PHP ldap_escape函数代码示例

 /**
  * Escape strings for safe use in an LDAP filter or DN
  *
  * @see RFC2254 define how string search filters must be represented
  * @see For PHP >= 5.6.0, ldap_escape() is a core function
  *
  * @author Chris Wright
  * @see https://github.com/DaveRandom/LDAPi/blob/master/src/global_functions.php
  *
  * @return String
  */
 private function escape($value, $ignore = '', $flags = 0)
 {
     if (function_exists('ldap_escape')) {
         return ldap_escape($value, $ignore, $flags);
     }
     $value = (string) $value;
     $ignore = (string) $ignore;
     $flags = (int) $flags;
     if ($value === '') {
         return '';
     }
     $char_list = array();
     if ($flags & self::LDAP_ESCAPE_FILTER) {
         $char_list = array("\\", "*", "(", ")", "");
     }
     if ($flags & self::LDAP_ESCAPE_DN) {
         $char_list = array_merge($char_list, array("\\", ",", "=", "+", "<", ">", ";", "\"", "#"));
     }
     if (!$char_list) {
         for ($i = 0; $i < 256; $i++) {
             $char_list[] = chr($i);
         }
     }
     $char_list = array_flip($char_list);
     for ($i = 0; isset($ignore[$i]); $i++) {
         unset($char_list[$ignore[$i]]);
     }
     foreach ($char_list as $k => &$v) {
         $v = sprintf('\\%02x', ord($k));
     }
     return strtr($value, $char_list);
 }

 public function createUser($fn, $ln, $mn, $uname, $pwd, $groups, $phType, $ph, $domain)
 {
     $ldapObj = new Lucid_LDAP($this->configFile);
     // Use sAMAccountName in commonName
     $newEntry = array('givenName' => $fn, 'sn' => $ln, 'cn' => $uname, 'name' => "{$fn} {$ln}", 'displayName' => "{$fn} {$ln}", 'objectClass' => array("top", "person", "organizationalPerson", "user"), 'objectCategory' => "CN=Person,CN=Schema,CN=Configuration," . $ldapObj->basedn, 'sAMAccountName' => $uname, 'mail' => "{$uname}@{$domain}", 'userAccountControl' => 512, 'unicodePwd' => adifyPw($pwd));
     if (!empty($mn)) {
         $newEntry['middleName'] = $mn;
     }
     if ($phType == "home") {
         $newEntry['homePhone'] = $ph;
     } else {
         if ($phType == "mobile") {
             $newEntry['mobile'] = $ph;
         }
     }
     // The DN for the new user
     $dn = ldap_escape("cn={$uname},") . $ldapObj->createUserDn;
     $ldapObj->bind($this->username, $this->password);
     $status = $ldapObj->addEntry($dn, $newEntry);
     if (!empty($groups)) {
         $this->addUserToGroups($ldapObj, $dn, $groups);
     }
     $this->loggerObj->log("ADMIN::info::{$this->username} has successfully created User {$uname} successfully");
     $ldapObj->destroy();
     return $status;
 }

 /**
  * Returns an escaped string for use in an LDAP filter.
  *
  * @param string $value
  * @param string $ignore
  * @param $flags
  *
  * @return string
  */
 public static function escape($value, $ignore = '', $flags = 0)
 {
     if (!static::isEscapingSupported()) {
         return static::escapeManual($value, $ignore, $flags);
     }
     return ldap_escape($value, $ignore, $flags);
 }

 /**
  * {@inheritdoc}
  */
 public function escape($subject, $ignore = '', $flags = 0)
 {
     $value = ldap_escape($subject, $ignore, $flags);
     // Per RFC 4514, leading/trailing spaces should be encoded in DNs, as well as carriage returns.
     if ((int) $flags & LDAP_ESCAPE_DN) {
         if (!empty($value) && $value[0] === ' ') {
             $value = '\\20' . substr($value, 1);
         }
         if (!empty($value) && $value[strlen($value) - 1] === ' ') {
             $value = substr($value, 0, -1) . '\\20';
         }
         $value = str_replace("\r", '\\0d', $value);
     }
     return $value;
 }

 public function searchUser($username, $attr)
 {
     if (!$this->conn) {
         throw new ADNotBoundException();
     }
     $eUserName = ldap_escape($username);
     $entries = ldap_search($this->conn, $this->searchUserDn, "(sAMAccountName={$eUserName})", $attr);
     $count = ldap_count_entries($this->conn, $entries);
     $this->logger->log("Lucid_LDAP::info::LDAP Search Complete for '{$eUserName}', found {$count} entries");
     if ($count > 0) {
         $entry = ldap_first_entry($this->conn, $entries);
         $dn = ldap_get_dn($this->conn, $entry);
         return array($entry, $dn);
     } else {
         throw new EntryNotFoundException($username);
     }
 }

