make sure we've ran our own random seeder before using mt_rand
[squirrelmail.git] / plugins / change_password / backend / ldap.php
CommitLineData
02c81de4 1<?php
4b4abf93 2
02c81de4 3/**
d04cab42 4 * Change password LDAP backend
02c81de4 5 *
4b5049de 6 * @copyright &copy; 2005-2007 The SquirrelMail Project Team
4b4abf93 7 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
02c81de4 8 * @version $Id$
9 * @package plugins
10 * @subpackage change_password
11 */
12
444db9b3 13/**
202bcbcc 14 * do not allow to call this file directly
444db9b3 15 */
f627180c 16if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE__) {
202bcbcc 17 header("Location: ../../../src/login.php");
18 die();
19}
444db9b3 20
21/** load required functions */
22
444db9b3 23/** sqimap_get_user_server() function */
faf98003 24include_once(SM_PATH . 'functions/imap_general.php');
444db9b3 25
26/** get imap server and username globals */
27global $imapServerAddress, $username;
f6d11dea 28
02c81de4 29/** Default plugin configuration.*/
30/**
d04cab42 31 * Address of LDAP server.
32 * You can use any URL format that is supported by your LDAP extension.
02c81de4 33 * Examples:
34 * <ul>
35 * <li>'ldap.example.com' - connect to server on ldap.example.com address
d04cab42 36 * <li>'ldaps://ldap.example.com' - connect to server on ldap.example.com address
37 * and use SSL encrypted connection to default LDAPs port.
02c81de4 38 * </ul>
39 * defaults to imap server address.
40 * @link http://www.php.net/ldap-connect
41 * @global string $cpw_ldap_server
42 */
43global $cpw_ldap_server;
f6d11dea 44$cpw_ldap_server=$imapServerAddress;
02c81de4 45
46/**
d04cab42 47 * Port of LDAP server.
48 * Used only when $cpw_ldap_server specifies IP address or DNS name.
02c81de4 49 * @global integer $cpw_ldap_port
50 */
51global $cpw_ldap_port;
52$cpw_ldap_port=389;
53
54/**
d04cab42 55 * LDAP basedn that is used for binding to LDAP server.
02c81de4 56 * this option must be set to correct value.
5de3158e 57 * @global string $cpw_ldap_basedn;
02c81de4 58 */
59global $cpw_ldap_basedn;
60$cpw_ldap_basedn='';
61
62/**
63 * LDAP connection options
64 * @link http://www.php.net/ldap-set-option
65 * @global array $cpw_ldap_connect_opts
66 */
67global $cpw_ldap_connect_opts;
68$cpw_ldap_connect_opts=array();
69
70/**
d04cab42 71 * Controls use of starttls on LDAP connection.
72 * Requires PHP 4.2+, PHP LDAP extension with SSL support and
02c81de4 73 * PROTOCOL_VERSION => 3 setting in $cpw_ldap_connect_opts
74 * @global boolean $cpw_ldap_use_tls
75 */
76global $cpw_ldap_use_tls;
77$cpw_ldap_use_tls=false;
78
79/**
d04cab42 80 * BindDN that should be able to search LDAP directory and find DN used by user.
81 * Uses anonymous bind if set to empty string. You should not use DN with write
82 * access to LDAP directory here. Write access is not required.
02c81de4 83 * @global string $cpw_ldap_binddn
84 */
85global $cpw_ldap_binddn;
86$cpw_ldap_binddn='';
87
88/**
89 * password used for $cpw_ldap_binddn
d04cab42 90 * @global string $cpw_ldap_bindpw
02c81de4 91 */
92global $cpw_ldap_bindpw;
93$cpw_ldap_bindpw='';
94
95/**
96 * BindDN that should be able to change password.
444db9b3 97 * WARNING: sometimes user has enough privileges to change own password.
d04cab42 98 * If you leave default value, plugin will try to connect with DN that
02c81de4 99 * is detected in $cpw_ldap_username_attr=$username search and current
100 * user password will be used for authentication.
101 * @global string $cpw_ldap_admindn
102 */
103global $cpw_ldap_admindn;
104$cpw_ldap_admindn='';
105
106/**
107 * password used for $cpw_ldap_admindn
d04cab42 108 * @global string $cpw_ldap_adminpw
02c81de4 109 */
110global $cpw_ldap_adminpw;
111$cpw_ldap_adminpw='';
112
113/**
d04cab42 114 * LDAP attribute that stores username.
