mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix detecting cyclic group memberships 

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
This commit is contained in:
Arthur Schiwon 2021-02-19 17:22:30 +01:00
parent 4a111afc8d
commit 7afb588059
No known key found for this signature in database
GPG Key ID: 7424F1874854DF23
1 changed files with 22 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
apps/user_ldap/lib/Group_LDAP.php
View File

@ -43,6 +43,7 @@
namespace OCA\User_LDAP; namespace OCA\User_LDAP;
use Closure;
use OC\Cache\CappedMemoryCache; use OC\Cache\CappedMemoryCache;
use OCP\Group\Backend\IGetDisplayNameBackend; use OCP\Group\Backend\IGetDisplayNameBackend;
use OCP\GroupInterface; use OCP\GroupInterface;
@ -223,6 +224,9 @@ class Group_LDAP extends BackendUtility implements \OCP\GroupInterface, IGroupLD
private function _groupMembers($dnGroup, &$seen = null) { private function _groupMembers($dnGroup, &$seen = null) {
if ($seen === null) { if ($seen === null) {
$seen = []; $seen = [];
// the root entry has to be marked as processed to avoind infinit loops,
// but not included in the results laters on
$excludeFromResult = $dnGroup;
} }
$allMembers = []; $allMembers = [];
if (array_key_exists($dnGroup, $seen)) { if (array_key_exists($dnGroup, $seen)) {
@ -269,13 +273,19 @@ class Group_LDAP extends BackendUtility implements \OCP\GroupInterface, IGroupLD
$seen[$dnGroup] = 1; $seen[$dnGroup] = 1;
$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr); $members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
if (is_array($members)) { if (is_array($members)) {
$fetcher = function ($memberDN, &$seen) { $fetcher = function ($memberDN) use (&$seen) {
return $this->_groupMembers($memberDN, $seen); return $this->_groupMembers($memberDN, $seen);
}; };
$allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members); $allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members, $seen);
} }
$allMembers += $this->getDynamicGroupMembers($dnGroup); $allMembers += $this->getDynamicGroupMembers($dnGroup);
if (isset($excludeFromResult)) {
$index = array_search($excludeFromResult, $allMembers, true);
if ($index !== false) {
unset($allMembers[$index]);
}
}
$this->access->connection->writeToCache($cacheKey, $allMembers); $this->access->connection->writeToCache($cacheKey, $allMembers);
if (isset($attemptedLdapMatchingRuleInChain) if (isset($attemptedLdapMatchingRuleInChain)
@ -317,13 +327,7 @@ class Group_LDAP extends BackendUtility implements \OCP\GroupInterface, IGroupLD
return $this->filterValidGroups($groups); return $this->filterValidGroups($groups);
} }
/** private function walkNestedGroups(string $dn, Closure $fetcher, array $list, array &$seen = []): array {
* @param string $dn
* @param \Closure $fetcher args: string $dn, array $seen, returns: string[] of dns
* @param array $list
* @return array
*/
private function walkNestedGroups(string $dn, \Closure $fetcher, array $list): array {
$nesting = (int)$this->access->connection->ldapNestedGroups; $nesting = (int)$this->access->connection->ldapNestedGroups;
// depending on the input, we either have a list of DNs or a list of LDAP records // depending on the input, we either have a list of DNs or a list of LDAP records
// also, the output expects either DNs or records. Testing the first element should suffice. // also, the output expects either DNs or records. Testing the first element should suffice.
@ -342,19 +346,21 @@ class Group_LDAP extends BackendUtility implements \OCP\GroupInterface, IGroupLD
return $list; return $list;
} }
$seen = [];
while ($record = array_shift($list)) { while ($record = array_shift($list)) {
$recordDN = $recordMode ? $record['dn'][0] : $record; $recordDN = $record['dn'][0] ?? $record;
if ($recordDN === $dn || array_key_exists($recordDN, $seen)) { if ($recordDN === $dn || array_key_exists($recordDN, $seen)) {
// Prevent loops // Prevent loops
continue; continue;
} }
$fetched = $fetcher($record, $seen); $fetched = $fetcher($record);
$list = array_merge($list, $fetched); $list = array_merge($list, $fetched);
$seen[$recordDN] = $record; if (!isset($seen[$recordDN]) || is_bool($seen[$recordDN]) && is_array($record)) {
$seen[$recordDN] = $record;
}
} }
return $recordMode ? $seen : array_keys($seen); // on record mode, filter out intermediate state
return $recordMode ? array_filter($seen, 'is_array') : array_keys($seen);
} }
/** /**
@ -850,13 +856,13 @@ class Group_LDAP extends BackendUtility implements \OCP\GroupInterface, IGroupLD
$groups = $this->access->fetchListOfGroups($filter, $groups = $this->access->fetchListOfGroups($filter,
[strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']); [strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']);
if (is_array($groups)) { if (is_array($groups)) {
$fetcher = function ($dn, &$seen) { $fetcher = function ($dn) use (&$seen) {
if (is_array($dn) && isset($dn['dn'][0])) { if (is_array($dn) && isset($dn['dn'][0])) {
$dn = $dn['dn'][0]; $dn = $dn['dn'][0];
} }
return $this->getGroupsByMember($dn, $seen); return $this->getGroupsByMember($dn, $seen);
}; };
$allGroups = $this->walkNestedGroups($dn, $fetcher, $groups); $allGroups = $this->walkNestedGroups($dn, $fetcher, $groups, $seen);
} }
$visibleGroups = $this->filterValidGroups($allGroups); $visibleGroups = $this->filterValidGroups($allGroups);
return array_intersect_key($allGroups, $visibleGroups); return array_intersect_key($allGroups, $visibleGroups);