path . 'register.php') {
bb_die(__('Registration is disabled for this forum, please login using your LDAP username and password.'));
}
}
function ldap_disable_ldap_password_recovery() {
global $LDAP_enabled, $bb;
if ($LDAP_enabled && $_SERVER['PHP_SELF'] == $bb->path . 'bb-reset-password.php') {
$user_login = user_sanitize($_POST['user_login']);
if (!empty($user_login)) {
$user = bb_get_user_by_name($user_login);
if (substr($user->user_pass, 0, 5) == '^LDAP') {
bb_die(__('Password recovery is not possible for this account because it uses an LDAP username and password to login. To change your LDAP password, please contact your system administrator.'));
}
}
}
}
function ldap_disable_password_editing() {
global $LDAP_enabled, $bb, $bb_current_user;
if ($LDAP_enabled && (($_SERVER['PHP_SELF'] == $bb->path . 'profile.php' && $_GET['tab'] == 'edit') || $_SERVER['PHP_SELF'] == $bb->path . 'profile-edit.php')) {
add_filter( 'bb_user_has_cap' , 'ldap_remove_password_capability' , 10, 2);
}
}
function ldap_remove_password_capability($allcaps, $caps) {
global $user;
if ($caps[0] == 'change_password' && substr($user->user_pass, 0, 5) == '^LDAP') {
unset($allcaps['change_password']);
}
return $allcaps;
}
function bb_check_login($user, $pass, $already_md5 = false) {
global $bbdb;
$user = user_sanitize( $user );
if ( !$already_md5 ) {
$user_exists = bb_user_exists( $user );
if ( !$user_exists ) {
// Check using LDAP
if ( !bb_get_option('LDAP_disable_automatic_registration') && $mail = ldap_connect_user( $user, $pass, true ) ) {
// Create the new user in the local database
if ( $user_id = ldap_new_user( $user, $pass, $mail ) ) {
return $bbdb->get_row("SELECT * FROM $bbdb->users WHERE `ID` = $user_id");
} else {
bb_die(__('Failed to add new LDAP user to local database.'));
}
} else {
return FALSE;
}
} else {
if ( substr($user_exists->user_pass, 0, 5) == '^LDAP' ) {
if ( ldap_connect_user( $user, $pass ) ) {
// Update their MD5 hash in case their password has changed
$bbdb->query("UPDATE $bbdb->users SET user_pass = '^LDAP-" . md5($pass) . "' WHERE user_login = '$user'");
// Get their record from the local database
return $bbdb->get_row("SELECT * FROM $bbdb->users WHERE user_login = '$user' AND SUBSTRING(SUBSTRING_INDEX( user_pass, '---', 1 ), 1, 5) = '^LDAP'");
} else {
return FALSE;
}
} else {
$pass = user_sanitize( md5( $pass ) );
return $bbdb->get_row("SELECT * FROM $bbdb->users WHERE user_login = '$user' AND SUBSTRING_INDEX( user_pass, '---', 1 ) = '$pass'");
}
}
} else {
return $bbdb->get_row("SELECT * FROM $bbdb->users WHERE user_login = '$user' AND MD5( user_pass ) = '$pass'");
}
}
function ldap_connect_user($user, $pass, $register = false) {
$host = bb_get_option('LDAP_host');
$port = bb_get_option('LDAP_port');
$tls = bb_get_option('LDAP_tls');
$domain = bb_get_option('LDAP_domain');
$options = bb_get_option('LDAP_options');
if ($port) {
$connection = ldap_connect($host, $port);
} else {
$connection = ldap_connect($host);
}
if ($options) {
$options = explode('|', $options);
foreach ($options as $option) {
$optionParts = explode(':', $option);
ldap_set_option($connection, $optionParts[0], $optionParts[1]);
}
}
if ($tls) {
// TLS requires ldap protocol version 3
ldap_set_option($connection, LDAP_OPT_PROTOCOL_VERSION, 3);
$tlsStart = ldap_start_tls($connection);
} else {
$tlsStart = TRUE;
}
if ($connection && $tlsStart) {
$uid = 'uid=' . stripslashes(addslashes($user));
$bindString = $uid . ',' . $domain;
$result = ldap_bind($connection, $bindString, stripslashes(addslashes($pass)));
if ($result) {
$mail = true;
if ($register && bb_get_option('LDAP_enable_email_retrieval')) {
if ($search = ldap_search($connection, $domain, '(' . $uid . ')', array('mail'))) {
if ($entry = ldap_first_entry($connection, $search)) {
$attributes = ldap_get_attributes($connection, $entry);
$mail = $attributes['mail'][0];
}
}
}
ldap_unbind($result);
ldap_close($connection);
return $mail;
} else {
ldap_close($connection);
return FALSE;
}
} else {
bb_die(__('Could not connect to LDAP authentication service.'));
}
}
function ldap_new_user( $user_login, $user_pass, $user_email ) {
global $bbdb, $bb_table_prefix;
$now = bb_current_time('mysql');
$password = '^LDAP-' . md5($user_pass);
if ($user_email !== true) {
$email = $user_email;
}
$bbdb->query("INSERT INTO $bbdb->users (user_login, user_pass, user_email, user_registered) VALUES ('$user_login', '$password', '$email', '$now')");
$user_id = $bbdb->insert_id;
bb_update_usermeta( $user_id, $bb_table_prefix . 'capabilities', array('member' => true) );
do_action('ldap_new_user', $user_id);
return $user_id;
}
}
?>