upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-07-15 04:51:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 66

Merge pull request #50481 from nextcloud/backport/45364/stable31

Browse source 
[stable31] fix(user_ldap): Do not map groups we do not know if they match filter
This commit is contained in:
Andy Scherzinger 2025-01-27 18:13:22 +01:00 committed by GitHub
commit 3604f0b0e6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
apps/user_ldap/lib/Access.php
View file

@ -436,10 +436,11 @@ class Access extends LDAPUtility {
*
* @param string $fdn the dn of the group object
* @param string $ldapName optional, the display name of the object
* @param bool $autoMapping Should the group be mapped if not yet mapped
* @return string|false with the name to use in Nextcloud, false on DN outside of search DN
* @throws \Exception
*/
public function dn2groupname($fdn, $ldapName = null) {
public function dn2groupname($fdn, $ldapName = null, bool $autoMapping = true) {
//To avoid bypassing the base DN settings under certain circumstances
//with the group support, check whether the provided DN matches one of
//the given Bases
@ -447,7 +448,7 @@ class Access extends LDAPUtility {
return false;
}
return $this->dn2ocname($fdn, $ldapName, false);
return $this->dn2ocname($fdn, $ldapName, false, autoMapping:$autoMapping);
}
/**
@ -477,10 +478,11 @@ class Access extends LDAPUtility {
* @param bool $isUser optional, whether it is a user object (otherwise group assumed)
* @param bool|null $newlyMapped
* @param array|null $record
* @param bool $autoMapping Should the group be mapped if not yet mapped
* @return false|string with with the name to use in Nextcloud
* @throws \Exception
*/
public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, ?array $record = null) {
public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, ?array $record = null, bool $autoMapping = true) {
static $intermediates = [];
if (isset($intermediates[($isUser ? 'user-' : 'group-') . $fdn])) {
return false; // is a known intermediate
@ -499,6 +501,11 @@ class Access extends LDAPUtility {
return $ncName;
}
if (!$autoMapping) {
/* If no auto mapping, stop there */
return false;
}
if ($isUser) {
$nameAttribute = strtolower($this->connection->ldapUserDisplayName);
$filter = $this->connection->ldapUserFilter;

2
apps/user_ldap/lib/Group_LDAP.php
View file

@ -1178,7 +1178,7 @@ class Group_LDAP extends ABackend implements GroupInterface, IGroupLDAP, IGetDis
continue;
}
$name = $item[$this->access->connection->ldapGroupDisplayName][0] ?? null;
$gid = $this->access->dn2groupname($dn, $name);
$gid = $this->access->dn2groupname($dn, $name, false);
if (!$gid) {
continue;
}