02c81de4 115 * username entry should be unique for $cpw_ldap_basedn
116 * @global string $cpw_ldap_userid_attr
117 */
118global $cpw_ldap_userid_attr;
119$cpw_ldap_userid_attr='uid';
120
121/**
122 * crypto that is used to encode new password
123 * If set to empty string, system tries to keep same encoding/hashing algorithm
124 * @global string $cpw_ldap_default_crypto
125 */
126global $cpw_ldap_default_crypto;
127$cpw_ldap_default_crypto='';
128
129/** end of default config */
130
131/** configuration overrides from config file */
132if (isset($cpw_ldap['server'])) $cpw_ldap_server=$cpw_ldap['server'];
133if (isset($cpw_ldap['port'])) $cpw_ldap_port=$cpw_ldap['port'];
134if (isset($cpw_ldap['basedn'])) $cpw_ldap_basedn=$cpw_ldap['basedn'];
135if (isset($cpw_ldap['connect_opts'])) $cpw_ldap_connect_opts=$cpw_ldap['connect_opts'];
136if (isset($cpw_ldap['use_tls'])) $cpw_ldap_use_tls=$cpw_ldap['use_tls'];
137if (isset($cpw_ldap['binddn'])) $cpw_ldap_binddn=$cpw_ldap['binddn'];
138if (isset($cpw_ldap['bindpw'])) $cpw_ldap_bindpw=$cpw_ldap['bindpw'];
139if (isset($cpw_ldap['admindn'])) $cpw_ldap_admindn=$cpw_ldap['admindn'];
140if (isset($cpw_ldap['adminpw'])) $cpw_ldap_adminpw=$cpw_ldap['adminpw'];
141if (isset($cpw_ldap['userid_attr'])) $cpw_ldap_userid_attr=$cpw_ldap['userid_attr'];
142if (isset($cpw_ldap['default_crypto'])) $cpw_ldap_default_crypto=$cpw_ldap['default_crypto'];
143
444db9b3 144/** make sure that setting does not contain mapping */
145$cpw_ldap_server=sqimap_get_user_server($cpw_ldap_server,$username);
146
02c81de4 147/**
148 * Adding plugin hooks
149 */
150global $squirrelmail_plugin_hooks;
151$squirrelmail_plugin_hooks['change_password_dochange']['ldap'] =
152 'cpw_ldap_dochange';
153$squirrelmail_plugin_hooks['change_password_init']['ldap'] =
154 'cpw_ldap_init';
155
156/**
9664b344 157 * Makes sure that required functions and configuration options are set.
02c81de4 158 */
159function cpw_ldap_init() {
1b858d86 160 global $oTemplate, $cpw_ldap_basedn;
02c81de4 161
02c81de4 162 // set initial value for error tracker
163 $cpw_ldap_initerr=false;
164
165 // check for ldap support in php
166 if (! function_exists('ldap_connect')) {
1b858d86 167 error_box(_("Current configuration requires LDAP support in PHP."));
02c81de4 168 $cpw_ldap_initerr=true;
169 }
170
171 // chech required configuration settings.
172 if ($cpw_ldap_basedn=='') {
1b858d86 173 error_box(_("Plugin is not configured correctly."));
02c81de4 174 $cpw_ldap_initerr=true;
175 }
176
d04cab42 177 // if error var is positive, close html and stop execution
02c81de4 178 if ($cpw_ldap_initerr) {
1b858d86 179 $oTemplate->display('footer.tpl');
02c81de4 180 exit;
181 }
182}
183
184
185/**
9664b344 186 * Changes password. Main function attached to hook
02c81de4 187 * @param array $data The username/curpw/newpw data.
188 * @return array Array of error messages.
189 */
190function cpw_ldap_dochange($data) {
d04cab42 191 global $cpw_ldap_server, $cpw_ldap_port, $cpw_ldap_basedn,
02c81de4 192 $cpw_ldap_connect_opts,$cpw_ldap_use_tls,
193 $cpw_ldap_binddn, $cpw_ldap_bindpw,
194 $cpw_ldap_admindn, $cpw_ldap_adminpw;
195
196 // unfortunately, we can only pass one parameter to a hook function,
197 // so we have to pass it as an array.
198 $username = $data['username'];
199 $curpw = $data['curpw'];
200 $newpw = $data['newpw'];
201
202 // globalize current password.
203
204 $msgs = array();
205
206 /**
d04cab42 207 * connect to LDAP server
02c81de4 208 * hide ldap_connect() function call errors, because they are processed in script.
d04cab42 209 * any script execution error is treated as critical, error messages are dumped
210 * to $msgs and LDAP connection is closed with ldap_unbind(). all ldap_unbind()
02c81de4 211 * errors are suppressed. Any other error suppression should be explained.
