LDAP-skupine"
 );
diff --git a/apps/user_ldap/l10n/sv.php b/apps/user_ldap/l10n/sv.php
index 2a1a6e46e03..922985e76f0 100644
--- a/apps/user_ldap/l10n/sv.php
+++ b/apps/user_ldap/l10n/sv.php
@@ -4,6 +4,7 @@ $TRANSLATIONS = array(
 "Failed to delete the server configuration" => "Misslyckades med att radera serverinställningen",
 "The configuration is valid and the connection could be established!" => "Inställningen är giltig och anslutningen kunde upprättas!",
 "The configuration is valid, but the Bind failed. Please check the server settings and credentials." => "Konfigurationen är riktig, men Bind felade. Var vänlig och kontrollera serverinställningar och logininformation.",
+"The configuration is invalid. Please have a look at the logs for further details." => "Inställningen är ogiltig. Vänligen se ownCloud-loggen för fler detaljer.",
 "No action specified" => "Ingen åtgärd har angetts",
 "No configuration specified" => "Ingen konfiguration har angetts",
 "No data specified" => "Ingen data har angetts",
@@ -15,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "mappningar rensade",
 "Success" => "Lyckat",
 "Error" => "Fel",
+"Configuration OK" => "Konfigurationen är OK",
+"Configuration incorrect" => "Felaktig konfiguration",
+"Configuration incomplete" => "Konfigurationen är ej komplett",
 "Select groups" => "Välj grupper",
 "Select object classes" => "Välj Objekt-klasser",
 "Select attributes" => "Välj attribut",
diff --git a/apps/user_ldap/l10n/tr.php b/apps/user_ldap/l10n/tr.php
index 80fd5705772..040c707cc46 100644
--- a/apps/user_ldap/l10n/tr.php
+++ b/apps/user_ldap/l10n/tr.php
@@ -16,6 +16,9 @@ $TRANSLATIONS = array(
 "mappings cleared" => "Dönüşümler temizlendi",
 "Success" => "Başarılı",
 "Error" => "Hata",
+"Configuration OK" => "Yapılandırma tamam",
+"Configuration incorrect" => "Yapılandırma geçersiz",
+"Configuration incomplete" => "Yapılandırma tamamlanmamış",
 "Select groups" => "Grupları seç",
 "Select object classes" => "Nesne sınıflarını seç",
 "Select attributes" => "Nitelikleri seç",
diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php
index a07bd3fa11f..ecc74b6cf54 100644
--- a/apps/user_ldap/lib/access.php
+++ b/apps/user_ldap/lib/access.php
@@ -199,7 +199,9 @@ class Access extends LDAPUtility {
 	 */
 	public function username2dn($name) {
 		$dn = $this->ocname2dn($name, true);
-		if($dn) {
+		//Check whether the DN belongs to the Base, to avoid issues on multi-
+		//server setups
+		if($dn && $this->isDNPartOfBase($dn, $this->connection->ldapBaseUsers)) {
 			return $dn;
 		}
 
diff --git a/apps/user_ldap/lib/configuration.php b/apps/user_ldap/lib/configuration.php
index e14ed824a74..c396d5b4bf8 100644
--- a/apps/user_ldap/lib/configuration.php
+++ b/apps/user_ldap/lib/configuration.php
@@ -47,12 +47,15 @@ class Configuration {
 		'ldapUserFilterObjectclass' => null,
 		'ldapUserFilterGroups' => null,
 		'ldapUserFilter' => null,
+		'ldapUserFilterMode' => null,
 		'ldapGroupFilter' => null,
+		'ldapGroupFilterMode' => null,
 		'ldapGroupFilterObjectclass' => null,
 		'ldapGroupFilterGroups' => null,
 		'ldapGroupDisplayName' => null,
 		'ldapGroupMemberAssocAttr' => null,
 		'ldapLoginFilter' => null,
+		'ldapLoginFilterMode' => null,
 		'ldapLoginFilterEmail' => null,
 		'ldapLoginFilterUsername' => null,
 		'ldapLoginFilterAttributes' => null,
@@ -72,6 +75,7 @@ class Configuration {
 		'ldapExpertUsernameAttr' => null,
 		'ldapExpertUUIDUserAttr' => null,
 		'ldapExpertUUIDGroupAttr' => null,
+		'lastJpegPhotoLookup' => null,
 	);
 
