aboutsummaryrefslogtreecommitdiffstats
path: root/CHANGES
blob: 3554f72e247d50b06787e2818d22c368bf9e8e3e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
==============================================================================
Done since 0.20.2 release
*** Tables
- Implement the proportional-column-width() function in table-column and
make it possible to specify table width (or inline-progression-dimension)
using percentage values. (Karen Lease)
- Fix a bug causing strange layout when a cell containing a nested table
was laid out again because another cell in the same row was split (David
Dixon's example). (Karen Lease)
*** Datatypes
- Rearrange the Length class hierarchy as part of the table-column proportional
width work. (Karen Lease)
*** Areas
- Fix BlockArea to account for padding and border when calculating space
remaining for content. (Karen Lease)
*** Properties
- Add support for inline-progression-dimension and table-layout. (Karen)
==============================================================================
Done since 0.20 release

*** General
- immediate fix to PDFRenderer and LazyFont, leading up to 0.20.1
- build.xml improvements (Weiqi Gao)

==============================================================================
Done since 0.19 release

*** General
(Lots and lots of stuff by Keiron Liddle)
- all properties are read, a message will indicate if it is not supported
- all elements now handled, with a message for unsupported elements
- uses Unknown element if namespace+element not found, rather than using
FObjMixed
- support for only loading user fonts for pdf when needed
- fo:wrapper should support inheriting properties better
- table row span, bunch of other significant table improvements by Karen Lease
- support for drawing text into PDFGraphics2D
- marker support (ASandstrom)
- streaming pdf
- changed rendering of alpha images for svg in pdf, now uses white
background
- proper device information for PDFGraphics2D rendering
- code formatted (Tore Engvig)
- element and property list mappings now added through single interface

Mark Lillywhite's performance and memory patch added.
Unfortunately breaks marker support.
XSL-FO with markers is not a good idea until it is fixed.

*** Building
- (build.bat, build.sh) now uses only the local set class path (KLiddle)
- (build.xml) added support for easily using w3c testsuite for build target
test (KLiddle)

*** Examples
- (extensive.fo) sets style so that it looks better (KLiddle)
- (images.fo) images are relative to where the doc is rather than an arbitrary
location (KLiddle)
- (glossary.xml, glossary.xsl) fo:marker examples (ASandstrom)
- (embedding.fo, external.fo) added some more info, examples (KLiddle)
- (headfoot.fo) Fix spanning row example so it works (KLease)

*** Documentation
- (embedding.xml) added info about using xslt input handler (KLiddle)
- (examples.xml) some slightly more info about svg -> pdf (KLiddle)
- (svg.xml) some slightly more info about svg -> pdf (KLiddle)
- (testing.xml) added support for easily using w3c testsuite for build
target test (KLiddle)

*** Hyphenation
- (sk.xml) added slovak hyphenation patterns; Obtained from: skhyphen.tex
Submitted by: KRUMPOLEC Martin <krumpolec@asset.sk>

*** FOP libraries
- (buildtools.jar) added support for easily using w3c testsuite for build
target test (KLiddle)

*** XSL Code Generation
- (elements.xsl) some independance improvements (KLiddle)
- (foproperties.xml) setup a couple of props (KLiddle); activated
space-start/space-end (ASandstrom)
- (foproperties.xml) added all remaining properties, currently just with
type String (KLiddle)
- Support 'format' property on fo:page-sequence (ASandstrom)
- (propmaker.xsl) put import at start; puts the right property family name
in resulting prop file (KLiddle)

*** Package org.apache.fop.apps:
- (AWTStarter.java, CommandLineStarter.java, Driver.java) Adds Mark
Lillywhite's performance
and memory patch in all it's glory. Unfortunately breaks marker support.
(AreaTree getNextPage and getPreviousPage return the current page)
XSL-FO with markers is not a good idea until it is fixed.
- (CommandLineOptions.java) command line support for new ps renderer
Submitted by:  Jeremias Maerki <jeremias.maerki@outline.ch>
- (Driver.java) combined property list setting into element setting
also always get parser class name from one place; allows adding mappings from
user config (KLiddle)
- (Driver.java) command line support for new ps renderer
Submitted by:  Jeremias Maerki <jeremias.maerki@outline.ch>
- (Options.java) fixed error where configfile was not being set (KLiddle)
- (Options.java) Added patch for loading config via Thread ContextClassLoader
Submitted by:  Davanum Srinivas
- (StreamRenderer.java) This just moves the marker supporting code from before
Mark's patch into StreamRenderer. Not tested. (SCoffman)

*** Package org.apache.fop.configuration:
- (Configuration.java) combined property list setting into element setting
also always get parser class name from one place (KLiddle)
- (ConfigurationReader.java) combined property list setting into element
setting; also always get parser class name from one place (KLiddle)

*** Package org.apache.fop.datatypes:
- (ToBeImplemented.java) indicates to be implemented status for
properties not implemented (KLiddle)
- (ToBeImplementedProperty.java) indicates to be implemented status for
properties no implemented (KLiddle)

*** Package org.apache.fop.extensions:
- (ExtensionElementMapping.java) combined property list setting into element
setting; also always get parser class name from one place (KLiddle)

*** Package org.apache.fop.fo:
started support to read all relevant properties, mostly commented; added all
remaining elements, currently are indicated as not implemented; removed old
elements (KLiddle)
- (ElementMapping.java) combined property list setting into element setting
also always get parser class name from one place (KLiddle)
- (FONode.java) initial marker support (ASandstrom)
- (FOTreeBuilder.java) gets all properties specified on each element; adds
"Unknown" element for unknown elements or other namespaces; need to get a
consistent and easy way to use the property values (KLiddle)
- (FOTreeBuilder.java) Added patch to allow FOTreeBuilder to be reused easier
Submitted by: Christopher Burkey
- (FObj.java) initial marker support (ASandstrom)
- (PropertyManager.java) handles page break for nested blocks now (KLiddle);
addressing break boundary conditions (ASandstrom)

*** Package org.apache.fop.fo.flow:
Table border placement and border-drawing improvements (PDF only)
Added support for the "height" property on table-row and for display-align
(except "auto") on table-cell.
Partial support for the "collapse" style of cell-borders was contributed
by Ivan Demakov (Jun 14, maybe that was already in 0.19?). The support
for "height" on table-cell was also contributed by Ivan.
- (Block.java) changed Area methods slightly (ASandstrom); initial marker
support, addressing break boundary conditions (ASandstrom)
- (ListBlock.java, ListItem.java, ListItemBody.java, ListItemLabel.java)
added support for 'returned-by' (ASandstrom)
- (Marker.java) initial marker support (ASandstrom)
- (PageNumber.java) Supports page-number formatting (ASandstrom)
- (RetrieveMarker.java) initial marker support (ASandstrom)
- (RowSpanMgr.java) Helper class for spanning rows (KLease)
- (Table.java) Fix some bugs in table and cell border drawing and cell
width calculations (KLease)
- (TableBody.java) Implements spanning table rows (KLease)
- (TableCell.java) Use a copy of BorderAndPadding to fix alignment bugs
in header/footer cells (KLease); Fix some bugs in table and cell border drawing
and cell width calculations (KLease); Make display-align work on table-cell
(KLease) Implements spanning table rows (KLease)
- (TableColumn.java) Fix some bugs in table and cell border drawing and
cell width calculations (KLease)
- (TableRow.java) Make display-align work on table-cell (KLease);
checkBreakBefore signature (Weiqi Gao); Fix spanning bug; use height property
(KLease) Implements spanning table rows (KLease)

*** Package org.apache.fop.fo.pagination:
- (PageNumberGenerator.java) helper class for page-number formatting
(ASandstrom)
- (PageSequence.java) initial marker support; support 'force-page-count';
Supports page-number formatting (ASandstrom); should handle page number
properly, with threads and multiple page sequences
Submitted by: Jeremias Maerki <jeremias.maerki@outline.ch>
- (RepeatablePageMasterAlternatives.java) restore ability to do blank pages
(ASandstrom)
- (Root.java) initial marker support; support 'force-page-count' (ASandstrom)
; should handle page number properly, with threads and multiple page sequences
Submitted by: Jeremias Maerki <jeremias.maerki@outline.ch>

*** Package org.apache.fop.fonts:
- (Glyphs.java) Fixes for unicode escapes that were removed during code
formatting (Sasaki Suguru [s-sasaki@hkg.odn.ne.jp])
- (TTFFile.java) Some glyphs are missed when more then one glyph maps to the
same data, now fixed. (SASAKI Suguru [s-sasaki@hkg.odn.ne.jp])

*** Package org.apache.fop.image:
- (FopImageFactory.java) changed to correct mime type
catch error if batik not available (KLiddle); compiles on jdk1.1;
fixes possible npe when no protocol specified; tries to get the reference from
baseDir + ref path (KLiddle)
- (SVGReader.java) changed to correct mime type; catch error if batik not
available (KLiddle)