212 */
213 $cpw_ldap_con=@ldap_connect($cpw_ldap_server);
214
215 if ($cpw_ldap_con) {
216 $cpw_ldap_con_err=false;
9664b344 217
02c81de4 218 // set connection options
219 if (is_array($cpw_ldap_connect_opts) && $cpw_ldap_connect_opts!=array()) {
9664b344 220 // ldap_set_option() is available only with openldap 2.x and netscape directory sdk.
221 if (function_exists('ldap_set_option')) {
222 foreach ($cpw_ldap_connect_opts as $opt => $value) {
223 // Make sure that constant is defined defore using it.
224 if (defined('LDAP_OPT_' . $opt)) {
225 // ldap_set_option() should not produce E_NOTICE or E_ALL errors and does not modify ldap_error().
226 // leave it without @ in order to see any weird errors
227 if (! ldap_set_option($cpw_ldap_con,constant('LDAP_OPT_' . $opt),$value)) {
228 // set error message
229 array_push($msgs,sprintf(_("Setting of LDAP connection option %s to value %s failed."),$opt,$value));
230 $cpw_ldap_con_err=true;
231 }
232 } else {
233 array_push($msgs,sprintf(_("Incorrect LDAP connection option: %s"),$opt));
234 $cpw_ldap_con_err=true;
235 }
02c81de4 236 }
9664b344 237 } else {
238 array_push($msgs,_("Current PHP LDAP extension does not allow use of ldap_set_option() function."));
239 $cpw_ldap_con_err=true;
02c81de4 240 }
241 }
242
243 // check for connection errors and stop execution if something is wrong
244 if ($cpw_ldap_con_err) {
245 @ldap_unbind($cpw_ldap_con);
246 return $msgs;
247 }
248
9664b344 249 // enable ldap starttls
02c81de4 250 if ($cpw_ldap_use_tls &&
251 check_php_version(4,2,0) &&
252 isset($cpw_ldap_connect_opts['PROTOCOL_VERSION']) &&
9664b344 253 $cpw_ldap_connect_opts['PROTOCOL_VERSION']>=3 &&
254 function_exists('ldap_start_tls')) {
255 // suppress ldap_start_tls errors and process error messages
256 if (! @ldap_start_tls($cpw_ldap_con)) {
257 array_push($msgs,
258 _("Unable to use TLS."),
259 sprintf(_("Error: %s"),ldap_error($cpw_ldap_con)));
02c81de4 260 $cpw_ldap_con_err=true;
261 }
262 } elseif ($cpw_ldap_use_tls) {
263 array_push($msgs,_("Unable to use LDAP TLS in current setup."));
264 $cpw_ldap_con_err=true;
265 }
266
267 // check for connection errors and stop execution if something is wrong
268 if ($cpw_ldap_con_err) {
269 @ldap_unbind($cpw_ldap_con);
270 return $msgs;
271 }
272
273 /**
d04cab42 274 * Bind to LDAP (use anonymous bind or unprivileged DN) in order to get user's DN
02c81de4 275 * hide ldap_bind() function call errors, because errors are processed in script
276 */
277 if ($cpw_ldap_binddn!='') {
278 // authenticated bind
279 $cpw_ldap_binding=@ldap_bind($cpw_ldap_con,$cpw_ldap_binddn,$cpw_ldap_bindpw);
280 } else {
281 // anonymous bind
282 $cpw_ldap_binding=@ldap_bind($cpw_ldap_con);
283 }
284
285 // check ldap_bind errors
286 if (! $cpw_ldap_binding) {
9664b344 287 array_push($msgs,
288 _("Unable to bind to LDAP server."),
289 sprintf(_("Server replied: %s"),ldap_error($cpw_ldap_con)));
02c81de4 290 @ldap_unbind($cpw_ldap_con);
291 return $msgs;
292 }
293
294 // find userdn
295 $cpw_ldap_search_err=cpw_ldap_uid_search($cpw_ldap_con,$cpw_ldap_basedn,$msgs,$cpw_ldap_res,$cpw_ldap_userdn);
296
297 // check for search errors and stop execution if something is wrong
298 if (! $cpw_ldap_search_err) {
9664b344 299 @ldap_unbind($cpw_ldap_con);
02c81de4 300 return $msgs;
301 }
302
303 /**
304 * unset $cpw_ldap_res2 variable, if such var exists.
d04cab42 305 * $cpw_ldap_res2 object can be set in two places and second place checks,
306 * if object was created in first place. if variable name matches (somebody
307 * uses $cpw_ldap_res2 in code or globals), incorrect validation might
308 * cause script errors.
