From c29f05762e3d9de6c9d26f2216904a54e960fd09 Mon Sep 17 00:00:00 2001 From: Lars Gebhardt-Kusche Date: Mon, 15 Jun 2026 01:08:54 +0200 Subject: [PATCH] ldap test --- public/admin/ldap-test/index.php | 174 +++++++++---------------------- 1 file changed, 51 insertions(+), 123 deletions(-) diff --git a/public/admin/ldap-test/index.php b/public/admin/ldap-test/index.php index 9ac3f143..185f8692 100644 --- a/public/admin/ldap-test/index.php +++ b/public/admin/ldap-test/index.php @@ -6,95 +6,57 @@ require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php'; use App\ConfigLoader; use App\LdapProvisioner; -use App\RegistrationAccess; - -session_start(); $projectRoot = dirname(__DIR__, 3); $config = ConfigLoader::load($projectRoot, 'registration'); -$access = new RegistrationAccess($config); - -if (!$access->canManage()) { - http_response_code(403); - echo 'Kein Zugriff auf LDAP-Test.'; - exit; -} - $ldap = new LdapProvisioner($config); -$csrfToken = (string) ($_SESSION['ldap_test_token'] ?? ''); - -if ($csrfToken === '') { - $csrfToken = bin2hex(random_bytes(16)); - $_SESSION['ldap_test_token'] = $csrfToken; -} $serviceResult = $ldap->testServiceBind(); $messages = []; $errors = []; -$loginForm = ['username' => '', 'password' => '']; -$passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => '']; +$form = ['username' => '', 'password' => '', 'new_password' => '']; if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $postedToken = (string) ($_POST['csrf_token'] ?? ''); + $action = (string) ($_POST['action'] ?? ''); + $form['username'] = trim((string) ($_POST['username'] ?? '')); + $form['password'] = (string) ($_POST['password'] ?? ''); + $form['new_password'] = (string) ($_POST['new_password'] ?? ''); - if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) { - $errors[] = 'Die Formularprüfung ist fehlgeschlagen.'; - } else { - $action = (string) ($_POST['action'] ?? ''); + if ($form['username'] === '') { + $errors[] = 'Benutzername ist erforderlich.'; + } + if ($form['password'] === '') { + $errors[] = 'Passwort ist erforderlich.'; + } + + if ($action === 'change-password' && strlen($form['new_password']) < 12) { + $errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.'; + } + + if ($errors === []) { if ($action === 'test-login') { - $loginForm['username'] = trim((string) ($_POST['username'] ?? '')); - $loginForm['password'] = (string) ($_POST['password'] ?? ''); + $result = $ldap->testUserCredentials($form['username'], $form['password']); - if ($loginForm['username'] === '' || $loginForm['password'] === '') { - $errors[] = 'Für den Login-Test sind Benutzername und Passwort erforderlich.'; + if ($result['success'] ?? false) { + $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? ''); } else { - $result = $ldap->testUserCredentials($loginForm['username'], $loginForm['password']); + $errors[] = (string) ($result['message'] ?? 'LDAP-Login fehlgeschlagen.'); + } + } elseif ($action === 'change-password') { + $loginCheck = $ldap->testUserCredentials($form['username'], $form['password']); + + if (!(bool) ($loginCheck['success'] ?? false)) { + $errors[] = 'Der Login mit aktuellem Passwort ist fehlgeschlagen: ' . (string) ($loginCheck['message'] ?? ''); + } else { + $result = $ldap->updateUserPassword($form['username'], $form['new_password']); if ($result['success'] ?? false) { $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? ''); + $form['password'] = ''; + $form['new_password'] = ''; } else { - $errors[] = (string) ($result['message'] ?? 'LDAP-Login fehlgeschlagen.'); - } - } - } - - if ($action === 'change-password') { - $passwordForm['username'] = trim((string) ($_POST['username'] ?? '')); - $passwordForm['current_password'] = (string) ($_POST['current_password'] ?? ''); - $passwordForm['new_password'] = (string) ($_POST['new_password'] ?? ''); - $passwordForm['new_password_confirm'] = (string) ($_POST['new_password_confirm'] ?? ''); - - if ($passwordForm['username'] === '') { - $errors[] = 'Für die Passwortänderung ist ein Benutzername erforderlich.'; - } - - if ($passwordForm['current_password'] === '') { - $errors[] = 'Bitte das aktuelle Passwort angeben, damit der Login vorab geprüft werden kann.'; - } - - if (strlen($passwordForm['new_password']) < 12) { - $errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.'; - } - - if ($passwordForm['new_password'] !== $passwordForm['new_password_confirm']) { - $errors[] = 'Die neuen Passwörter stimmen nicht überein.'; - } - - if ($errors === []) { - $loginCheck = $ldap->testUserCredentials($passwordForm['username'], $passwordForm['current_password']); - - if (!(bool) ($loginCheck['success'] ?? false)) { - $errors[] = 'Der Vorab-Login mit aktuellem Passwort ist fehlgeschlagen: ' . (string) ($loginCheck['message'] ?? ''); - } else { - $result = $ldap->updateUserPassword($passwordForm['username'], $passwordForm['new_password']); - - if ($result['success'] ?? false) { - $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? ''); - $passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => '']; - } else { - $errors[] = (string) ($result['message'] ?? 'Passwortänderung fehlgeschlagen.'); - } + $errors[] = (string) ($result['message'] ?? 'Passwortänderung fehlgeschlagen.'); } } } @@ -114,7 +76,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {

LDAP-Test

- +
@@ -144,61 +106,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-
-
-

Login testen

- -
- -
-

Passwort ändern

- -
-
+
+ + +
+