*** Package org.apache.fop.layout:
- (AbsolutePositionProps.java, AccessibilityProps.java) adds the remaining
property groups (KLiddle)
- (Area.java) changed Area methods slightly; improving area information; initial
marker support; addressing break boundary conditions (ASandstrom)
- (AreaContainer.java) improving area information (ASandstrom)
- (AuralProps.java, BackgroundProps.java) adds the remaining property groups
(KLiddle)
- (BlockArea.java) Fix a bug which caused FOP to overestimate the space
available for the first line of a Block (KLease)
- (BorderAndPadding.java) Add clone method (KLease); Make display-align work
on table-cell (KLease)
- (FontInfo.java) updates to pdf text painter (KLiddle)
- (LineArea.java) Fixes bug that causes character - glyph mapping to occur
twice in getWordWidth method causing overlapping areas.
(Struan Judd [struan@sjudd.com])
- (LineArea.java) Fixes for unicode escapes that were removed during code
formatting (Sasaki Suguru [s-sasaki@hkg.odn.ne.jp])
- (LineArea.java) Added support for various spaces, inluding non-breaking space
  (fixes bug no 2297) (TEngvig)
Added support for line breaking in the middle of words for CJK languages
Fixes for bug 2243 based on a patch from rainer.garus@nexgo.de
- (LineArea.java) This fixes bug 2556 by changing the leader with pattern
"space" to use an InlineSpace instead of adding actually spaces. (TEngvig)
- (MarginInlineProps.java) adds the remaining property groups (KLiddle)
- (Page.java) initial marker support; page-number formatting (ASandstrom)
- (RelativePositionProps.java) adds the remaining property groups (KLiddle)

*** Package org.apache.fop.layout.hyphenation:
- (Hyphenator.java) Added patch for loading config via Thread ContextClassLoader
(Davanum Srinivas)
- (TernaryTree.java) Fixes for unicode escapes that were removed during code
formatting (Sasaki Suguru [s-sasaki@hkg.odn.ne.jp])

*** Package org.apache.fop.layout.inline:
- (InlineSpace.java) Added support for various spaces, including non-breaking
space (fixes bug no 2297); Added support for line breaking in the middle of
words for CJK languages (TEngvig)
Fixes for bug 2243 based on a patch from rainer.garus@nexgo.de

*** Package org.apache.fop.pdf:
- (PDFColor.java) changed PDFNumber to use static methods (Liddle)
- (PDFDocument.java) adds support for lazy loading of fonts; saves some cpu,
memory (SASAKI Suguru <s-sasaki@hkg.odn.ne.jp>)
- (PDFOutline.java) Adds support for unicode characters in bookmarks.
(SASAKI Suguru [s-sasaki@hkg.odn.ne.jp])

*** Package org.apache.fop.render:
- (PrintRenderer.java) Add new addFilledRect method to make it possible to
draw filled rectangles without any stroke in PDF; in doFrame, use rectangles
instead of lines for borders to eliminate pixel errors (KLease)
- (awt.AWTRenderer.java) updated to new batik interface (KLiddle)
improvements to AWTRenderer (borders,backgrounds...)
(Ralph LaChance/Andy Langowitz):
[ AWTRenderers  (-awt and -print options)
         - eliminated 3D-effect in rendering background color
         - borders now draw wider than 1 pixel if appropriate
         - fixed a roundoff error in background and border dimension/location
         - fixed a positioning error on Top and Right borders ]
- (pdf.FontSetup.java) adds support for lazy loading of fonts
saves some cpu, memory (SASAKI Suguru <s-sasaki@hkg.odn.ne.jp>)
- (pdf/PDFRenderer.java) adds support for lazy loading of fonts
saves some cpu, memory (SASAKI Suguru <s-sasaki@hkg.odn.ne.jp>)
- (pdf/PDFRenderer.java) updated to new batik interface (KLiddle)
- (pdf/PDFRenderer.java) added the start of svg linking; also improved a few
text things (KLiddle)
- (pdf/PDFRenderer.java) Add new addFilledRect method to make it possible to
draw filled rectangles without any stroke in PDF; in doFrame, use rectangles
instead of lines for borders to eliminate pixel errors (KLease)
- (pdf/PDFRenderer.java) added initial impl of text painter that uses pdf fonts
rather than stroking (KLiddle)
- (pdf/PDFRenderer.java) workaround for a bug in Acrobat Reader where text
may disappear or be placed in the wrong position (KLiddle)
- (pdf.fonts.LazyFont.java) adds support for lazy loading of fonts
saves some cpu, memory (SASAKI Suguru <s-sasaki@hkg.odn.ne.jp>)

*** Package org.apache.fop.render.ps:
New addition: postscript renderer
Submitted by: Jeremias Maerki <jeremias.maerki@outline.ch>
- (PSGraphics2D.java, PSRenderer.java) added support for rendering SVG
graphics to ps, not fully functional (KLiddle)

*** Package org.apache.fop.svg:
- (PDFDocumentGraphics2D.java) fixes PDFDoc to work with changed interface;
added the start of svg linking; should handle colour space a bit better;
writes fonts to resources in PDFDocument; sets up the font state if not using
strokes for text (KLiddle)
- (PDFGraphics2D.java) Handles the graphics device better. (Kliddle)
Also handles the alpha transparency better, at least for white backgrounds
it works properly (Thomas E Deweese <thomas.deweese@kodak.com>)
- (PDFGraphics2D.java) should handle colour space a bit better;
writes fonts to resources in PDFDocument; added initial impl of text painter
that uses pdf fonts rather than stroking (KLiddle)
- (PDFTextPainter.java) should handle colour space a bit better; writes fonts
to resources in PDFDocument; added initial impl of text painter that uses pdf
fonts rather than stroking (KLiddle)
- (PDFTranscoder.java) updated to new batik interface (KLiddle); added the
start of svg linking; gets the xml parser class name properly (KLiddle)
- (SVGElement.java) sets the context url properly (with baseDir)
- (SVGObj.java, XMLObj.java) allows better for other xml data (KLiddle)
- (SVGUtilities.java) a utility file for creating some svg things (Kliddle)

*** Testing and Support
- (tools.anttasks.Fop.java) handles baseDir (with a capital D) properly as
suggested by Anthony Tagunov <atagunov@nnt.ru> (KLiddle)
- (tools.anttasks.RunTest.java) added support for easily using w3c testsuite
for build target test (KLiddle)

==============================================================================
Done since 0.18 release

*** Building
- improvements and fixes to build.xml (ASandstrom,KCampbell)

*** General
- Changes to support Batik (KLiddle)
{ FOP now uses Batik to render svg
This is handled for awt - using batik to render to a graphic
and pdf.
Pdf still requires better image support.
The elements and properties are generated from the svgelements.xml
document.
The version of batik is 17/05/2001 cvs. }
- memory buffering (Seshadri G.K.)

*** Examples
- Added Norwegian hyphenation based on Rune Kleveland's original
nohyphb.tex TeX patterns from the ispell-norsk-2.0 package (TEngvig)
adds Danish text (Lars Michael Johnsen)
- fixed up fills and borders for better appearance (KLiddle)
- Fixed basic-link horizontal position with justification turned on. (KCampbell)
- add border-collapse property (KLease)
- Added CID Font example (KCampbell)

*** Hyphenation
- corrected danish hyphenation (Carlos Villegas)
- adds Danish hyphenation file (Carlos Villegas)
- Added Norwegian hyphenation based on Rune Kleveland's original
nohyphb.tex TeX patterns from the ispell-norsk-2.0 package (TEngvig)
- Hyphenation patterns for russian (TEngvig)

*** codegen
- The elements and properties are generated from the svgelements.xml
document. (KLiddle)

*** Package org.apache.fop.apps:
- support for XMLRenderer (ASandstrom)
- Removed uses of System.out where throwing a FOPException should suffice.
Refactored code to throw FOPExceptions so embedding FOP wont' cause app
server JVMs to exit. (KCampbell)
- adding -text and -pcl options to help text (FJannidis)
- sets baseDir to a URL string rather than a file path string (KLiddle)

*** Package org.apache.fop.datatypes:
- New datatype to represent the property border-separation (KLease)

*** Package org.apache.fop.fo:
- fixed a couple of problems when placing foreign objects near
page break (KLiddle)
- Support for LengthPair property type (KLease)
- restored support for external svg images (KLiddle)

*** Package org.apache.fop.fo.flow:
- inlining of images (ASandstrom, Seshadri G.K.)
- footnote height problem fix (KLiddle)
- fixed a couple of problems when placing foreign objects near
page break (KLiddle)
- added support for 'number-columns-repeated' (G. Pretterhofer)
- fixes a null pointer ex if area is removed before creating area (KLiddle)
- footnote height/id reference problem fixes (KLiddle)
- Fix body positioning; remove widow and orphan handling for rows (KLease)
- Make borders closer to CR spec (KLease)
- Improves cell borders when border-collapse=collapse (the default). Note that
this doesn't implement the full CR, but it's a big improvement and will handle
many common cases. (KLease)
- Stop tables from breaking too early, but make sure that all cells are
composed with the same maxHeight and that absolute Height is set correctly.
In TableRow.java, remove old commented out stuff and put back space-before
(for now) and fix a potential bug involving space-before. (KLease)
- Overflows may cause a row to be re-laid out, need to skip cell content
that has already been processed. (AWelch)
- Put back background on table-column and table-cell (KLease)
- increasing padding problem fix (KLiddle)
- Each column in the row should start with the same height available. (AWelch)
- For borders to be drawn properly on overflowed rows must process all
children. (AWelch)
- Use Constants values. (KLease)