02c81de4 309 */
310 if (isset($cpw_ldap_res2)) unset($cpw_ldap_res2);
311
312 // rebind as userdn or admindn
313 if ($cpw_ldap_admindn!='') {
314 // admindn bind
315 $cpw_ldap_binding=@ldap_bind($cpw_ldap_con,$cpw_ldap_admindn,$cpw_ldap_adminpw);
316
317 if ($cpw_ldap_binding) {
318 // repeat search in order to get password info. Password info should be unavailable in unprivileged bind.
319 $cpw_ldap_search_err=cpw_ldap_uid_search($cpw_ldap_con,$cpw_ldap_basedn,$msgs,$cpw_ldap_res2,$cpw_ldap_userdn);
320
321 // check for connection errors and stop execution if something is wrong
322 if (! $cpw_ldap_search_err) {
323 @ldap_unbind($cpw_ldap_con);
9664b344 324 // errors are added to msgs by cpw_ldap_uid_search()
02c81de4 325 return $msgs;
326 }
327
328 // we should check user password here.
9664b344 329 // suppress errors and check value returned by function call
330 $cpw_ldap_cur_pass_array=@ldap_get_values($cpw_ldap_con,
02c81de4 331 ldap_first_entry($cpw_ldap_con,$cpw_ldap_res2),'userpassword');
9664b344 332
333 // check if ldap_get_values() have found userpassword field
334 if (! $cpw_ldap_cur_pass_array) {
335 array_push($msgs,_("Unable to find user's password attribute."));
336 return $msgs;
337 }
02c81de4 338
339 // compare passwords
340 if (! cpw_ldap_compare_pass($cpw_ldap_cur_pass_array[0],$curpw,$msgs)) {
341 @ldap_unbind($cpw_ldap_con);
9664b344 342 // errors are added to $msgs by cpw_ldap_compare_pass()
02c81de4 343 return $msgs;
344 }
345 }
346 } else {
347 $cpw_ldap_binding=@ldap_bind($cpw_ldap_con,$cpw_ldap_userdn,$curpw);
348 }
349
350 if (! $cpw_ldap_binding) {
9664b344 351 array_push($msgs,
352 _("Unable to rebind to LDAP server."),
353 sprintf(_("Server replied: %s"),ldap_error($cpw_ldap_con)));
02c81de4 354 @ldap_unbind($cpw_ldap_con);
355 return $msgs;
356 }
357
358 // repeat search in order to get password info
359 if (! isset($cpw_ldap_res2))
360 $cpw_ldap_search_err=cpw_ldap_uid_search($cpw_ldap_con,$cpw_ldap_basedn,$msgs,$cpw_ldap_res2,$cpw_ldap_userdn);
361
362 // check for connection errors and stop execution if something is wrong
363 if (! $cpw_ldap_search_err) {
364 @ldap_unbind($cpw_ldap_con);
365 return $msgs;
366 }
367
9664b344 368 // getpassword. suppress errors and check value returned by function call
369 $cpw_ldap_cur_pass_array=@ldap_get_values($cpw_ldap_con,ldap_first_entry($cpw_ldap_con,$cpw_ldap_res2),'userpassword');
370
371 // check if ldap_get_values() have found userpassword field.
372 // Error differs from previous one, because user managed to authenticate.
373 if (! $cpw_ldap_cur_pass_array) {
374 array_push($msgs,_("LDAP server uses different attribute to store user's password."));
375 return $msgs;
376 }
02c81de4 377
378 // encrypt new password (old password is needed for plaintext encryption detection)
379 $cpw_ldap_new_pass=cpw_ldap_encrypt_pass($newpw,$cpw_ldap_cur_pass_array[0],$msgs,$curpw);
380
381 if (! $cpw_ldap_new_pass) {
382 @ldap_unbind($cpw_ldap_con);
383 return $msgs;
384 }
385
d264e600 386 // set new password. suppress ldap_modify errors. script checks and displays ldap_modify errors.
