githubFork/roundcubemail.git

			@@ -12,6 +12,20 @@
			* method hashPassword based on code from the phpLDAPadmin development team (http://phpldapadmin.sourceforge.net/).
			* method randomSalt based on code from the phpLDAPadmin development team (http://phpldapadmin.sourceforge.net/).
			*
			* Copyright (C) 2005-2014, The Roundcube Dev Team
			*
			* This program is free software: you can redistribute it and/or modify
			* it under the terms of the GNU General Public License as published by
			* the Free Software Foundation, either version 3 of the License, or
			* (at your option) any later version.
			*
			* This program is distributed in the hope that it will be useful,
			* but WITHOUT ANY WARRANTY; without even the implied warranty of
			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
			* GNU General Public License for more details.
			*
			* You should have received a copy of the GNU General Public License
			* along with this program. If not, see http://www.gnu.org/licenses/.
			*/

			class rcube_ldap_password
			@@ -23,8 +37,9 @@

			// Building user DN
			if ($userDN = $rcmail->config->get('password_ldap_userDN_mask')) {
			$userDN = $this->substitute_vars($userDN);
			} else {
			$userDN = self::substitute_vars($userDN);
			}
			else {
			$userDN = $this->search_userdn($rcmail);
			}

			@@ -60,17 +75,28 @@
			$ldap = Net_LDAP2::connect($ldapConfig);

			// Checking for connection error
			if (PEAR::isError($ldap)) {
			if (is_a($ldap, 'PEAR_Error')) {
			return PASSWORD_CONNECT_ERROR;
			}

			$crypted_pass = $this->hashPassword($passwd, $rcmail->config->get('password_ldap_encodage'));
			$force = $rcmail->config->get('password_ldap_force_replace');
			$pwattr = $rcmail->config->get('password_ldap_pwattr');
			$lchattr = $rcmail->config->get('password_ldap_lchattr');
			$smbpwattr = $rcmail->config->get('password_ldap_samba_pwattr');
			$smblchattr = $rcmail->config->get('password_ldap_samba_lchattr');
			$samba = $rcmail->config->get('password_ldap_samba');
			$encodage = $rcmail->config->get('password_ldap_encodage');

			// Support multiple userPassword values where desired.
			// multiple encodings can be specified separated by '+' (e.g. "cram-md5+ssha")
			$encodages = explode('+', $encodage);
			$crypted_pass = array();

			foreach ($encodages as $enc) {
			if ($cpw = password::hash_password($passwd, $enc)) {
			$crypted_pass[] = $cpw;
			}
			}

			// Support password_ldap_samba option for backward compat.
			if ($samba && !$smbpwattr) {
			@@ -79,12 +105,12 @@
			}

			// Crypt new password
			if (!$crypted_pass) {
			if (empty($crypted_pass)) {
			return PASSWORD_CRYPT_ERROR;
			}

			// Crypt new samba password
			if ($smbpwattr && !($samba_pass = $this->hashPassword($passwd, 'samba'))) {
			if ($smbpwattr && !($samba_pass = password::hash_password($passwd, 'samba'))) {
			return PASSWORD_CRYPT_ERROR;
			}

			@@ -130,9 +156,10 @@
			*/
			function search_userdn($rcmail)
			{
			$binddn = $rcmail->config->get('password_ldap_searchDN');
			$bindpw = $rcmail->config->get('password_ldap_searchPW');

			$ldapConfig = array (
			'binddn' => $rcmail->config->get('password_ldap_searchDN'),
			'bindpw' => $rcmail->config->get('password_ldap_searchPW'),
			'basedn' => $rcmail->config->get('password_ldap_basedn'),
			'host' => $rcmail->config->get('password_ldap_host'),
			'port' => $rcmail->config->get('password_ldap_port'),
			@@ -140,183 +167,56 @@
			'version' => $rcmail->config->get('password_ldap_version'),
			);