*** Package org.apache.fop.fo.pagination:
- running page num ctr now instance variable for servlet use (KLiddle)
- Made logging go to the same stream (out) for pages and the newline
after a page sequence. The newline was previously going to the err stream.
(KCampbell)

*** Package org.apache.fop.fonts:
- Patch from westbay@seaple.icc.ne.jp to use unicode escape char instead of
pound sign because it was interpreted as an invalid double byte char in
Japanese locale (ja_JP.EUC) and wouldn't compile. (TEngvig)
- Fixes a signedness bug in handling cmaps that caused some fonts to be
invalid. (TEngvig)
- Some fonts contains malformed composite glyphs which used to make fop crash.
This adds an errormessage and tries to embed the font without the composite
glyph. (TEngvig)
- Made some tables in the TTF embedding optional to be compatible with more
fonts. This adheres to the TrueType spec, and makes the MS OpenType
extras optional. (KCampbell)
- Bugfix for font headers with long datatype (KCampbell)

*** Package org.apache.fop.fonts.apps:
- Fixes NumberFormatExceptions when reading .pfm files with kerning values.
(TEngvig)

*** Package org.apache.fop.image[.analyser]:
- now passes in url string to the analyser; some readers may need the url
eg. svg document creator (KLiddle)
- inlining of images (ASandstrom, Seshadri G.K.)
- restored support for external svg images (KLiddle)
- gives SVGReader the correct size (KLiddle)

*** Package org.apache.fop.layout:
- Fix table breaking bug (KLease)
- (AreaContainer) Remove offset of X and Y position by border and
padding (KLease)
- (FontInfo, FontState) Refactored FontState so it doesn't do excessive font
lookups per character. (KCampbell)
- (LineArea) Moved mapping from character to cid from LineArea to PDFRenderer.
This fixes bug no 1681 and other issues with wrong characters being displayed
when using CID fonts. (TEngvig)
- (LineArea) vertical align amount modified (KLiddle)
- (LineArea) Fixes hyphenation for CID fonts (TEngvig)
- (basic-link) Fixed basic-link horizontal position with justification
turned on. (KCampbell)

*** Package org.apache.fop.layout.hyphenation:
- Fixed an array out of bounds that caused some combinations of word/pattern
to crash (TEngvig)

*** Package org.apache.fop.layout.inline:
- Fixed basic-link horizontal position with justification turned on. (Campbell)

*** Package org.apache.fop.pdf:
- Changed encoding of CID fonts from customized CMap to predefined Identity-H
encoding. (TEngvig)
- Fixed some bugs in PDF rendering when font embedding fails.
FontDescriptor is now written out anyway to produce a valid PDF
and acrobat reports that the font can't be displayed. (KCampbell)
- Added default producer to fix a bug where the PDF producer is
set to null in the default commandline usage. (KCampbell)
- (PrintRenderer) Correct border positions on absolutely positioned
AreaContainers (fo:block-container) (KLease)

*** Package org.apache.fop.render[.*]:
- ps renderer (JMaerki)
- improved support for XMLRenderer (ASandstrom)
- fixes for -print option (DBradby)
- restored support for external svg images (KLiddle)
- Moved mapping from character to cid from LineArea to PDFRenderer. This
fixes bug no 1681 and other issues with wrong characters being displayed when
using CID fonts. (TEngvig)
- Fix for color carrying over page breaks (ASandstrom)
- Cleaned up renderWordArea. removed unused code. optimized object creation
a little. (KCampbell)
- Fix disappearing text when using text-anchor != start (KLease)
- Fix for using embedded TrueType fonts in SVG. This fix adds the use of
FontState.mapChar to ensure that glyphs used in the SVG document are included
in the embedded font. (TEngvig)
- Fixed some bugs in PDF rendering when font embedding fails.
FontDescriptor is now written out anyway to produce a valid PDF
and acrobat reports that the font can't be displayed. (KCampbell)

*** Package src.org.apache.fop.svg:
- svg handled with batik, supported in pdf, awt and ps
- svg->pdf transcoder, PDFGraphics2D for drawing into pdf
- (PDFDocumentGraphics2D) now supports size setting properly (KLiddle)
- (PDFGraphics2D) fixes a line colouring problem (Liddle)
- (PDFGraphics2D) better svg rendering; stroke style for lines (KLiddle)
- (PDFGraphics2D) now supports size setting properly (KLiddle)
- (SVG) Add viewBox support to svg element. (KLease)

*** Package src.org.apache.fop.tools:
- (TestConverter.java) fixes a problem relating to rendering options for xml
renderer (KLiddle)

test/Testing:
- testing system, for use with the w3c defined testsuite.dtd including our
tests (KLiddle)
- added some simple test files with blocks (KLiddle)
- also a script to create pdf from test suites (KLiddle)

==============================================================================
Done since 0.17 release

- added: improved Fop task for Ant, added basedir attribute [Will Holcomb]
- added: Driver can be reset now [Art Welch]
- added: CID Font support to svg text [Claud Yu]
- added: renders svg to the awt viewer using batik [Keiron Liddle]
- added: start on the PDFGraphics2D for rendering the batik svg to pdf [Keiron Liddle]
- added: a text renderer [Art Welch]
- added: PCL renderer [Art Welch]
- added: a bunch more properties on svg elements [Keiron Liddle]
- added: subset fonts embedding [Tore Engvig]
- added: Dutch hyphenation file [Reinout Verkerk]
- added: Fop is now self-contained (all necessary jar files included) and
         a runnable jar (can be started with java -jar fop.jar) [Kelly Campbell]
- added: support for border and padding shorthand properties [Karen Lease]
- added: use of property manager, new properties handling [Karen Lease]
- added: support for region-start, region-end [Arved Sandstrom]
- added: to migrate FOP to use the svg facilities from Batik in a special cvs branch [Keiron Liddle]
- added: enabling CID keyed truetype fonts; this gives support
         for other encodings besides WinAnsiEncoding (eg japanese, chinese, arabic,
         iso-whatever, etc). Also makes font inclusion easier [Tore Engvig]
- added: new font configuration [Fotis Jannidis]
- added: support for body-start and label-end in lists [Peter S. Housel]
- added: support for non-rotated arcs in svg [Keiron Liddle]
- added: break before and break after for table rows [Keiron Liddle]
- added: error is reported if the number of columns the cells are using is
         different to the number of columns in the table [Keiron Liddle]
- updated: better handling of svg properties using xsl conversion to svgproperties [Keiron Liddle]
- updated: the FOP build to fix the problems of the output location for the
           property code generation. updated ant.jar to version 1.3,
           added all needed jar files [Kelly Campbell]
- changed: cleaned up renderWordArea. removed unused code.
           optimized object creation a   little. [Kelly Campbell]
- changed: refactored FontState so it doesn't do excessive font lookups per character [Kelly Campbell]
- changed: Driver to make embedding Fop easier [Kelly Campbell]
- changed: apps package and commandline usage of Fop [Fotis Jannidis]
- changed: adding a PrintRenderer for all print oriented renderers [Art Welch]
- fixed: problems if calculated leader-length < 0 [Fotis Jannidis]
- fixed: fixes problem with page break after last row of table body [Keiron Liddle]
- fixed: fixed svg placement bug, now puts the image at the correct offset [Keiron Liddle]
- fixed: broken support of jdk 1.1 [Art Welch]
- fixed: xalan 1 support works again, was broken after changes in apps [Kelly Campbell]
- fixed: properly adjusts the max height of table parts, when a footnote is added
         table will not overlap with the footnote [Keiron Liddle]
- fixed: hexadecimal escape sequences in dutch hyphenation file converted
         to iso-latin-1 [Carlos Villegas]
- fixed: the typos in the fonts example in the userconfig.xml
         and optimized conversions to String in TTFReader and use of StringBuffer [Alain Fagot]
- fixed: added border style to relevant border so that borders show up [Keiron Liddle]
- fixed:  put text-anchor in the correct place [Keiron Liddle]
- fixed: InstreamForeignObject checks for no more room in block area [Keiron Liddle]
- fixed: false border rendering for PCL renderer [Art Welch]
- fixed: added default producer to fix a bug where the PDF producer is set to null in the default
         commandline usage. [Kelly Campbell]
- fixed: Made logging go to the same stream (out) for pages and the newline after a page
         sequence. The newline was previously going to the err stream. [Kelly Campbell]