387 $ldap_pass_change=@ldap_modify($cpw_ldap_con,$cpw_ldap_userdn,array('userpassword'=>$cpw_ldap_new_pass));
02c81de4 388
389 // check if ldap_modify was successful
390 if(! $ldap_pass_change) {
391 array_push($msgs,ldap_error($cpw_ldap_con));
392 }
393
394 // close connection
395 @ldap_unbind($cpw_ldap_con);
396 } else {
397 array_push($msgs,_("Unable to connect to LDAP server."));
398 }
399 return $msgs;
400}
401
402/** backend support functions **/
403
404/**
d04cab42 405 * Sanitizes LDAP query strings.
02c81de4 406 * original code - ldapquery plugin.
407 * See rfc2254
408 * @link http://www.faqs.org/rfcs/rfc2254.html
409 * @param string $string
410 * @return string sanitized string
411 */
412function cpw_ldap_specialchars($string) {
413 $sanitized=array('\\' => '\5c',
414 '*' => '\2a',
415 '(' => '\28',
416 ')' => '\29',
417 "\x00" => '\00');
418
419 return str_replace(array_keys($sanitized),array_values($sanitized),$string);
420}
421
422/**
423 * returns crypto algorithm used in password.
424 * @param string $pass encrypted/hashed password
425 * @return string lowercased crypto algorithm name
426 */
427function cpw_ldap_get_crypto($pass,$curpass='') {
428 $ret = false;
429
430 if (preg_match("/^\{(.+)\}+/",$pass,$crypto)) {
431 $ret=strtolower($crypto[1]);
432 }
433
434 if ($ret=='crypt') {
435 // {CRYPT} can be standard des crypt, extended des crypt, md5 crypt or blowfish
d264e600 436 // depends on first salt symbols (ext_des = '_', md5 = '$1$', blowfish = '$2')
02c81de4 437 // and length of salt (des = 2 chars, ext_des = 9, md5 = 12, blowfish = 16).
438 if (preg_match("/^\{crypt\}\\\$1\\\$+/i",$pass)) {
439 $ret='md5crypt';
d264e600 440 } elseif (preg_match("/^\{crypt\}\\\$2+/i",$pass)) {
02c81de4 441 $ret='blowfish';
442 } elseif (preg_match("/^\{crypt\}_+/i",$pass)) {
443 $ret='extcrypt';
444 }
445 }
446
447 // maybe password is plaintext
448 if (! $ret && $curpass!='' && $pass==$curpass) $ret='plaintext';
449
450 return $ret;
451}
452
453/**
d04cab42 454 * Search LDAP for user id.
02c81de4 455 * @param object $ldap_con ldap connection
456 * @param string $ldap_basedn ldap basedn
457 * @param array $msgs error messages
458 * @param object $results ldap search results
459 * @param string $userdn DN of found entry
460 * @param boolean $onlyone require unique search results
461 * @return boolean false if connection failed.
462 */
463function cpw_ldap_uid_search($ldap_con,$ldap_basedn,&$msgs,&$results,&$userdn,$onlyone=true) {
464 global $cpw_ldap_userid_attr,$username;
465
466 $ret=true;
467
468 $results=ldap_search($ldap_con,$ldap_basedn,cpw_ldap_specialchars($cpw_ldap_userid_attr . '=' . $username));
469
470 if (! $results) {
9664b344 471 array_push($msgs,
472 _("Unable to find user's DN."),
473 _("Search error."),
474 sprintf(_("Error: %s"),ldap_error($ldap_con)));
02c81de4 475 $ret=false;
476 } elseif ($onlyone && ldap_count_entries($ldap_con,$results)>1) {
477 array_push($msgs,_("Multiple userid matches found."));
478 $ret=false;
479 } elseif (! $userdn = ldap_get_dn($ldap_con,ldap_first_entry($ldap_con,$results))) {
480 // ldap_get_dn() returned error
9664b344 481 array_push($msgs,
482 _("Unable to find user's DN."),
483 _("ldap_get_dn error."));
02c81de4 484 $ret=false;
485 }
486 return $ret;
487}
488
489/**
d04cab42 490 * Encrypts LDAP password
02c81de4 491 *
d04cab42 492 * if $cpw_ldap_default_crypto is set to empty string or $same_crypto is set,
02c81de4 493 * uses same crypto as in old password.
494 * See phpldapadmin password_hash() function
495 * @link http://phpldapadmin.sf.net
496 * @param string $pass string that has to be encrypted/hashed
497 * @param string $cur_pass_hash old password hash
498 * @param array $msgs error message
499 * @param string $curpass current password. Used for plaintext password detection.