			// allow anonymous searches
			if (!empty($binddn)) {
			$ldapConfig['binddn'] = $binddn;
			$ldapConfig['bindpw'] = $bindpw;
			}

			$ldap = Net_LDAP2::connect($ldapConfig);

			if (PEAR::isError($ldap)) {
			if (is_a($ldap, 'PEAR_Error')) {
			return '';
			}

			$base = $rcmail->config->get('password_ldap_search_base');
			$filter = $this->substitute_vars($rcmail->config->get('password_ldap_search_filter'));
			$base = self::substitute_vars($rcmail->config->get('password_ldap_search_base'));
			$filter = self::substitute_vars($rcmail->config->get('password_ldap_search_filter'));
			$options = array (
			'scope' => 'sub',
			'attributes' => array(),
			);

			$result = $ldap->search($base, $filter, $options);
			$ldap->done();
			if (PEAR::isError($result) \|\| ($result->count() != 1)) {
			if (is_a($result, 'PEAR_Error') \|\| ($result->count() != 1)) {
			$ldap->done();
			return '';
			}
			$userDN = $result->current()->dn();
			$ldap->done();

			return $result->current()->dn();
			return $userDN;
			}

			/**
			* Substitute %login, %name, %domain, %dc in $str.
			* See plugin config for details.
			* Substitute %login, %name, %domain, %dc in $str
			* See plugin config for details
			*/
			function substitute_vars($str)
			static function substitute_vars($str)
			{
			$rcmail = rcmail::get_instance();
			$domain = $rcmail->user->get_username('domain');
			$dc = 'dc='.strtr($domain, array('.' => ',dc=')); // hierarchal domain string
			$str = str_replace('%login', $_SESSION['username'], $str);
			$str = str_replace('%l', $_SESSION['username'], $str);

			$str = str_replace(array(
			'%login',
			'%name',
			'%domain',
			'%dc',
			), array(
			$_SESSION['username'],
			$rcmail->user->get_username('local'),
			$domain,
			$dc,
			), $str
			);
			$parts = explode('@', $_SESSION['username']);

			return $str;
			}
			if (count($parts) == 2) {
			$dc = 'dc='.strtr($parts[1], array('.' => ',dc=')); // hierarchal domain string

			/**
			* Code originaly from the phpLDAPadmin development team
			* http://phpldapadmin.sourceforge.net/
			*
			* Hashes a password and returns the hash based on the specified enc_type.
			*
			* @param string $passwordClear The password to hash in clear text.
			* @param string $encodageType Standard LDAP encryption type which must be one of
			* crypt, ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, or clear.
			* @return string The hashed password.
			*
			*/
			function hashPassword( $passwordClear, $encodageType )
			{
			$encodageType = strtolower( $encodageType );
			switch( $encodageType ) {
			case 'crypt':
			$cryptedPassword = '{CRYPT}' . crypt($passwordClear, $this->randomSalt(2));
			break;

			case 'ext_des':
			// extended des crypt. see OpenBSD crypt man page.
			if ( ! defined( 'CRYPT_EXT_DES' ) \|\| CRYPT_EXT_DES == 0 ) {
			// Your system crypt library does not support extended DES encryption.
			return FALSE;
			}
			$cryptedPassword = '{CRYPT}' . crypt( $passwordClear, '_' . $this->randomSalt(8) );
			break;

			case 'md5crypt':
			if( ! defined( 'CRYPT_MD5' ) \|\| CRYPT_MD5 == 0 ) {
			// Your system crypt library does not support md5crypt encryption.
			return FALSE;
			}
			$cryptedPassword = '{CRYPT}' . crypt( $passwordClear , '$1$' . $this->randomSalt(9) );
			break;

			case 'blowfish':
			if( ! defined( 'CRYPT_BLOWFISH' ) \|\| CRYPT_BLOWFISH == 0 ) {
			// Your system crypt library does not support blowfish encryption.
			return FALSE;
			}
			// hardcoded to second blowfish version and set number of rounds
			$cryptedPassword = '{CRYPT}' . crypt( $passwordClear , '$2a$12$' . $this->randomSalt(13) );
			break;