Done since 0.16 release

- added: a branch for a Fop version which supports Japanese text
        (not yet part of the main branch) [Satoshi Ishigami]
- added support for text-anchor in svg:text, viewBox in svg:svg [Aaron Optimizer Digulla]
- added: MIF Renderer [G. Seshadri]
- added: vertical-align to text [Keiron Liddle]
- added: support for PDF outlines (aka bookmarks). See the example in
         docs/examples/fo/pdfoutline.fo [Kelly Campbell]
- added: some text rendering optimizations for PDF [Kelly Campbell]
- added: limited support for fo:wrapper [Kelly Campbell]
- added: support in pdfrenderer for using TrueType fonts, and embedding of TrueType
         and Type1 fonts, and support for kerning [Tore Engvig]
- added: further support for complete font handling in pdf renderer [Alain Fagot]
- added: support for fo:footnote, fo:footnote-body [Keiron Liddle]
- added: support for  values of property textdecoration ('overline','linethrough') [Christian Geisert]
- added: support for font-variant="small-caps" [Eric Schaeffer]
- added/changed: organization of build tools / classes  + support for xalan 2 [Kelly Campbell]
- added: italian hyphenation file [Stephane Bline)]
- added: uml diagrams to online docs [Stuart Zakon]
- added: a new faq for fop at http://www.owal.co.uk:8090/ [Alex McLintock]
- refactoring org.apache.fop.layout  [Keiron Liddle]
- changed:  XObject to use the stream default filter list [Kelly Campbell]
- changed: placed svg inline first, part in moving towards proper inline areas [Keiron Liddle]
- fixed: a problem with spaces before and after a body in table
         also properly sets the width of the table to the sum of the columns [Keiron Liddle]
- fixed: handling of orphans, keep problem [Keiron Liddle]
- fixed: handling of column heights properly [Keiron Liddle]
- fixed: bails out if no rows in table body  [Keiron Liddle]
- fixed: list-block spanning a page problem [Keiron Liddle]
- fixed: an off by one error in the end of stream encoding part of ASCII85Filter
         as reported by Alex Cherepanov [Kelly Campbell]
- fixed: Clarified error reported for order of static-content, flow within a
         page-sequence to meet section 6.4.5 of the spec [Kelly Campbell]
- fixed: leader didn't fill rest of line in table of contents [Fotis Jannidis]
- fixed: throws a more useful error if non-row inside table body [Keiron Liddle]
- fixed: duplicate ID bug for tables that flow over a page [Keiron Liddle]
- fixed: empty flow bug [Kai Strackbein]
- fixed: broken support of jdk 1.1 [Peter Housel]

Done since 0.15 release

- added: support for  background color property, column breaks [Arved Sandstrom]
- added: support for xalan 2 in xslt task [Kelly Campbell]
- added: support for the properties table-omit-header-at-break,
         table-omit-footer-at-break, number-columns-spanned (partly), orphans, widows (only for tables) [Keiron Liddle]
- added: support for multi-column and column spanning (column-count, column-gap, span)[Arved Sandstrom]
- added: compression for pdf files, changed output format to OutputStream [Kelly Campbell]
- added: improved handling of compound properties [Karen Lease]
- added: fo:character and property 'character' [Fotis Jannidis]
         (limitation: not included into hyphenation, no Common Margin and Padding support)
- added: vertical alignment for table cell contents [Keiron Liddle]
- added: Finnish hyphenation patterns [Jarno Elovirta]
- added: hyphenation package [Carlos Villegas], integration into Fop [Fotis Jannidis]
- added: interim configuration package [Fotis Jannidis]
- added: FopImage class that uses JAI [Eric Schaeffer] and JAI compile target [Kelly Campbell]
- added: support for rule-style [Fotis Jannidis]
- added: support for fo:table-header, fo:table-footer, and for the following properties
         in tables: keep-with-next, keep-with-previous  [Keiron Liddle]
- updated: svg stuff for the latest java bindings [Keiron Liddle]
- fixed: enhanced error messages for page layout (region names, master) [Norm Walsh]
- fixed: infinite looping bug when TableCell or TableRow is larger than a page [Hani Elabed]
- fixed: corrected the size of the "-" char [Keiron Liddle]
- fixed: check for unnecessary whitespace at end of line [Marcus Crafter]
- fixed: moves table completely to next page if first row doesn't fit into last page [Keiron Liddle]
- fixed: problem where id's where being setup twice for
         table row going over the page  [Kelly Campbell]
- fixed colspanning so that the cell state keeps track of the
        width so far properly [Keiron Liddle]
- fix to allow JDK 1.1 users to compile and use FOP [Mikko Honkala, Art Welch]
- fix: removing duplicate character mappings [Dharamveer Salecha]
- fix: NullPointerException in FopImageFactory [Kelly Campbell]
- fixed: space after's where not being removed if table row was being removed [Keiron Liddle]
- fixed problem with keep-with not storing the correct rows [Keiron Liddle]
- fixed: extra space after was left behind for rows going over a page [Keiron Liddle]

Done since 0.14 release
- added region-name support, refactoring of region, PageSequence,
        PageMasterReference, flow/static [Kelly Campbell, Arved Sandstrom]
- added CommandLine/Driver -d option to output stack traces [Kelly Campbell, Arved Sandstrom]
- added: a new package for image support and analysis [Pankaj Narula]
- added better svg support (linear gradients, radial gradients, css style selectors,
        css colour names, patterns, path curves (except arcs), text tspan and tref, text whitespace
        handling, text outline and fill, switch, images (including external svg images)
        references in external svg documents, svg elements (below top element), symbol element) [Keiron Liddle]
- added large test suite for svg [Keiron Liddle]
- added support for property textdecoration (only value 'underline') [Christian Geisert]
- added support for type 1 fonts [Jeremias Maerki,Alan Fagot]
- added support for compile target jdk 1.1 only [Art Welch]
- added support for  partial borders in block, block-container,
                     table-row, table-column and table-cell [Corinna Hischke]
- redesign of properties handling, support for computed, compound and shorthand properties,
                     supporting docs [Karen Lease]
- redesign of font handling for AWTRenderer [Dorothea Wiarda]
- added: support for leader-alignment, leader-pattern-width, leader-pattern (dots,space) [Fotis Jannidis]
- fixed: unnecessary dependence on jdk 1.2 features [Christian Geisert]
- fixed: unicode problem in UserMessage [Ross Golder]
- fixed: broken buildFOTree [Marcus Holmberg]
- fixed: problems with borders and padding in tables [Corinna Hischke]
- fixed: XMLRenderer, unbalanced " in the produced output [Dorothea Wiarda]
- fixed: renamed: inline-sequence -> inline, simple-link -> basic-link,
                  white-space-treatment -> white-space-collapse [Fotis Jannidis]
- fixed: images were rendered only half size (Mikko Honkala)
- fixed: pdf file in XalanCommandFile explicitly closed [Dharamveer Salecha]
- fixed: lists containing list do not keep their indentation correctly
         over a page boundary [Dorothea Wiarda]

Done since 0.13 release
- pagination updated to 03/27/2000 XSL WD [Arved Sandstrom]
- added support for fo page-number-citation [Mike Crowe, Jordan Naftolin]
- added support for 06/29/2000 SVG WD + W3C Java DOM bindings [Keiron Liddle]
- added image support using Jimi [Eric Schaeffer]
- added support for external and internal simple-links [Jordan Naftolin]
- added support for the fonts Symbol and ZapfDingbats [Fotis Jannidis]
- added a MessageHandler  [Fotis Jannidis]
- fixed table overflow bug [Jordan Naftolin]
- finally fixed postscript printing of generated PDF [Domagoj Cosic]
- removed XTCommandLine from build.xml
- removed PDFOutputHandler from build.xml
- added XalanCommandLine  [Fotis Jannidis]
- added: fo:instream-foreign-object [Keiron Liddle]
- added: goto button in AWT viewer [Stanislav Gorkhover]
- updated: AWT viewer now works again and supports - with some restrictions - the new SVG support [Stanislav Gorkhover]

Done since 0.12.1 release
- using Ant to build Fop instead of make [Giacomo Pati]
- borders, padding and absolute positioning [Jon Smirl]

0.12.1 release
to make the bug fix on XTCommandLine available to non developers
basic support for padding-{top,left,bottom,right} on blocks.
implemented simple-link (don't think it works, though)
XTCommandLine now works again
background color works on list-block
list-blocks can now be in table-cell

Done for 0.12.0 release:

Make sure Makefiles work
Switch to using Status object as return from layout()
Incorporate Eric Schaeffer's fix to tables in static-content
Incorporate Kelly Campell's fixes to GifJpegImage
Incorporate Eric Schaeffer's background colour implementation
  (actually used different approach with background colour as trait)
onsistent-handling-of-SensitiveParameter Nextcloud server, a safe home for all your data: https://github.com/nextcloud/serverwww-data
aboutsummaryrefslogtreecommitdiffstats
path: root/apps/user_ldap/lib/Group_LDAP.php
blob: c166ad5ebef0230695234cf8554b5aeac435e103 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
<?php
/**
 * @copyright Copyright (c) 2016, ownCloud, Inc.
 *
 * @author Alexander Bergolth <leo@strike.wu.ac.at>
 * @author Alex Weirig <alex.weirig@technolink.lu>
 * @author alexweirig <alex.weirig@technolink.lu>
 * @author Andreas Fischer <bantu@owncloud.com>
 * @author Andreas Pflug <dev@admin4.org>
 * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
 * @author Bart Visscher <bartv@thisnet.nl>
 * @author Christopher Schäpers <kondou@ts.unde.re>
 * @author Christoph Wurst <christoph@winzerhof-wurst.at>
 * @author Frédéric Fortier <frederic.fortier@oronospolytechnique.com>
 * @author Joas Schilling <coding@schilljs.com>
 * @author Lukas Reschke <lukas@statuscode.ch>
 * @author Morris Jobke <hey@morrisjobke.de>
 * @author Nicolas Grekas <nicolas.grekas@gmail.com>
 * @author Robin McCorkell <robin@mccorkell.me.uk>
 * @author Roeland Jago Douma <roeland@famdouma.nl>
 * @author Roland Tapken <roland@bitarbeiter.net>
 * @author Thomas Müller <thomas.mueller@tmit.eu>
 * @author Victor Dubiniuk <dubiniuk@owncloud.com>
 * @author Vincent Petry <pvince81@owncloud.com>
 * @author Vinicius Cubas Brand <vinicius@eita.org.br>
 * @author Xuanwo <xuanwo@yunify.com>
 *
 * @license AGPL-3.0
 *
 * This code is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License, version 3,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License, version 3,
 * along with this program. If not, see <http://www.gnu.org/licenses/>
 *
 */

namespace OCA\User_LDAP;

use OC\Cache\CappedMemoryCache;
use OCP\Group\Backend\IGetDisplayNameBackend;
use OCP\GroupInterface;
use OCP\ILogger;

class Group_LDAP extends BackendUtility implements \OCP\GroupInterface, IGroupLDAP, IGetDisplayNameBackend {
	protected $enabled = false;