500 * @return string encrypted/hashed password or false
501 */
502function cpw_ldap_encrypt_pass($pass,$cur_pass_hash,&$msgs,$curpass='') {
503 global $cpw_ldap_default_crypto;
504
505 // which crypto should be used to encode/hash password
506 if ($cpw_ldap_default_crypto=='') {
507 $ldap_crypto=cpw_ldap_get_crypto($cur_pass_hash,$curpass);
508 } else {
509 $ldap_crypto=$cpw_ldap_default_crypto;
510 }
511 return cpw_ldap_password_hash($pass,$ldap_crypto,$msgs);
512}
513
514/**
515 * create hashed password
516 * @param string $pass plain text password
517 * @param string $crypto used crypto algorithm
518 * @param array $msgs array used for error messages
519 * @param string $forced_salt salt that should be used during hashing.
520 * Is used only when is not set to empty string. Salt should be formated
521 * according to $crypto requirements.
522 * @return hashed password or false.
523 */
524function cpw_ldap_password_hash($pass,$crypto,&$msgs,$forced_salt='') {
525 // set default return code
526 $ret=false;
527
528 // lowercase crypto just in case
529 $crypto=strtolower($crypto);
530
531 // extra symbols used for random string in crypt salt
532 // squirrelmail GenerateRandomString() adds alphanumerics with third argument = 7.
533 $extra_salt_chars='./';
534
535 // encrypt/hash password
536 switch ($crypto) {
444db9b3 537 case 'md4':
538 // minimal requirement = php with mhash extension
539 if ( function_exists( 'mhash' ) && defined('MHASH_MD4')) {
540 $ret = '{MD4}' . base64_encode( mhash( MHASH_MD4, $pass) );
541 } else {
542 array_push($msgs,
543 sprintf(_("Unsupported crypto: %s"),'md4'),
544 _("PHP mhash extension is missing or does not support selected crypto."));
545 }
546 break;
02c81de4 547 case 'md5':
548 $ret='{MD5}' . base64_encode(pack('H*',md5($pass)));
549 break;
550 case 'smd5':
444db9b3 551 // minimal requirement = mhash extension with md5 support and php 4.0.4.
552 if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) && defined('MHASH_MD5')) {
02c81de4 553 sq_mt_seed( (double) microtime() * 1000000 );
554 if ($forced_salt!='') {
555 $salt=$forced_salt;
556 } else {
c8e4fe01 557 sq_mt_randomize();
02c81de4 558 $salt = mhash_keygen_s2k( MHASH_MD5, $pass, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
559 }
560 $ret = "{SMD5}".base64_encode( mhash( MHASH_MD5, $pass.$salt ).$salt );
561 } else {
d264e600 562 // use two array_push calls in order to display messages in different lines.
9664b344 563 array_push($msgs,
564 sprintf(_("Unsupported crypto: %s"),'smd5'),
444db9b3 565 _("PHP mhash extension is missing or does not support selected crypto."));
566 }
567 break;
568 case 'rmd160':
569 // minimal requirement = php with mhash extension
570 if ( function_exists( 'mhash' ) && defined('MHASH_RIPEMD160')) {
571 $ret = '{RMD160}' . base64_encode( mhash( MHASH_RIPEMD160, $pass) );
572 } else {
573 array_push($msgs,
574 sprintf(_("Unsupported crypto: %s"),'ripe-md160'),
575 _("PHP mhash extension is missing or does not support selected crypto."));
02c81de4 576 }
577 break;
578 case 'sha':
d264e600 579 // minimal requirement = php 4.3.0+ or php with mhash extension
444db9b3 580 if ( function_exists('sha1') && defined('MHASH_SHA1')) {
d264e600 581 // use php 4.3.0+ sha1 function, if it is available.