 /**
  * Escape any special characters for LDAP to their hexadecimal representation.
  *
  * @param mixed $value The value to escape.
  * @param null|string $ignore The characters to ignore.
  * @param null|int $flags The context for the escaped string. LDAP_ESCAPE_FILTER or LDAP_ESCAPE_DN.
  * @return string The escaped value.
  */
 public static function escapeValue($value, $ignore = null, $flags = null)
 {
     // If this is a hexadecimal escaped string, then do not escape it.
     $value = preg_match('/^(\\\\[0-9a-fA-F]{2})+$/', (string) $value) ? $value : ldap_escape($value, $ignore, $flags);
     // Per RFC 4514, leading/trailing spaces should be encoded in DNs, as well as carriage returns.
     if ((int) $flags & LDAP_ESCAPE_DN) {
         if (!empty($value) && $value[0] === ' ') {
             $value = '\\20' . substr($value, 1);
         }
         if (!empty($value) && $value[strlen($value) - 1] === ' ') {
             $value = substr($value, 0, -1) . '\\20';
         }
         // Only carriage returns seem to be valid, not line feeds (per testing of AD anyway).
         $value = str_replace("\r", '\\0d', $value);
     }
     return $value;
 }

function myldap_search($ds, $dn, $filter)
{
    $dn = ldap_escape($dn);
    //$filter = ldap_escape($filter);
    $sr = ldap_search($ds, $dn, $filter);
    $info = ldap_get_entries($ds, $sr);
    $data = array();
    $data["count"] = $info["count"];
    for ($i = 0; $i < $info["count"]; $i++) {
        $entry = $info[$i];
        $data[$i] = array();
        $data[$i]["cn"] = $entry["cn"][0];
        $data[$i]["sn"] = $entry["sn"][0];
        $data[$i]["telephonenumber"] = $entry["telephonenumber"][0];
        $data[$i]["postalcode"] = $entry["postalcode"][0];
        $data[$i]["userpassword"] = $entry["userpassword"][0];
    }
    return $data;
}

 /**
  * Validate a user against the given credentials.
  *
  * @param  \Illuminate\Contracts\Auth\Authenticatable  $user
  * @param  array  $credentials
  * @return bool
  */
 public function validateCredentials(UserContract $user, array $credentials)
 {
     $email = $credentials['email'];
     $password = $credentials['password'];
     $ldap_conn = ldap_connect($this->ldapConfig['host'], $this->ldapConfig['port']);
     $ldap_bind = ldap_bind($ldap_conn, $this->ldapConfig['user'], $this->ldapConfig['password']);
     try {
         // Find By Email
         $escEmail = ldap_escape($email, '', LDAP_ESCAPE_FILTER);
         $filter = "(&(uid=*)(|(mail=" . $escEmail . ")" . "(gosaMailAlternateAddress=" . $escEmail . ")))";
         $sr = ldap_search($ldap_conn, $this->ldapConfig['base'], $filter, []);
         if (!$sr) {
             return false;
         }
         $conn = ldap_connect($this->ldapConfig['host'], $this->ldapConfig['port']);
         $entry = ldap_first_entry($ldap_conn, $sr);
         while ($entry) {
             $dn = ldap_get_dn($ldap_conn, $entry);
             // Check Credentials
             // remove warnings for incorrect passwords
             $level = error_reporting();
             error_reporting($level & ~E_WARNING);
             try {
                 $bind = ldap_bind($conn, $dn, $password);
                 if ($bind) {
                     // successful
                     ldap_unbind($conn);
                     return true;
                 }
             } finally {
                 // restore warnings
                 error_reporting($level);
             }
             $entry = ldap_next_entry($ldap_conn, $entry);
         }
     } finally {
         ldap_unbind($ldap_conn);
     }
     return false;
 }

 /**
  * Returns user by uid
  *
  * @param string $username
  * @param int $configId
  * @return array|boolean
  */
 public function getUserByUsernameField($username, $configId = 0)
 {
     $ldapConnections = $this->getLDAPConnectionsByConfigId($configId);
     $user = false;
     foreach ($ldapConnections as $ldapConnection) {
         try {
             $filter = $this->getFeUsersFilter($ldapConnection, ldap_escape($username));
             $entry = $ldapConnection->search($ldapConnection->getDN(), $filter)->getFirstEntry();
         } catch (LDAPException $e) {
             continue;
         }
         if (!empty($entry)) {
             foreach ($entry->getAttributes() as $attribute) {
                 $attribute = strtolower($attribute);
                 $user[$attribute] = $entry->getValues($attribute);
             }
             $user['dn'] = $entry->getDN();
             $user['configId'] = $ldapConnection->getConfigUid();
         }
     }
     return $user;
 }