	/**
	 * @var string[] $cachedGroupMembers array of users with gid as key
	 */
	protected $cachedGroupMembers;

	/**
	 * @var string[] $cachedGroupsByMember array of groups with uid as key
	 */
	protected $cachedGroupsByMember;

	/**
	 * @var string[] $cachedNestedGroups array of groups with gid (DN) as key
	 */
	protected $cachedNestedGroups;

	/** @var GroupPluginManager */
	protected $groupPluginManager;

	public function __construct(Access $access, GroupPluginManager $groupPluginManager) {
		parent::__construct($access);
		$filter = $this->access->connection->ldapGroupFilter;
		$gassoc = $this->access->connection->ldapGroupMemberAssocAttr;
		if(!empty($filter) && !empty($gassoc)) {
			$this->enabled = true;
		}

		$this->cachedGroupMembers = new CappedMemoryCache();
		$this->cachedGroupsByMember = new CappedMemoryCache();
		$this->cachedNestedGroups = new CappedMemoryCache();
		$this->groupPluginManager = $groupPluginManager;
	}

	/**
	 * is user in group?
	 * @param string $uid uid of the user
	 * @param string $gid gid of the group
	 * @return bool
	 *
	 * Checks whether the user is member of a group or not.
	 */
	public function inGroup($uid, $gid) {
		if(!$this->enabled) {
			return false;
		}
		$cacheKey = 'inGroup'.$uid.':'.$gid;
		$inGroup = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($inGroup)) {
			return (bool)$inGroup;
		}

		$userDN = $this->access->username2dn($uid);

		if(isset($this->cachedGroupMembers[$gid])) {
			$isInGroup = in_array($userDN, $this->cachedGroupMembers[$gid]);
			return $isInGroup;
		}

		$cacheKeyMembers = 'inGroup-members:'.$gid;
		$members = $this->access->connection->getFromCache($cacheKeyMembers);
		if(!is_null($members)) {
			$this->cachedGroupMembers[$gid] = $members;
			$isInGroup = in_array($userDN, $members, true);
			$this->access->connection->writeToCache($cacheKey, $isInGroup);
			return $isInGroup;
		}

		$groupDN = $this->access->groupname2dn($gid);
		// just in case
		if(!$groupDN || !$userDN) {
			$this->access->connection->writeToCache($cacheKey, false);
			return false;
		}

		//check primary group first
		if($gid === $this->getUserPrimaryGroup($userDN)) {
			$this->access->connection->writeToCache($cacheKey, true);
			return true;
		}

		//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
		$members = $this->_groupMembers($groupDN);
		if(!is_array($members) || count($members) === 0) {
			$this->access->connection->writeToCache($cacheKey, false);
			return false;
		}

		//extra work if we don't get back user DNs
		if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
			$dns = [];
			$filterParts = [];
			$bytes = 0;
			foreach($members as $mid) {
				$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
				$filterParts[] = $filter;
				$bytes += strlen($filter);
				if($bytes >= 9000000) {
					// AD has a default input buffer of 10 MB, we do not want
					// to take even the chance to exceed it
					$filter = $this->access->combineFilterWithOr($filterParts);
					$bytes = 0;
					$filterParts = [];
					$users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
					$dns = array_merge($dns, $users);
				}
			}
			if(count($filterParts) > 0) {
				$filter = $this->access->combineFilterWithOr($filterParts);
				$users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
				$dns = array_merge($dns, $users);
			}
			$members = $dns;
		}

		$isInGroup = in_array($userDN, $members);
		$this->access->connection->writeToCache($cacheKey, $isInGroup);
		$this->access->connection->writeToCache($cacheKeyMembers, $members);
		$this->cachedGroupMembers[$gid] = $members;

		return $isInGroup;
	}

	/**
	 * @param string $dnGroup
	 * @return array
	 *
	 * For a group that has user membership defined by an LDAP search url attribute returns the users
	 * that match the search url otherwise returns an empty array.
	 */
	public function getDynamicGroupMembers($dnGroup) {
		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);

		if (empty($dynamicGroupMemberURL)) {
			return [];
		}

		$dynamicMembers = [];
		$memberURLs = $this->access->readAttribute(
			$dnGroup,
			$dynamicGroupMemberURL,
			$this->access->connection->ldapGroupFilter
		);
		if ($memberURLs !== false) {
			// this group has the 'memberURL' attribute so this is a dynamic group
			// example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
			// example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
			$pos = strpos($memberURLs[0], '(');
			if ($pos !== false) {
				$memberUrlFilter = substr($memberURLs[0], $pos);
				$foundMembers = $this->access->searchUsers($memberUrlFilter,'dn');
				$dynamicMembers = [];
				foreach($foundMembers as $value) {
					$dynamicMembers[$value['dn'][0]] = 1;
				}
			} else {
				\OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
					'of group ' . $dnGroup, ILogger::DEBUG);
			}
		}
		return $dynamicMembers;
	}

	/**
	 * @param string $dnGroup
	 * @param array|null &$seen
	 * @return array|mixed|null
	 * @throws \OC\ServerNotAvailableException
	 */
	private function _groupMembers($dnGroup, &$seen = null) {
		if ($seen === null) {
			$seen = [];
		}
		$allMembers = [];
		if (array_key_exists($dnGroup, $seen)) {
			// avoid loops
			return [];
		}
		// used extensively in cron job, caching makes sense for nested groups
		$cacheKey = '_groupMembers'.$dnGroup;
		$groupMembers = $this->access->connection->getFromCache($cacheKey);
		if($groupMembers !== null) {
			return $groupMembers;
		}
		$seen[$dnGroup] = 1;
		$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
		if (is_array($members)) {
			$fetcher = function ($memberDN, &$seen) {
				return $this->_groupMembers($memberDN, $seen);
			};
			$allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members);
		}

		$allMembers += $this->getDynamicGroupMembers($dnGroup);

		$this->access->connection->writeToCache($cacheKey, $allMembers);
		return $allMembers;
	}

	/**
	 * @param string $DN
	 * @param array|null &$seen
	 * @return array
	 * @throws \OC\ServerNotAvailableException
	 */
	private function _getGroupDNsFromMemberOf($DN) {
		$groups = $this->access->readAttribute($DN, 'memberOf');
		if (!is_array($groups)) {
			return [];
		}

		$fetcher = function ($groupDN) {
			if (isset($this->cachedNestedGroups[$groupDN])) {
				$nestedGroups = $this->cachedNestedGroups[$groupDN];
			} else {
				$nestedGroups = $this->access->readAttribute($groupDN, 'memberOf');
				if (!is_array($nestedGroups)) {
					$nestedGroups = [];
				}
				$this->cachedNestedGroups[$groupDN] = $nestedGroups;
			}
			return $nestedGroups;
		};

		$groups = $this->walkNestedGroups($DN, $fetcher, $groups);
		return $this->access->groupsMatchFilter($groups);
	}

	/**
	 * @param string $dn
	 * @param \Closure $fetcher args: string $dn, array $seen, returns: string[] of dns
	 * @param array $list
	 * @return array
	 */
	private function walkNestedGroups(string $dn, \Closure $fetcher, array $list): array {
		$nesting = (int) $this->access->connection->ldapNestedGroups;
		// depending on the input, we either have a list of DNs or a list of LDAP records
		// also, the output expects either DNs or records. Testing the first element should suffice.
		$recordMode = is_array($list) && isset($list[0]) && is_array($list[0]) && isset($list[0]['dn'][0]);

		if ($nesting !== 1) {
			if($recordMode) {
				// the keys are numeric, but should hold the DN
				return array_reduce($list, function ($transformed, $record) use ($dn) {
					if($record['dn'][0] != $dn) {
						$transformed[$record['dn'][0]] = $record;
					}
					return $transformed;
				}, []);
			}
			return $list;
		}

		$seen = [];
		while ($record = array_pop($list)) {
			$recordDN = $recordMode ? $record['dn'][0] : $record;
			if ($recordDN === $dn || array_key_exists($recordDN, $seen)) {
				// Prevent loops
				continue;
			}
			$fetched = $fetcher($record, $seen);
			$list = array_merge($list, $fetched);
			$seen[$recordDN] = $record;
		}

		return $recordMode ? $seen : array_keys($seen);
	}

	/**
	 * translates a gidNumber into an ownCloud internal name
	 * @param string $gid as given by gidNumber on POSIX LDAP
	 * @param string $dn a DN that belongs to the same domain as the group
	 * @return string|bool
	 */
	public function gidNumber2Name($gid, $dn) {
		$cacheKey = 'gidNumberToName' . $gid;
		$groupName = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($groupName) && isset($groupName)) {
			return $groupName;
		}