9664b344 582 $ret = '{SHA}' . base64_encode(pack('H*',sha1($pass)));
d264e600 583 } elseif( function_exists( 'mhash' ) ) {
02c81de4 584 $ret = '{SHA}' . base64_encode( mhash( MHASH_SHA1, $pass) );
585 } else {
9664b344 586 array_push($msgs,
587 sprintf(_("Unsupported crypto: %s"),'sha'),
444db9b3 588 _("PHP mhash extension is missing or does not support selected crypto."));
02c81de4 589 }
590 break;
591 case 'ssha':
592 // minimal requirement = mhash extension and php 4.0.4
444db9b3 593 if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) && defined('MHASH_SHA1')) {
02c81de4 594 sq_mt_seed( (double) microtime() * 1000000 );
595 if ($forced_salt!='') {
596 $salt=$forced_salt;
597 } else {
c8e4fe01 598 sq_mt_randomize();
02c81de4 599 $salt = mhash_keygen_s2k( MHASH_SHA1, $pass, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
600 }
601 $ret = "{SSHA}".base64_encode( mhash( MHASH_SHA1, $pass.$salt ).$salt );
602 } else {
9664b344 603 array_push($msgs,
604 sprintf(_("Unsupported crypto: %s"),'ssha'),
444db9b3 605 _("PHP mhash extension is missing or does not support selected crypto."));
02c81de4 606 }
607 break;
608 case 'crypt':
609 if (defined('CRYPT_STD_DES') && CRYPT_STD_DES==1) {
610 $ret = '{CRYPT}' . crypt($pass,GenerateRandomString(2,$extra_salt_chars,7));
611 } else {
9664b344 612 array_push($msgs,
613 sprintf(_("Unsupported crypto: %s"),'crypt'),
614 _("System crypt library doesn't support standard DES crypt."));
02c81de4 615 }
616 break;
617 case 'md5crypt':
618 // check if crypt() supports md5
619 if (defined('CRYPT_MD5') && CRYPT_MD5==1) {
620 $ret = '{CRYPT}' . crypt($pass,'$1$' . GenerateRandomString(9,$extra_salt_chars,7));
621 } else {
9664b344 622 array_push($msgs,
623 sprintf(_("Unsupported crypto: %s"),'md5crypt'),
624 _("System crypt library doesn't have MD5 support."));
02c81de4 625 }
626 break;
627 case 'extcrypt':
628 // check if crypt() supports extended des
629 if (defined('CRYPT_EXT_DES') && CRYPT_EXT_DES==1) {
02c81de4 630 $ret = '{CRYPT}' . crypt($pass,'_' . GenerateRandomString(8,$extra_salt_chars,7));
631 } else {
9664b344 632 array_push($msgs,
633 sprintf(_("Unsupported crypto: %s"),'ext_des'),
634 _("System crypt library doesn't support extended DES crypt."));
02c81de4 635 }
636 break;
637 case 'blowfish':
638 // check if crypt() supports blowfish
639 if (defined('CRYPT_BLOWFISH') && CRYPT_BLOWFISH==1) {
d264e600 640 $ret = '{CRYPT}' . crypt($pass,'$2a$12$' . GenerateRandomString(13,$extra_salt_chars,7));
02c81de4 641 } else {
9664b344 642 array_push($msgs,
643 sprintf(_("Unsupported crypto: %s"),'Blowfish'),
644 _("System crypt library doesn't have Blowfish support."));
02c81de4 645 }
646 break;
647 case 'plaintext':
648 // clear plain text password
649 $ret=$pass;
650 break;
651 default:
652 array_push($msgs,sprintf(_("Unsupported crypto: %s"),
653 (is_string($ldap_crypto) ? htmlspecialchars($ldap_crypto) : _("unknown"))));
654 }
655 return $ret;
656}
657
658/**
659 * compares two passwords
660 * Code reuse. See phpldapadmin password_compare() function.
661 * Some parts of code was rewritten to backend specifics.
662 * @link http://phpldapadmin.sf.net
444db9b3 663 * @param string $pass_hash hashed password string with password type indicators
664 * @param string $pass_clear plain text password
665 * @param array $msgs error messages
02c81de4 666 * @return boolean true, if passwords match
667 */
668function cpw_ldap_compare_pass($pass_hash,$pass_clear,&$msgs) {
669 $ret=false;
670
671 if( preg_match( "/{([^}]+)}(.*)/", $pass_hash, $cypher ) ) {
672 $pass_hash = $cypher[2];
673 $_cypher = strtolower($cypher[1]);
674 } else {
675 $_cypher = NULL;
676 }
677
678 switch( $_cypher ) {
679 case 'ssha':
680 // Salted SHA
681 // check for mhash support
444db9b3 682 if ( function_exists('mhash') && defined('MHASH_SHA1')) {
02c81de4 683 $hash = base64_decode($pass_hash);
684 $salt = substr($hash, -4);
