From 100d0f77fedc6fab2dc6a16eaab45e6f5c7708ce Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 7 Apr 2016 10:08:47 -0400 Subject: [PATCH] Teach get_user_privileges how to retrieve groups from LDAP/RADIUS, and have getUserEntry fall back to a format that will allow it to function. Net result is that now userHasPrivilege() will respect remote groups as well as local groups, which fixes #6088 --- src/etc/inc/auth.inc | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc index 1cac5665f3..d8dd709cee 100644 --- a/src/etc/inc/auth.inc +++ b/src/etc/inc/auth.inc @@ -271,8 +271,14 @@ function index_users() { function & getUserEntry($name) { global $debug, $config, $userindex; + $authcfg = auth_get_authserver($config['system']['webgui']['authmode']); + if (isset($userindex[$name])) { return $config['system']['user'][$userindex[$name]]; + } elseif ($authcfg['type'] != "Local Database") { + $user = array(); + $user['name'] = $name; + return $user; } } @@ -312,13 +318,25 @@ function & getGroupEntryByGID($gid) { } function get_user_privileges(& $user) { + global $config; + + $authcfg = auth_get_authserver($config['system']['webgui']['authmode']); + $names = array(); $privs = $user['priv']; if (!is_array($privs)) { $privs = array(); } - $names = local_user_get_groups($user, true); + if ($authcfg['type'] == "ldap") { + $names = @ldap_get_groups($user['name'], $authcfg); + } elseif ($authcfg['type'] == "radius") { + $names = @radius_get_groups($_SESSION['user_radius_attributes']); + } + + if (empty($names)) { + $names = local_user_get_groups($user, true); + } foreach ($names as $name) { $group = getGroupEntry($name);