		//we need to get the DN from LDAP
		$filter = $this->access->combineFilterWithAnd([
			$this->access->connection->ldapGroupFilter,
			'objectClass=posixGroup',
			$this->access->connection->ldapGidNumber . '=' . $gid
		]);
		$result = $this->access->searchGroups($filter, ['dn'], 1);
		if(empty($result)) {
			return false;
		}
		$dn = $result[0]['dn'][0];

		//and now the group name
		//NOTE once we have separate ownCloud group IDs and group names we can
		//directly read the display name attribute instead of the DN
		$name = $this->access->dn2groupname($dn);

		$this->access->connection->writeToCache($cacheKey, $name);

		return $name;
	}

	/**
	 * returns the entry's gidNumber
	 * @param string $dn
	 * @param string $attribute
	 * @return string|bool
	 */
	private function getEntryGidNumber($dn, $attribute) {
		$value = $this->access->readAttribute($dn, $attribute);
		if(is_array($value) && !empty($value)) {
			return $value[0];
		}
		return false;
	}

	/**
	 * returns the group's primary ID
	 * @param string $dn
	 * @return string|bool
	 */
	public function getGroupGidNumber($dn) {
		return $this->getEntryGidNumber($dn, 'gidNumber');
	}

	/**
	 * returns the user's gidNumber
	 * @param string $dn
	 * @return string|bool
	 */
	public function getUserGidNumber($dn) {
		$gidNumber = false;
		if($this->access->connection->hasGidNumber) {
			$gidNumber = $this->getEntryGidNumber($dn, $this->access->connection->ldapGidNumber);
			if($gidNumber === false) {
				$this->access->connection->hasGidNumber = false;
			}
		}
		return $gidNumber;
	}

	/**
	 * returns a filter for a "users has specific gid" search or count operation
	 *
	 * @param string $groupDN
	 * @param string $search
	 * @return string
	 * @throws \Exception
	 */
	private function prepareFilterForUsersHasGidNumber($groupDN, $search = '') {
		$groupID = $this->getGroupGidNumber($groupDN);
		if($groupID === false) {
			throw new \Exception('Not a valid group');
		}

		$filterParts = [];
		$filterParts[] = $this->access->getFilterForUserCount();
		if ($search !== '') {
			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
		}
		$filterParts[] = $this->access->connection->ldapGidNumber .'=' . $groupID;

		return $this->access->combineFilterWithAnd($filterParts);
	}

	/**
	 * returns a list of users that have the given group as gid number
	 *
	 * @param string $groupDN
	 * @param string $search
	 * @param int $limit
	 * @param int $offset
	 * @return string[]
	 */
	public function getUsersInGidNumber($groupDN, $search = '', $limit = -1, $offset = 0) {
		try {
			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
			$users = $this->access->fetchListOfUsers(
				$filter,
				[$this->access->connection->ldapUserDisplayName, 'dn'],
				$limit,
				$offset
			);
			return $this->access->nextcloudUserNames($users);
		} catch (\Exception $e) {
			return [];
		}
	}

	/**
	 * returns the number of users that have the given group as gid number
	 *
	 * @param string $groupDN
	 * @param string $search
	 * @param int $limit
	 * @param int $offset
	 * @return int
	 */
	public function countUsersInGidNumber($groupDN, $search = '', $limit = -1, $offset = 0) {
		try {
			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
			return (int)$users;
		} catch (\Exception $e) {
			return 0;
		}
	}

	/**
	 * gets the gidNumber of a user
	 * @param string $dn
	 * @return string
	 */
	public function getUserGroupByGid($dn) {
		$groupID = $this->getUserGidNumber($dn);
		if($groupID !== false) {
			$groupName = $this->gidNumber2Name($groupID, $dn);
			if($groupName !== false) {
				return $groupName;
			}
		}

		return false;
	}

	/**
	 * translates a primary group ID into an Nextcloud internal name
	 * @param string $gid as given by primaryGroupID on AD
	 * @param string $dn a DN that belongs to the same domain as the group
	 * @return string|bool
	 */
	public function primaryGroupID2Name($gid, $dn) {
		$cacheKey = 'primaryGroupIDtoName';
		$groupNames = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($groupNames) && isset($groupNames[$gid])) {
			return $groupNames[$gid];
		}

		$domainObjectSid = $this->access->getSID($dn);
		if($domainObjectSid === false) {
			return false;
		}

		//we need to get the DN from LDAP
		$filter = $this->access->combineFilterWithAnd([
			$this->access->connection->ldapGroupFilter,
			'objectsid=' . $domainObjectSid . '-' . $gid
		]);
		$result = $this->access->searchGroups($filter, ['dn'], 1);
		if(empty($result)) {
			return false;
		}
		$dn = $result[0]['dn'][0];

		//and now the group name
		//NOTE once we have separate Nextcloud group IDs and group names we can
		//directly read the display name attribute instead of the DN
		$name = $this->access->dn2groupname($dn);

		$this->access->connection->writeToCache($cacheKey, $name);

		return $name;
	}

	/**
	 * returns the entry's primary group ID
	 * @param string $dn
	 * @param string $attribute
	 * @return string|bool
	 */
	private function getEntryGroupID($dn, $attribute) {
		$value = $this->access->readAttribute($dn, $attribute);
		if(is_array($value) && !empty($value)) {
			return $value[0];
		}
		return false;
	}

	/**
	 * returns the group's primary ID
	 * @param string $dn
	 * @return string|bool
	 */
	public function getGroupPrimaryGroupID($dn) {
		return $this->getEntryGroupID($dn, 'primaryGroupToken');
	}

	/**
	 * returns the user's primary group ID
	 * @param string $dn
	 * @return string|bool
	 */
	public function getUserPrimaryGroupIDs($dn) {
		$primaryGroupID = false;
		if($this->access->connection->hasPrimaryGroups) {
			$primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
			if($primaryGroupID === false) {
				$this->access->connection->hasPrimaryGroups = false;
			}
		}
		return $primaryGroupID;
	}

	/**
	 * returns a filter for a "users in primary group" search or count operation
	 *
	 * @param string $groupDN
	 * @param string $search
	 * @return string
	 * @throws \Exception
	 */
	private function prepareFilterForUsersInPrimaryGroup($groupDN, $search = '') {
		$groupID = $this->getGroupPrimaryGroupID($groupDN);
		if($groupID === false) {
			throw new \Exception('Not a valid group');
		}

		$filterParts = [];
		$filterParts[] = $this->access->getFilterForUserCount();
		if ($search !== '') {
			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
		}
		$filterParts[] = 'primaryGroupID=' . $groupID;

		return $this->access->combineFilterWithAnd($filterParts);
	}

	/**
	 * returns a list of users that have the given group as primary group
	 *
	 * @param string $groupDN
	 * @param string $search
	 * @param int $limit
	 * @param int $offset
	 * @return string[]
	 */
	public function getUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
		try {
			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
			$users = $this->access->fetchListOfUsers(
				$filter,
				[$this->access->connection->ldapUserDisplayName, 'dn'],
				$limit,
				$offset
			);
			return $this->access->nextcloudUserNames($users);
		} catch (\Exception $e) {
			return [];
		}
	}

	/**
	 * returns the number of users that have the given group as primary group
	 *
	 * @param string $groupDN
	 * @param string $search
	 * @param int $limit
	 * @param int $offset
	 * @return int
	 */
	public function countUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
		try {
			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
			return (int)$users;
		} catch (\Exception $e) {
			return 0;
		}
	}

	/**
	 * gets the primary group of a user
	 * @param string $dn
	 * @return string
	 */
	public function getUserPrimaryGroup($dn) {
		$groupID = $this->getUserPrimaryGroupIDs($dn);
		if($groupID !== false) {
			$groupName = $this->primaryGroupID2Name($groupID, $dn);
			if($groupName !== false) {
				return $groupName;
			}
		}

		return false;
	}

	/**
	 * Get all groups a user belongs to
	 * @param string $uid Name of the user
	 * @return array with group names
	 *
	 * This function fetches all groups a user belongs to. It does not check
	 * if the user exists at all.
	 *
	 * This function includes groups based on dynamic group membership.
	 */
	public function getUserGroups($uid) {
		if(!$this->enabled) {
			return [];
		}
		$cacheKey = 'getUserGroups'.$uid;
		$userGroups = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($userGroups)) {
			return $userGroups;
		}
		$userDN = $this->access->username2dn($uid);
		if(!$userDN) {
			$this->access->connection->writeToCache($cacheKey, []);
			return [];
		}

		$groups = [];
		$primaryGroup = $this->getUserPrimaryGroup($userDN);
		$gidGroupName = $this->getUserGroupByGid($userDN);