685 $new_hash = base64_encode( mhash( MHASH_SHA1, $pass_clear.$salt).$salt );
686 if( strcmp( $pass_hash, $new_hash ) == 0 )
687 $ret=true;
688 } else {
9664b344 689 array_push($msgs,
690 _("Unable to validate user's password."),
444db9b3 691 _("PHP mhash extension is missing or does not support selected crypto."));
02c81de4 692 }
693 break;
694 case 'smd5':
695 // Salted MD5
696 // check for mhash support
444db9b3 697 if ( function_exists('mhash') && defined('MHASH_MD5')) {
02c81de4 698 $hash = base64_decode($pass_hash);
699 $salt = substr($hash, -4);
700 $new_hash = base64_encode( mhash( MHASH_MD5, $pass_clear.$salt).$salt );
701 if( strcmp( $pass_hash, $new_hash ) == 0)
702 $ret=true;
703 } else {
9664b344 704 array_push($msgs,
705 _("Unable to validate user's password."),
444db9b3 706 _("PHP mhash extension is missing or does not support selected crypto."));
02c81de4 707 }
708 break;
709 case 'sha':
710 // SHA crypted passwords
711 if( strcasecmp( cpw_ldap_password_hash($pass_clear,'sha',$msgs), "{SHA}".$pass_hash ) == 0)
712 $ret=true;
713 break;
444db9b3 714 case 'rmd160':
715 // RIPE-MD160 crypted passwords
716 if( strcasecmp( cpw_ldap_password_hash($pass_clear,'rmd160',$msgs), "{RMD160}".$pass_hash ) == 0 )
717 $ret=true;
718 break;
02c81de4 719 case 'md5':
720 // MD5 crypted passwords
d264e600 721 if( strcasecmp( cpw_ldap_password_hash($pass_clear,'md5',$msgs), "{MD5}".$pass_hash ) == 0 )
02c81de4 722 $ret=true;
723 break;
444db9b3 724 case 'md4':
725 // MD4 crypted passwords
726 if( strcasecmp( cpw_ldap_password_hash($pass_clear,'md4',$msgs), "{MD4}".$pass_hash ) == 0 )
727 $ret=true;
728 break;
02c81de4 729 case 'crypt':
730 // Crypt passwords
d264e600 731 if( preg_match( "/^\\\$2+/",$pass_hash ) ) { // Check if it's blowfish crypt
02c81de4 732 // check CRYPT_BLOWFISH here.
733 // ldap server might support it, but php can be on other OS
734 if (defined('CRYPT_BLOWFISH') && CRYPT_BLOWFISH==1) {
d264e600 735 if( crypt( $pass_clear, $pass_hash ) == $pass_hash )
02c81de4 736 $ret=true;
737 } else {
9664b344 738 array_push($msgs,
739 _("Unable to validate user's password."),
740 _("Blowfish is not supported by webserver's system crypt library."));
02c81de4 741 }
742 } elseif( strstr( $pass_hash, '$1$' ) ) { // Check if it's md5 crypt
743 // check CRYPT_MD5 here.
744 // ldap server might support it, but php might be on other OS
745 if (defined('CRYPT_MD5') && CRYPT_MD5==1) {
746 list(,$type,$salt,$hash) = explode('$',$pass_hash);
747 if( crypt( $pass_clear, '$1$' .$salt ) == $pass_hash )
748 $ret=true;
749 } else {
9664b344 750 array_push($msgs,
751 _("Unable to validate user's password."),
752 _("MD5 is not supported by webserver's system crypt library."));
02c81de4 753 }
754 } elseif( strstr( $pass_hash, '_' ) ) { // Check if it's extended des crypt
755 // check CRYPT_EXT_DES here.
756 // ldap server might support it, but php might be on other OS
757 if (defined('CRYPT_EXT_DES') && CRYPT_EXT_DES==1) {
758 if( crypt( $pass_clear, $pass_hash ) == $pass_hash )
759 $ret=true;
760 } else {
9664b344 761 array_push($msgs,
762 _("Unable to validate user's password."),
763 _("Extended DES crypt is not supported by webserver's system crypt library."));
02c81de4 764 }
765 } else {
766 // it is possible that this test is useless and any crypt library supports it, but ...
767 if (defined('CRYPT_STD_DES') && CRYPT_STD_DES==1) {
768 // plain crypt password
769 if( crypt($pass_clear, $pass_hash ) == $pass_hash )
770 $ret=true;
771 } else {
9664b344 772 array_push($msgs,
773 _("Unable to validate user's password."),
774 _("Standard DES crypt is not supported by webserver's system crypt library."));
02c81de4 775 }
776 }
777 break;
d264e600 778 // No crypt is given, assume plaintext passwords are used
02c81de4 779 default:
780 if( $pass_clear == $pass_hash )
781 $ret=true;
782 break;
783 }
d264e600 784 if (! $ret && empty($msgs)) {
02c81de4 785 array_push($msgs,CPW_CURRENT_NOMATCH);
786 }
787 return $ret;
788}