adding two configuration options

[squirrelmail.git] / functions / abook_ldap_server.php

diff --git a/functions/abook_ldap_server.php b/functions/abook_ldap_server.php
index c8848bc13a563c0fd6bb55f71dd52e9b41aa6a92..cfb36000e820916309927db1003643bbb681a0da 100644 (file)
--- a/functions/abook_ldap_server.php
+++ b/functions/abook_ldap_server.php
@@ -2,7 +2,7 @@
 /**
  * abook_ldap_server.php
  *
- * Copyright (c) 1999-2004 The SquirrelMail Project Team
+ * Copyright (c) 1999-2005 The SquirrelMail Project Team
  * Licensed under the GNU GPL. For full terms see the file COPYING.
  *
  * Address book backend for LDAP server
@@ -161,7 +161,7 @@ class abook_ldap_server extends addressbook_backend {
 
         $this->linkid = @ldap_connect($this->server, $this->port);
         if(!$this->linkid) {
-            if(function_exists('ldap_error')) {
+            if(function_exists('ldap_error') && is_object($this->linkid)) {
                 return $this->set_error(ldap_error($this->linkid));
             } else {
                 return $this->set_error('ldap_connect failed');
@@ -218,7 +218,7 @@ class abook_ldap_server extends addressbook_backend {
     /**
      * Decode from charset used by this LDAP server to charset used by translation
      *
-     * Uses squirrelmail charset_decode functions
+     * Uses SquirrelMail charset_decode functions
      * @param string string that has to be decoded
      * @return string decoded string
      */
@@ -231,6 +231,23 @@ class abook_ldap_server extends addressbook_backend {
         }
     }
 
+    /**
+     * Sanitizes ldap search strings.
+     * See rfc2254
+     * @link http://www.faqs.org/rfcs/rfc2254.html
+     * @since 1.5.1
+     * @param string $string
+     * @return string sanitized string
+     */
+    function ldapspecialchars($string) {
+        $sanitized=array('\\' => '\5c',
+                         '*' => '\2a',
+                         '(' => '\28',
+                         ')' => '\29',
+                         "\x00" => '\00');
+
+        return str_replace(array_keys($sanitized),array_values($sanitized),$string);
+    }
 
     /* ========================== Public ======================== */
 
@@ -240,14 +257,18 @@ class abook_ldap_server extends addressbook_backend {
      * @return array search results
      */
     function search($expr) {
-
         /* To be replaced by advanded search expression parsing */
         if(is_array($expr)) return false;
 
         /* Encode the expression */
         $expr = $this->charset_encode($expr);
-        if(strstr($expr, '*') === false) {
-            $expr = "*$expr*";
+
+        /*
+         * allow use of one asterisk in search. 
+         * Don't allow any ldap special chars if search is different
+         */
+        if($expr!='*') {
+            $expr = '*' . $this->ldapspecialchars($expr) . '*';
         }
         $expression = "cn=$expr";