//.........这里部分代码省略.........
                                ?>
		<p><a href="?sta=studentska/osobe&osoba=<?php 
                                echo $osoba;
                                ?>
&akcija=izbori&broj_izbora=-1">Kliknite ovdje za unos novog izbora</a></p>
		<?php 
                            }
                        } else {
                            if ($akcija == "edit") {
                                $pretraga = my_escape($_REQUEST['search']);
                                $ofset = my_escape($_REQUEST['offset']);
                                ?>
<a href="?sta=studentska/osobe&search=<?php 
                                echo $pretraga;
                                ?>
&offset=<?php 
                                echo $ofset;
                                ?>
">Nazad na rezultate pretrage</a><br/><br/><?php 
                                // Prvo odredjujemo aktuelnu akademsku godinu - ovaj upit se dosta koristi kasnije
                                $q210 = myquery("select id,naziv from akademska_godina where aktuelna=1 order by id desc");
                                if (mysql_num_rows($q210) < 1) {
                                    // Nijedna godina nije aktuelna - ali mora postojati barem jedna u bazi
                                    $q210 = myquery("select id,naziv from akademska_godina order by id desc");
                                }
                                $id_ak_god = mysql_result($q210, 0, 0);
                                $naziv_ak_god = mysql_result($q210, 0, 1);
                                // Posto se id_ak_god moze promijeniti.... CLEANUP!!!
                                $orig_iag = $id_ak_god;
                                // ======= SUBMIT AKCIJE =========
                                // Promjena korisničkog pristupa i pristupnih podataka
                                if ($_POST['subakcija'] == "auth" && check_csrf_token()) {
                                    $login = my_escape(trim($_REQUEST['login']));
                                    $login_ldap = ldap_escape(trim($_REQUEST['login']));
                                    $stari_login = my_escape($_REQUEST['stari_login']);
                                    $password = my_escape($_REQUEST['password']);
                                    $aktivan = intval($_REQUEST['aktivan']);
                                    if ($login == "") {
                                        niceerror("Ne možete postaviti prazan login");
                                    } else {
                                        if ($stari_login == "") {
                                            // Provjeravamo LDAP?
                                            if ($conf_system_auth == "ldap") {
                                                do {
                                                    // Simuliramo GOTO...
                                                    // Tražimo ovaj login na LDAPu...
                                                    $ds = ldap_connect($conf_ldap_server);
                                                    ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
                                                    if (!ldap_bind($ds)) {
                                                        zamgerlog("Ne mogu se spojiti na LDAP server", 3);
                                                        // 3 - greska
                                                        zamgerlog2("ne mogu se spojiti na LDAP server");
                                                        niceerror("Ne mogu se spojiti na LDAP server - nastavljam dalje bez provjere");
                                                        break;
                                                    }
                                                    $sr = ldap_search($ds, "", "uid={$login_ldap}", array());
                                                    if (!$sr) {
                                                        zamgerlog("ldap_search() nije uspio.", 3);
                                                        zamgerlog2("ldap_search() nije uspio.");
                                                        niceerror("ldap_search() nije uspio - nastavljam dalje bez provjere");
                                                        break;
                                                    }
                                                    $results = ldap_get_entries($ds, $sr);
                                                    if ($results['count'] > 0) {
                                                        nicemessage("Login '{$login}' pronađen na LDAP serveru");
                                                        break;

 public function mailUsed($mail)
 {
     $resource = ldap_search($this->ldapconn, $this->ldapbasedn, "otherMailbox=" . ldap_escape($mail, true));
     if ($resource) {
         $entry = ldap_first_entry($this->ldapconn, $resource);
         if (@ldap_get_dn($this->ldapconn, $entry)) {
             return true;
         }
     }
     return false;
 }