 	public function __construct($configPrefix, $autoread = true) {
@@ -301,13 +305,16 @@ class Configuration {
 			'ldap_base_users'					=> '',
 			'ldap_base_groups'					=> '',
 			'ldap_userlist_filter'				=> '',
+			'ldap_user_filter_mode'				=> 0,
 			'ldap_userfilter_objectclass'		=> '',
 			'ldap_userfilter_groups'			=> '',
 			'ldap_login_filter'					=> 'uid=%uid',
+			'ldap_login_filter_mode'			=> 0,
 			'ldap_loginfilter_email'			=> 0,
 			'ldap_loginfilter_username'			=> 1,
 			'ldap_loginfilter_attributes'		=> '',
 			'ldap_group_filter'					=> '',
+			'ldap_group_filter_mode'			=> 0,
 			'ldap_groupfilter_objectclass'		=> '',
 			'ldap_groupfilter_groups'			=> '',
 			'ldap_display_name'					=> 'displayName',
@@ -330,6 +337,7 @@ class Configuration {
 			'ldap_expert_uuid_user_attr'		=> '',
 			'ldap_expert_uuid_group_attr'		=> '',
 			'has_memberof_filter_support'		=> 0,
+			'last_jpegPhoto_lookup'				=> 0,
 		);
 	}
 
@@ -352,11 +360,14 @@ class Configuration {
 			'ldap_userfilter_objectclass' 		=> 'ldapUserFilterObjectclass',
 			'ldap_userfilter_groups'	 		=> 'ldapUserFilterGroups',
 			'ldap_userlist_filter'				=> 'ldapUserFilter',
+			'ldap_user_filter_mode'				=> 'ldapUserFilterMode',
 			'ldap_login_filter'					=> 'ldapLoginFilter',
+			'ldap_login_filter_mode'			=> 'ldapLoginFilterMode',
 			'ldap_loginfilter_email'			=> 'ldapLoginFilterEmail',
 			'ldap_loginfilter_username'			=> 'ldapLoginFilterUsername',
 			'ldap_loginfilter_attributes'		=> 'ldapLoginFilterAttributes',
 			'ldap_group_filter'					=> 'ldapGroupFilter',
+			'ldap_group_filter_mode'			=> 'ldapGroupFilterMode',
 			'ldap_groupfilter_objectclass'		=> 'ldapGroupFilterObjectclass',
 			'ldap_groupfilter_groups'			=> 'ldapGroupFilterGroups',
 			'ldap_display_name'					=> 'ldapUserDisplayName',
@@ -377,6 +388,7 @@ class Configuration {
 			'ldap_expert_uuid_user_attr' 		=> 'ldapExpertUUIDUserAttr',
 			'ldap_expert_uuid_group_attr'		=> 'ldapExpertUUIDGroupAttr',
 			'has_memberof_filter_support'		=> 'hasMemberOfFilterSupport',
+			'last_jpegPhoto_lookup'				=> 'lastJpegPhotoLookup',
 		);
 		return $array;
 	}
diff --git a/apps/user_ldap/lib/proxy.php b/apps/user_ldap/lib/proxy.php
index c74b357bdd2..30e1875901c 100644
--- a/apps/user_ldap/lib/proxy.php
+++ b/apps/user_ldap/lib/proxy.php
@@ -54,7 +54,7 @@ abstract class Proxy {
 		return 'group-'.$gid.'-lastSeenOn';
 	}
 
-	abstract protected function callOnLastSeenOn($id, $method, $parameters);
+	abstract protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen);
 	abstract protected function walkBackends($id, $method, $parameters);
 