			case 'md5':
			$cryptedPassword = '{MD5}' . base64_encode( pack( 'H*' , md5( $passwordClear) ) );
			break;

			case 'sha':
			if( function_exists('sha1') ) {
			// use php 4.3.0+ sha1 function, if it is available.
			$cryptedPassword = '{SHA}' . base64_encode( pack( 'H*' , sha1( $passwordClear) ) );
			} elseif( function_exists( 'mhash' ) ) {
			$cryptedPassword = '{SHA}' . base64_encode( mhash( MHASH_SHA1, $passwordClear) );
			} else {
			return FALSE; //Your PHP install does not have the mhash() function. Cannot do SHA hashes.
			}
			break;

			case 'ssha':
			if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) ) {
			mt_srand( (double) microtime() * 1000000 );
			$salt = mhash_keygen_s2k( MHASH_SHA1, $passwordClear, substr( pack( 'h*', md5( mt_rand() ) ), 0, 8 ), 4 );
			$cryptedPassword = '{SSHA}'.base64_encode( mhash( MHASH_SHA1, $passwordClear.$salt ).$salt );
			} else {
			return FALSE; //Your PHP install does not have the mhash() function. Cannot do SHA hashes.
			}
			break;

			case 'smd5':
			if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) ) {
			mt_srand( (double) microtime() * 1000000 );
			$salt = mhash_keygen_s2k( MHASH_MD5, $passwordClear, substr( pack( 'h*', md5( mt_rand() ) ), 0, 8 ), 4 );
			$cryptedPassword = '{SMD5}'.base64_encode( mhash( MHASH_MD5, $passwordClear.$salt ).$salt );
			} else {
			return FALSE; //Your PHP install does not have the mhash() function. Cannot do SHA hashes.
			}
			break;

			case 'samba':
			if (function_exists('hash')) {
			$cryptedPassword = hash('md4', rcube_charset::convert($passwordClear, RCUBE_CHARSET, 'UTF-16LE'));
			$cryptedPassword = strtoupper($cryptedPassword);
			} else {
			/* Your PHP install does not have the hash() function */
			return false;
			}
			break;

			case 'ad':
			$cryptedPassword = rcube_charset::convert('"' . $passwordClear . '"', RCUBE_CHARSET, 'UTF-16LE');
			break;

			case 'clear':
			default:
			$cryptedPassword = $passwordClear;
			$str = str_replace('%name', $parts[0], $str);
			$str = str_replace('%n', $parts[0], $str);
			$str = str_replace('%dc', $dc, $str);
			$str = str_replace('%domain', $parts[1], $str);
			$str = str_replace('%d', $parts[1], $str);
			}

			return $cryptedPassword;
			}

			/**
			* Code originaly from the phpLDAPadmin development team
			* http://phpldapadmin.sourceforge.net/
			*
			* Used to generate a random salt for crypt-style passwords. Salt strings are used
			* to make pre-built hash cracking dictionaries difficult to use as the hash algorithm uses
			* not only the user's password but also a randomly generated string. The string is
			* stored as the first N characters of the hash for reference of hashing algorithms later.
			*
			* --- added 20021125 by bayu irawan <bayuir@divnet.telkom.co.id> ---
			* --- ammended 20030625 by S C Rigler <srigler@houston.rr.com> ---
			*
			* @param int $length The length of the salt string to generate.
			* @return string The generated salt string.
			*/
			function randomSalt( $length )
			{
			$possible = '0123456789'.
			'abcdefghijklmnopqrstuvwxyz'.
			'ABCDEFGHIJKLMNOPQRSTUVWXYZ'.
			'./';
			$str = '';
			// mt_srand((double)microtime() * 1000000);

			while (strlen($str) < $length)
			$str .= substr($possible, (rand() % strlen($possible)), 1);

			return $str;
			}