function login($pass)
{
    // RETURN VALUE:
    //  0 - OK
    //  1 - unknown user
    //  2 - password doesn't match
    // VARIABLES:
    //  $admin - user has admin privileges (from auth table)
    //  $userid - whatever is used internally (aside from login)
    global $userid, $admin, $login, $conf_system_auth, $conf_ldap_server, $conf_ldap_domain, $posljednji_pristup;
    $q1 = myquery("select id, password, admin, UNIX_TIMESTAMP(posljednji_pristup) from auth where login='{$login}' and aktivan=1");
    if (mysql_num_rows($q1) <= 0) {
        return 1;
    }
    function is_alias($results)
    {
        foreach ($results as $k1 => $v1) {
            if ($k1 === "objectclass") {
                foreach ($v1 as $k2 => $v2) {
                    if ($v2 === "zimbraAlias") {
                        return true;
                    }
                }
            }
        }
        return false;
    }
    if ($conf_system_auth == "ldap") {
        $ds = ldap_connect($conf_ldap_server);
        ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
        if ($ds) {
            if (ldap_bind($ds)) {
                $i = 0;
                // Probavamo UID
                $login = ldap_escape($login);
                $sr = ldap_search($ds, "", "uid={$login}", array());
                if (!$sr) {
                    niceerror("ldap_search() failed.");
                    exit;
                }
                $results = ldap_get_entries($ds, $sr);
                // Ako ldap_get_entries vrati false, pretpostavićemo da nema rezultata
                // To se dešava rijetko ali se dešava i nije mi jasno zašto
                // Ovaj upit ce vratiti i aliase, koje moramo profiltrirati
                while ($results && is_alias($results[$i]) && $i < $results['count']) {
                    $i++;
                }
                // Probavamo email adresu
                if (!$results || $i == $results['count']) {
                    $sr = ldap_search($ds, "", "mail={$login}", array());
                    if (!$sr) {
                        niceerror("ldap_search() 1 failed.");
                        exit;
                    }
                    $results = ldap_get_entries($ds, $sr);
                    $i = 0;
                    while ($results && is_alias($results[$i]) && $i < $results['count']) {
                        $i++;
                    }
                }
                // Probavamo email adresu + domena
                if (!$results || $i == $results['count']) {
                    $sr = ldap_search($ds, "", "mail={$login}{$conf_ldap_domain}", array());
                    if (!$sr) {
                        niceerror("ldap_search() 2 failed.");
                        exit;
                    }
                    $results = ldap_get_entries($ds, $sr);
                    $i = 0;
                    while ($results && is_alias($results[$i]) && $i < $results['count']) {
                        $i++;
                    }
                }
                if (!$results || $i == $results['count']) {
                    return 1;
                }
                $dn = $results[$i]['dn'];
                if (!@ldap_bind($ds, $dn, $pass)) {
                    // ldap_bind generiše warning svaki put kad je pogrešna šifra :(
                    return 2;
                }
                // ldap_bind succeeded, user is authenticated
            } else {
                niceerror("LDAP anonymous bind failed.");
                exit;
            }
        } else {
            niceerror("Can't contact LDAP server.");
            exit;
        }
    } else {
        if ($conf_system_auth == "table") {
            if ($pass != mysql_result($q1, 0, 1)) {
                return 2;
            }
        }
    }
    $userid = mysql_result($q1, 0, 0);
    $admin = mysql_result($q1, 0, 2);
    $posljednji_pristup = mysql_result($q1, 0, 3);
//.........这里部分代码省略.........

 /**
  * Takes a generic representation of the group and adds the username provided to 
  * limit returned items to those matching the username
  *
  * This is useful for the is_username_member_of_group() method, which gets the representation, then adds the user limit with this method.
  *
  * @param string $user_netID The username we're going to test
  * @param array $rep group representation
  * @return string
  * @access private
  */
 function add_netid_check_to_representation($user_netID, $rep)
 {
     $user_netID = ldap_escape($user_netID);
     foreach ($rep as $filter_key => $filter_info) {
         if (!empty($filter_info['filter'])) {
             $rep[$filter_key]['filter'] = '(&(ds_username=' . $user_netID . ')' . $filter_info['filter'] . ')';
         }
         if (!empty($filter_info['group_filter'])) {
             if ($this->group->get_value('ldap_group_member_fields')) {
                 $fields = explode(',', $this->group->get_value('ldap_group_member_fields'));
                 $member_chunk = '(|';
                 foreach ($fields as $field) {
                     $field = trim($field);
                     if (!empty($field)) {
                         $member_chunk .= '(' . $field . '=' . $user_netID . ')';
                     }
                 }
                 $member_chunk .= ')';
             } else {
                 $member_chunk = '(ds_member=' . $user_netID . ')';
             }
             $rep[$filter_key]['group_filter'] = '(&' . $member_chunk . $filter_info['group_filter'] . ')';
         }
     }
     return $rep;
 }

 /**
  * @link http://php.net/manual/en/function.ldap-escape.php
  * @param $subject
  * @param null $ignore
  * @param null $escape
  * @return string
  */
 public function escape($subject, $ignore = null, $escape = null)
 {
     return ldap_escape($subject, $ignore, $escape);
 }

 static function escape_filter($string)
 {
     if (function_exists('ldap_escape')) {
         return ldap_escape($string, '', LDAP_ESCAPE_FILTER);
     } else {
         $map = array('\\' => '\\5c', '*' => '\\2a', '(' => '\\28', ')' => '\\29', "" => '\\00');
         return str_replace(array_keys($map), $map, $string);
     }
 }