 	/**
@@ -64,8 +64,9 @@ abstract class Proxy {
 	 * @param $parameters an array of parameters to be passed
 	 * @return mixed, the result of the specified method
 	 */
-	protected function handleRequest($id, $method, $parameters) {
-		if(!$result = $this->callOnLastSeenOn($id,  $method, $parameters)) {
+	protected function handleRequest($id, $method, $parameters, $passOnWhen = false) {
+		$result = $this->callOnLastSeenOn($id,  $method, $parameters, $passOnWhen);
+		if($result === $passOnWhen) {
 			$result = $this->walkBackends($id, $method, $parameters);
 		}
 		return $result;
diff --git a/apps/user_ldap/lib/wizard.php b/apps/user_ldap/lib/wizard.php
index fb6aca9e961..84b397cf5e8 100644
--- a/apps/user_ldap/lib/wizard.php
+++ b/apps/user_ldap/lib/wizard.php
@@ -38,6 +38,9 @@ class Wizard extends LDAPUtility {
 	const LFILTER_USER_LIST  = 3;
 	const LFILTER_GROUP_LIST = 4;
 
+	const LFILTER_MODE_ASSISTED = 2;
+	const LFILTER_MODE_RAW = 1;
+
 	const LDAP_NW_TIMEOUT = 4;
 
 	/**
@@ -148,6 +151,42 @@ class Wizard extends LDAPUtility {
 	}
 
 	/**
+	 * @brief return the state of the Group Filter Mode
+	 */
+	public function getGroupFilterMode() {
+		$this->getFilterMode('ldapGroupFilterMode');
+		return $this->result;
+	}
+
+	/**
+	 * @brief return the state of the Login Filter Mode
+	 */
+	public function getLoginFilterMode() {
+		$this->getFilterMode('ldapLoginFilterMode');
+		return $this->result;
+	}
+
+	/**
+	 * @brief return the state of the User Filter Mode
+	 */
+	public function getUserFilterMode() {
+		$this->getFilterMode('ldapUserFilterMode');
+		return $this->result;
+	}
+
+	/**
+	 * @brief return the state of the mode of the specified filter
+	 * @param $confkey string, contains the access key of the Configuration
+	 */
+	private function getFilterMode($confkey) {
+		$mode = $this->configuration->$confkey;
+		if(is_null($mode)) {
+			$mode = $this->LFILTER_MODE_ASSISTED;
+		}
+		$this->result->addChange($confkey, $mode);
+	}
+
+	/**
 	 * @brief detects the available LDAP attributes
 	 * @returns the instance's WizardResult instance
 	 */
@@ -215,7 +254,7 @@ class Wizard extends LDAPUtility {
 			throw new \Exception('Could not connect to LDAP');
 		}
 
-		$obclasses = array('posixGroup', 'group', '*');
+		$obclasses = array('posixGroup', 'group', 'zimbraDistributionList', '*');
 		$this->determineFeature($obclasses, 'cn', $dbkey, $confkey);
 
 		if($testMemberOf) {
diff --git a/apps/user_ldap/templates/part.wizard-loginfilter.php b/apps/user_ldap/templates/part.wizard-loginfilter.php
index d4a36eb0cb7..dc5d61e9f77 100644
--- a/apps/user_ldap/templates/part.wizard-loginfilter.php
+++ b/apps/user_ldap/templates/part.wizard-loginfilter.php
@@ -29,6 +29,16 @@
 			</select>
 		</p>
 		<p>
+			<label><a id='toggleRawLoginFilter'>↓ <?php p($l->t('Edit raw filter instead'));?></a></label>
+		</p>
+		<p id="rawLoginFilterContainer" class="invisible">
+			<input type="text" id="ldap_login_filter" name="ldap_login_filter"
+				class="lwautosave"
+				placeholder="<?php p($l->t('Raw LDAP filter'));?>"
+				title="<?php p($l->t('Defines the filter to apply, when login is attempted. %%uid replaces the username in the login action. Example: "uid=%%uid"'));?>"
+			/>
+		</p>
+		<p>
 			<div class="ldapWizardInfo invisible">&nbsp;</div>
 		</p>
 