		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);

		if (!empty($dynamicGroupMemberURL)) {
			// look through dynamic groups to add them to the result array if needed
			$groupsToMatch = $this->access->fetchListOfGroups(
				$this->access->connection->ldapGroupFilter,['dn',$dynamicGroupMemberURL]);
			foreach($groupsToMatch as $dynamicGroup) {
				if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
					continue;
				}
				$pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
				if ($pos !== false) {
					$memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0],$pos);
					// apply filter via ldap search to see if this user is in this
					// dynamic group
					$userMatch = $this->access->readAttribute(
						$userDN,
						$this->access->connection->ldapUserDisplayName,
						$memberUrlFilter
					);
					if ($userMatch !== false) {
						// match found so this user is in this group
						$groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
						if(is_string($groupName)) {
							// be sure to never return false if the dn could not be
							// resolved to a name, for whatever reason.
							$groups[] = $groupName;
						}
					}
				} else {
					\OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
						'of group ' . print_r($dynamicGroup, true), ILogger::DEBUG);
				}
			}
		}

		// if possible, read out membership via memberOf. It's far faster than
		// performing a search, which still is a fallback later.
		// memberof doesn't support memberuid, so skip it here.
		if((int)$this->access->connection->hasMemberOfFilterSupport === 1
			&& (int)$this->access->connection->useMemberOfToDetectMembership === 1
			&& strtolower($this->access->connection->ldapGroupMemberAssocAttr) !== 'memberuid'
			) {
			$groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
			if (is_array($groupDNs)) {
				foreach ($groupDNs as $dn) {
					$groupName = $this->access->dn2groupname($dn);
					if(is_string($groupName)) {
						// be sure to never return false if the dn could not be
						// resolved to a name, for whatever reason.
						$groups[] = $groupName;
					}
				}
			}

			if($primaryGroup !== false) {
				$groups[] = $primaryGroup;
			}
			if($gidGroupName !== false) {
				$groups[] = $gidGroupName;
			}
			$this->access->connection->writeToCache($cacheKey, $groups);
			return $groups;
		}

		//uniqueMember takes DN, memberuid the uid, so we need to distinguish
		if((strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'uniquemember')
			|| (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'member')
		) {
			$uid = $userDN;
		} else if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
			$result = $this->access->readAttribute($userDN, 'uid');
			if ($result === false) {
				\OCP\Util::writeLog('user_ldap', 'No uid attribute found for DN ' . $userDN . ' on '.
					$this->access->connection->ldapHost, ILogger::DEBUG);
				$uid = false;
			} else {
				$uid = $result[0];
			}
		} else {
			// just in case
			$uid = $userDN;
		}

		if($uid !== false) {
			if (isset($this->cachedGroupsByMember[$uid])) {
				$groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
			} else {
				$groupsByMember = array_values($this->getGroupsByMember($uid));
				$groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
				$this->cachedGroupsByMember[$uid] = $groupsByMember;
				$groups = array_merge($groups, $groupsByMember);
			}
		}

		if($primaryGroup !== false) {
			$groups[] = $primaryGroup;
		}
		if($gidGroupName !== false) {
			$groups[] = $gidGroupName;
		}

		$groups = array_unique($groups, SORT_LOCALE_STRING);
		$this->access->connection->writeToCache($cacheKey, $groups);

		return $groups;
	}

	/**
	 * @param string $dn
	 * @param array|null &$seen
	 * @return array
	 */
	private function getGroupsByMember($dn, &$seen = null) {
		if ($seen === null) {
			$seen = [];
		}
		if (array_key_exists($dn, $seen)) {
			// avoid loops
			return [];
		}
		$allGroups = [];
		$seen[$dn] = true;
		$filter = $this->access->connection->ldapGroupMemberAssocAttr.'='.$dn;
		$groups = $this->access->fetchListOfGroups($filter,
			[$this->access->connection->ldapGroupDisplayName, 'dn']);
		if (is_array($groups)) {
			$fetcher = function ($dn, &$seen) {
				if(is_array($dn) && isset($dn['dn'][0])) {
					$dn = $dn['dn'][0];
				}
				return $this->getGroupsByMember($dn, $seen);
			};
			$allGroups = $this->walkNestedGroups($dn, $fetcher, $groups);
		}
		$visibleGroups = $this->access->groupsMatchFilter(array_keys($allGroups));
		return array_intersect_key($allGroups, array_flip($visibleGroups));
	}

	/**
	 * get a list of all users in a group
	 *
	 * @param string $gid
	 * @param string $search
	 * @param int $limit
	 * @param int $offset
	 * @return array with user ids
	 * @throws \Exception
	 */
	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
		if(!$this->enabled) {
			return [];
		}
		if(!$this->groupExists($gid)) {
			return [];
		}
		$search = $this->access->escapeFilterPart($search, true);
		$cacheKey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
		// check for cache of the exact query
		$groupUsers = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($groupUsers)) {
			return $groupUsers;
		}

		// check for cache of the query without limit and offset
		$groupUsers = $this->access->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
		if(!is_null($groupUsers)) {
			$groupUsers = array_slice($groupUsers, $offset, $limit);
			$this->access->connection->writeToCache($cacheKey, $groupUsers);
			return $groupUsers;
		}

		if($limit === -1) {
			$limit = null;
		}
		$groupDN = $this->access->groupname2dn($gid);
		if(!$groupDN) {
			// group couldn't be found, return empty resultset
			$this->access->connection->writeToCache($cacheKey, []);
			return [];
		}

		$primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
		$posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
		$members = $this->_groupMembers($groupDN);
		if(!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
			//in case users could not be retrieved, return empty result set
			$this->access->connection->writeToCache($cacheKey, []);
			return [];
		}

		$groupUsers = [];
		$isMemberUid = (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid');
		$attrs = $this->access->userManager->getAttributes(true);
		foreach($members as $member) {
			if($isMemberUid) {
				//we got uids, need to get their DNs to 'translate' them to user names
				$filter = $this->access->combineFilterWithAnd([
					str_replace('%uid', trim($member), $this->access->connection->ldapLoginFilter),
					$this->access->combineFilterWithAnd([
						$this->access->getFilterPartForUserSearch($search),
						$this->access->connection->ldapUserFilter
					])
				]);
				$ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
				if(count($ldap_users) < 1) {
					continue;
				}
				$groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
			} else {
				//we got DNs, check if we need to filter by search or we can give back all of them
				$uid = $this->access->dn2username($member);
				if(!$uid) {
					continue;
				}

				$cacheKey = 'userExistsOnLDAP' . $uid;
				$userExists = $this->access->connection->getFromCache($cacheKey);
				if($userExists === false) {
					continue;
				}
				if($userExists === null || $search !== '') {
					if (!$this->access->readAttribute($member,
						$this->access->connection->ldapUserDisplayName,
						$this->access->combineFilterWithAnd([
							$this->access->getFilterPartForUserSearch($search),
							$this->access->connection->ldapUserFilter
						])))
					{
						if($search === '') {
							$this->access->connection->writeToCache($cacheKey, false);
						}
						continue;
					}
					$this->access->connection->writeToCache($cacheKey, true);
				}
				$groupUsers[] = $uid;
			}
		}

		$groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
		natsort($groupUsers);
		$this->access->connection->writeToCache('usersInGroup-'.$gid.'-'.$search, $groupUsers);
		$groupUsers = array_slice($groupUsers, $offset, $limit);

		$this->access->connection->writeToCache($cacheKey, $groupUsers);

		return $groupUsers;
	}

	/**
	 * returns the number of users in a group, who match the search term
	 * @param string $gid the internal group name
	 * @param string $search optional, a search string
	 * @return int|bool
	 */
	public function countUsersInGroup($gid, $search = '') {
		if ($this->groupPluginManager->implementsActions(GroupInterface::COUNT_USERS)) {
			return $this->groupPluginManager->countUsersInGroup($gid, $search);
		}

		$cacheKey = 'countUsersInGroup-'.$gid.'-'.$search;
		if(!$this->enabled || !$this->groupExists($gid)) {
			return false;
		}
		$groupUsers = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($groupUsers)) {
			return $groupUsers;
		}

		$groupDN = $this->access->groupname2dn($gid);
		if(!$groupDN) {
			// group couldn't be found, return empty result set
			$this->access->connection->writeToCache($cacheKey, false);
			return false;
		}

		$members = $this->_groupMembers($groupDN);
		$primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
		if(!$members && $primaryUserCount === 0) {
			//in case users could not be retrieved, return empty result set
			$this->access->connection->writeToCache($cacheKey, false);
			return false;
		}

		if ($search === '') {
			$groupUsers = count($members) + $primaryUserCount;
			$this->access->connection->writeToCache($cacheKey, $groupUsers);
			return $groupUsers;
		}
		$search = $this->access->escapeFilterPart($search, true);
		$isMemberUid =
			(strtolower($this->access->connection->ldapGroupMemberAssocAttr)
			=== 'memberuid');

		//we need to apply the search filter
		//alternatives that need to be checked:
		//a) get all users by search filter and array_intersect them
		//b) a, but only when less than 1k 10k ?k users like it is
		//c) put all DNs|uids in a LDAP filter, combine with the search string
		//   and let it count.
		//For now this is not important, because the only use of this method
		//does not supply a search string
		$groupUsers = [];
		foreach($members as $member) {
			if($isMemberUid) {
				//we got uids, need to get their DNs to 'translate' them to user names
				$filter = $this->access->combineFilterWithAnd([
					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
					$this->access->getFilterPartForUserSearch($search)
				]);
				$ldap_users = $this->access->fetchListOfUsers($filter, 'dn', 1);
				if(count($ldap_users) < 1) {
					continue;
				}
				$groupUsers[] = $this->access->dn2username($ldap_users[0]);
			} else {
				//we need to apply the search filter now
				if(!$this->access->readAttribute($member,
					$this->access->connection->ldapUserDisplayName,
					$this->access->getFilterPartForUserSearch($search))) {
					continue;
				}
				// dn2username will also check if the users belong to the allowed base
				if($ocname = $this->access->dn2username($member)) {
					$groupUsers[] = $ocname;
				}
			}
		}

		//and get users that have the group as primary
		$primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);

		return count($groupUsers) + $primaryUsers;
	}

	/**
	 * get a list of all groups
	 *
	 * @param string $search
	 * @param $limit
	 * @param int $offset
	 * @return array with group names
	 *
	 * Returns a list with all groups (used by getGroups)
	 */
	protected function getGroupsChunk($search = '', $limit = -1, $offset = 0) {
		if(!$this->enabled) {
			return [];
		}
		$cacheKey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;

		//Check cache before driving unnecessary searches
		\OCP\Util::writeLog('user_ldap', 'getGroups '.$cacheKey, ILogger::DEBUG);
		$ldap_groups = $this->access->connection->getFromCache($cacheKey);
		if(!is_null($ldap_groups)) {
			return $ldap_groups;
		}

		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
		// error. With a limit of 0, we get 0 results. So we pass null.
		if($limit <= 0) {
			$limit = null;
		}
		$filter = $this->access->combineFilterWithAnd([
			$this->access->connection->ldapGroupFilter,
			$this->access->getFilterPartForGroupSearch($search)
		]);
		\OCP\Util::writeLog('user_ldap', 'getGroups Filter '.$filter, ILogger::DEBUG);
		$ldap_groups = $this->access->fetchListOfGroups($filter,
				[$this->access->connection->ldapGroupDisplayName, 'dn'],
				$limit,
				$offset);
		$ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);

		$this->access->connection->writeToCache($cacheKey, $ldap_groups);
		return $ldap_groups;
	}

	/**
	 * get a list of all groups using a paged search
	 *
	 * @param string $search
	 * @param int $limit
	 * @param int $offset
	 * @return array with group names
	 *
	 * Returns a list with all groups
	 * Uses a paged search if available to override a
	 * server side search limit.
	 * (active directory has a limit of 1000 by default)
	 */
	public function getGroups($search = '', $limit = -1, $offset = 0) {
		if(!$this->enabled) {
			return [];
		}
		$search = $this->access->escapeFilterPart($search, true);
		$pagingSize = (int)$this->access->connection->ldapPagingSize;
		if ($pagingSize <= 0) {
			return $this->getGroupsChunk($search, $limit, $offset);
		}
		$maxGroups = 100000; // limit max results (just for safety reasons)
		if ($limit > -1) {
		   $overallLimit = min($limit + $offset, $maxGroups);
		} else {
		   $overallLimit = $maxGroups;
		}
		$chunkOffset = $offset;
		$allGroups = [];
		while ($chunkOffset < $overallLimit) {
			$chunkLimit = min($pagingSize, $overallLimit - $chunkOffset);
			$ldapGroups = $this->getGroupsChunk($search, $chunkLimit, $chunkOffset);
			$nread = count($ldapGroups);
			\OCP\Util::writeLog('user_ldap', 'getGroups('.$search.'): read '.$nread.' at offset '.$chunkOffset.' (limit: '.$chunkLimit.')', ILogger::DEBUG);
			if ($nread) {
				$allGroups = array_merge($allGroups, $ldapGroups);
				$chunkOffset += $nread;
			}
			if ($nread < $chunkLimit) {
				break;
			}
		}
		return $allGroups;
	}

	/**
	 * @param string $group
	 * @return bool
	 */
	public function groupMatchesFilter($group) {
		return (strripos($group, $this->groupSearch) !== false);
	}

	/**
	 * check if a group exists
	 * @param string $gid
	 * @return bool
	 */
	public function groupExists($gid) {
		$groupExists = $this->access->connection->getFromCache('groupExists'.$gid);
		if(!is_null($groupExists)) {
			return (bool)$groupExists;
		}

		//getting dn, if false the group does not exist. If dn, it may be mapped
		//only, requires more checking.
		$dn = $this->access->groupname2dn($gid);
		if(!$dn) {
			$this->access->connection->writeToCache('groupExists'.$gid, false);
			return false;
		}

		//if group really still exists, we will be able to read its objectclass
		if(!is_array($this->access->readAttribute($dn, ''))) {
			$this->access->connection->writeToCache('groupExists'.$gid, false);
			return false;
		}

		$this->access->connection->writeToCache('groupExists'.$gid, true);
		return true;
	}

	/**
	 * Check if backend implements actions
	 * @param int $actions bitwise-or'ed actions
	 * @return boolean
	 *
	 * Returns the supported actions as int to be
	 * compared with GroupInterface::CREATE_GROUP etc.
	 */
	public function implementsActions($actions) {
		return (bool)((GroupInterface::COUNT_USERS |
				$this->groupPluginManager->getImplementedActions()) & $actions);
	}

	/**
	 * Return access for LDAP interaction.
	 * @return Access instance of Access for LDAP interaction
	 */
	public function getLDAPAccess($gid) {
		return $this->access;
	}

	/**
	 * create a group
	 * @param string $gid
	 * @return bool
	 * @throws \Exception
	 */
	public function createGroup($gid) {
		if ($this->groupPluginManager->implementsActions(GroupInterface::CREATE_GROUP)) {
			if ($dn = $this->groupPluginManager->createGroup($gid)) {
				//updates group mapping
				$uuid = $this->access->getUUID($dn, false);
				if(is_string($uuid)) {
					$this->access->mapAndAnnounceIfApplicable(
						$this->access->getGroupMapper(),
						$dn,
						$gid,
						$uuid,
						false
					);
					$this->access->cacheGroupExists($gid);
				}
			}
			return $dn != null;
		}
		throw new \Exception('Could not create group in LDAP backend.');
	}

	/**
	 * delete a group
	 * @param string $gid gid of the group to delete
	 * @return bool
	 * @throws \Exception
	 */
	public function deleteGroup($gid) {
		if ($this->groupPluginManager->implementsActions(GroupInterface::DELETE_GROUP)) {
			if ($ret = $this->groupPluginManager->deleteGroup($gid)) {
				#delete group in nextcloud internal db
				$this->access->getGroupMapper()->unmap($gid);
				$this->access->connection->writeToCache("groupExists".$gid, false);
			}
			return $ret;
		}
		throw new \Exception('Could not delete group in LDAP backend.');
	}

	/**
	 * Add a user to a group
	 * @param string $uid Name of the user to add to group
	 * @param string $gid Name of the group in which add the user
	 * @return bool
	 * @throws \Exception
	 */
	public function addToGroup($uid, $gid) {
		if ($this->groupPluginManager->implementsActions(GroupInterface::ADD_TO_GROUP)) {
			if ($ret = $this->groupPluginManager->addToGroup($uid, $gid)) {
				$this->access->connection->clearCache();
				unset($this->cachedGroupMembers[$gid]);
			}
			return $ret;
		}
		throw new \Exception('Could not add user to group in LDAP backend.');
	}

	/**
	 * Removes a user from a group
	 * @param string $uid Name of the user to remove from group
	 * @param string $gid Name of the group from which remove the user
	 * @return bool
	 * @throws \Exception
	 */
	public function removeFromGroup($uid, $gid) {
		if ($this->groupPluginManager->implementsActions(GroupInterface::REMOVE_FROM_GROUP)) {
			if ($ret = $this->groupPluginManager->removeFromGroup($uid, $gid)) {
				$this->access->connection->clearCache();
				unset($this->cachedGroupMembers[$gid]);
			}
			return $ret;
		}
		throw new \Exception('Could not remove user from group in LDAP backend.');
	}

	/**
	 * Gets group details
	 * @param string $gid Name of the group
	 * @return array | false
	 * @throws \Exception
	 */
	public function getGroupDetails($gid) {
		if ($this->groupPluginManager->implementsActions(GroupInterface::GROUP_DETAILS)) {
			return $this->groupPluginManager->getGroupDetails($gid);
		}
		throw new \Exception('Could not get group details in LDAP backend.');
	}

	/**
	 * Return LDAP connection resource from a cloned connection.
	 * The cloned connection needs to be closed manually.
	 * of the current access.
	 * @param string $gid
	 * @return resource of the LDAP connection
	 */
	public function getNewLDAPConnection($gid) {
		$connection = clone $this->access->getConnection();
		return $connection->getConnectionResource();
	}

	/**
	 * @throws \OC\ServerNotAvailableException
	 */
	public function getDisplayName(string $gid): string {
		if ($this->groupPluginManager instanceof IGetDisplayNameBackend) {
			return $this->groupPluginManager->getDisplayName($gid);
		}

		$cacheKey = 'group_getDisplayName' . $gid;
		if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
			return $displayName;
		}

		$displayName = $this->access->readAttribute(
			$this->access->groupname2dn($gid),
			$this->access->connection->ldapGroupDisplayName);

		if ($displayName && (count($displayName) > 0)) {
			$displayName = $displayName[0];
			$this->access->connection->writeToCache($cacheKey, $displayName);
			return $displayName;
		}

		return '';
	}
}