diff --git a/apps/user_ldap/templates/settings.php b/apps/user_ldap/templates/settings.php
index feb5ac6385d..3ccc7a860f5 100644
--- a/apps/user_ldap/templates/settings.php
+++ b/apps/user_ldap/templates/settings.php
@@ -20,9 +20,6 @@
 			<h3><?php p($l->t('Connection Settings'));?></h3>
 			<div>
 				<p><label for="ldap_configuration_active"><?php p($l->t('Configuration Active'));?></label><input type="checkbox" id="ldap_configuration_active" name="ldap_configuration_active" value="1" data-default="<?php p($_['ldap_configuration_active_default']); ?>"  title="<?php p($l->t('When unchecked, this configuration will be skipped.'));?>" /></p>
-				<p><label for="ldap_login_filter"><?php p($l->t('User Login Filter'));?></label><input type="text" id="ldap_login_filter" name="ldap_login_filter"
-					data-default="<?php p($_['ldap_login_filter_default']); ?>"
-					title="<?php p($l->t('Defines the filter to apply, when login is attempted. %%uid replaces the username in the login action. Example: "uid=%%uid"'));?>" /></p>
 				<p><label for="ldap_backup_host"><?php p($l->t('Backup (Replica) Host'));?></label><input type="text" id="ldap_backup_host" name="ldap_backup_host" data-default="<?php p($_['ldap_backup_host_default']); ?>" title="<?php p($l->t('Give an optional backup host. It must be a replica of the main LDAP/AD server.'));?>"></p>
 				<p><label for="ldap_backup_port"><?php p($l->t('Backup (Replica) Port'));?></label><input type="number" id="ldap_backup_port" name="ldap_backup_port" data-default="<?php p($_['ldap_backup_port_default']); ?>"  /></p>
 				<p><label for="ldap_override_main_server"><?php p($l->t('Disable Main Server'));?></label><input type="checkbox" id="ldap_override_main_server" name="ldap_override_main_server" value="1" data-default="<?php p($_['ldap_override_main_server_default']); ?>"  title="<?php p($l->t('Only connect to the replica server.'));?>" /></p>
diff --git a/apps/user_ldap/user_ldap.php b/apps/user_ldap/user_ldap.php
index 6f52bbdf233..527a5c10b85 100644
--- a/apps/user_ldap/user_ldap.php
+++ b/apps/user_ldap/user_ldap.php
@@ -70,6 +70,74 @@ class USER_LDAP extends BackendUtility implements \OCP\UserInterface {
 	}
 
 	/**
+	 * @brief reads jpegPhoto and set is as avatar if available
+	 * @param $uid string ownCloud user name
+	 * @param $dn string the user's LDAP DN
+	 * @return void
+	 */
+	private function updateAvatar($uid, $dn) {
+		$hasLoggedIn = \OCP\Config::getUserValue($uid, 'user_ldap',
+												 'firstLoginAccomplished', 0);
+		$lastChecked = \OCP\Config::getUserValue($uid, 'user_ldap',
+												 'lastJpegPhotoLookup', 0);
+		if(($hasLoggedIn !== '1') || (time() - intval($lastChecked)) < 86400 ) {
+			//update only once a day
+			return;
+		}
+
+		$jpegPhoto = $this->access->readAttribute($dn, 'jpegPhoto');
+		\OCP\Config::setUserValue($uid, 'user_ldap', 'lastJpegPhotoLookup', time());
+		if(!$jpegPhoto || !is_array($jpegPhoto) || !isset($jpegPhoto[0])) {
+			//not set, nothing left to do;
+			return;
+		}
+
+		$image = new \OCP\Image();
+		$image->loadFromBase64(base64_encode($jpegPhoto[0]));
+
+		if(!$image->valid()) {
+			\OCP\Util::writeLog('user_ldap', 'jpegPhoto data invalid for '.$dn,
+								\OCP\Util::ERROR);
+			return;
+		}
+		//make sure it is a square and not bigger than 128x128
+		$size = min(array($image->width(), $image->height(), 128));
+		if(!$image->centerCrop($size)) {
+			\OCP\Util::writeLog('user_ldap',
+								'croping image for avatar failed for '.$dn,
+								\OCP\Util::ERROR);
+			return;
+		}
+
+		if(!\OC\Files\Filesystem::$loaded) {
+			\OC_Util::setupFS($uid);
+		}
+
+		$avatarManager = \OC::$server->getAvatarManager();
+		$avatar = $avatarManager->getAvatar($uid);
+		$avatar->set($image);
+	}
+
+	/**
+	 * @brief checks whether the user is allowed to change his avatar in ownCloud
+	 * @param $uid string the ownCloud user name
+	 * @return boolean either the user can or cannot
+	 */
+	public function canChangeAvatar($uid) {
+		$dn = $this->access->username2dn($uid);
+		if(!$dn) {
+			return false;
+		}
+		$jpegPhoto = $this->access->readAttribute($dn, 'jpegPhoto');
+		if(!$jpegPhoto || !is_array($jpegPhoto) || !isset($jpegPhoto[0])) {
+			//The user is allowed to change his avatar in ownCloud only if no
+			//avatar is provided by LDAP
+			return true;
+		}
+		return false;
+	}
+
+	/**
 	 * @brief Check if the password is correct
 	 * @param $uid The username
 	 * @param $password The password
@@ -100,6 +168,10 @@ class USER_LDAP extends BackendUtility implements \OCP\UserInterface {
 				return false;
 			}
 
+			\OCP\Config::setUserValue($ocname, 'user_ldap',
+									  'firstLoginAccomplished', 1);
+
+			$this->updateAvatar($ocname, $dn);
 			//give back the display name
 			return $ocname;
 		}
@@ -173,6 +245,7 @@ class USER_LDAP extends BackendUtility implements \OCP\UserInterface {
 
 		$this->access->connection->writeToCache('userExists'.$uid, true);
 		$this->updateQuota($dn);
+		$this->updateAvatar($uid, $dn);
 		return true;
 	}
 
@@ -289,7 +362,8 @@ class USER_LDAP extends BackendUtility implements \OCP\UserInterface {
 	public function implementsActions($actions) {
 		return (bool)((OC_USER_BACKEND_CHECK_PASSWORD
 			| OC_USER_BACKEND_GET_HOME
-			| OC_USER_BACKEND_GET_DISPLAYNAME)
+			| OC_USER_BACKEND_GET_DISPLAYNAME
+			| OC_USER_BACKEND_PROVIDE_AVATAR)
 			& $actions);
 	}
 
diff --git a/apps/user_ldap/user_proxy.php b/apps/user_ldap/user_proxy.php
index 092fdbf7c78..b073b143e74 100644
--- a/apps/user_ldap/user_proxy.php
+++ b/apps/user_ldap/user_proxy.php
@@ -54,6 +54,7 @@ class User_Proxy extends lib\Proxy implements \OCP\UserInterface {
 	protected  function walkBackends($uid, $method, $parameters) {
 		$cacheKey = $this->getUserCacheKey($uid);
 		foreach($this->backends as $configPrefix => $backend) {
+// 			print("walkBackend '$configPrefix'<br/>");
 		    if($result = call_user_func_array(array($backend, $method), $parameters)) {
 				$this->writeToCache($cacheKey, $configPrefix);
 				return $result;
@@ -67,16 +68,17 @@ class User_Proxy extends lib\Proxy implements \OCP\UserInterface {
 	 * @param $uid string, the uid connected to the request
 	 * @param $method string, the method of the user backend that shall be called
 	 * @param $parameters an array of parameters to be passed
+	 * @param $passOnWhen the result matches this variable
 	 * @return mixed, the result of the method or false
 	 */
-	protected  function callOnLastSeenOn($uid, $method, $parameters) {
+	protected  function callOnLastSeenOn($uid, $method, $parameters, $passOnWhen) {
 		$cacheKey = $this->getUserCacheKey($uid);
 		$prefix = $this->getFromCache($cacheKey);
 		//in case the uid has been found in the past, try this stored connection first
 		if(!is_null($prefix)) {
 			if(isset($this->backends[$prefix])) {
 				$result = call_user_func_array(array($this->backends[$prefix], $method), $parameters);
-				if(!$result) {
+				if($result === $passOnWhen) {
 					//not found here, reset cache to null if user vanished
 					//because sometimes methods return false with a reason
 					$userExists = call_user_func_array(
@@ -164,6 +166,15 @@ class User_Proxy extends lib\Proxy implements \OCP\UserInterface {
 	}
 
 	/**
+	 * @brief checks whether the user is allowed to change his avatar in ownCloud
+	 * @param $uid string the ownCloud user name
+	 * @return boolean either the user can or cannot
+	 */
+	public function canChangeAvatar($uid) {
+		return $this->handleRequest($uid, 'canChangeAvatar', array($uid), true);
+	}
+
+	/**
 	 * @brief Get a list of all display names
 	 * @returns array with  all displayNames (value) and the corresponding uids (key)
 	 *