LDAPAccountManager/lam/lib/modules/posixGroup.inc

<?php
/*
$Id$

This code is part of LDAP Account Manager (http://www.sourceforge.net/projects/lam)
Copyright (C) 2003  Tilo Lutz

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/


class posixGroup extends baseModule {

	// Variables
	// Use a unix password?
	var $userPassword_nopassword;
	// Use invalid password, '*', e.g. * for services
	var $userPassword_invalid;
	// Lock password
	var $userPassword_lock;
	// change gids of users and hosts?
	var $changegids;

	/**
	* Creates a new posixGroup object.
	*
	* @param string $scope account type
	*/
	function posixGroup($scope) {
		// call parent constructor
		parent::baseModule($scope);
	}


	/**
	* In this function the LDAP account is built up.
	*
	* @param array $rawAccounts list of hash arrays (name => value) from user input
	* @param array $partialAccounts list of hash arrays (name => value) which are later added to LDAP
	* @param array $ids list of IDs for column position (e.g. "posixAccount_uid" => 5)
	* @return array list of error messages if any
	*/
	function build_uploadAccounts($rawAccounts, $ids, &$partialAccounts) {
		$errors = array();
		for ($i = 0; $i < sizeof($rawAccounts); $i++) {
			if (!in_array("posixGroup", $partialAccounts[$i]['objectClass'])) $partialAccounts[$i]['objectClass'][] = "posixGroup";
			// group name
			if (get_preg($rawAccounts[$i][$ids['posixGroup_cn']], 'groupname')) {
				$partialAccounts[$i]['cn'] = $rawAccounts[$i][$ids['posixGroup_cn']];
			}
			else {
				$errMsg = $this->messages['cn'][3];
				array_push($errMsg, array($i));
				$errors[] = $errMsg;
			}
			// GID
			if ($rawAccounts[$i][$ids['posixGroup_gid']] == "") {
				// TODO autoGID
				$partialAccounts[$i]['gidNumber'] = 42;
			}
			elseif (get_preg($rawAccounts[$i][$ids['posixGroup_gid']], 'digit')) {
				$partialAccounts[$i]['gidNumber'] = $rawAccounts[$i][$ids['posixGroup_gid']];
			}
			else {
				$errMsg = $this->messages['gidNumber'][8];
				array_push($errMsg, array($i));
				$errors[] = $errMsg;
			}
			// description (UTF-8, no regex check needed)
			if ($rawAccounts[$i][$ids['posixGroup_description']] == "") {
				$partialAccounts[$i]['description'] = $partialAccounts[$i]['cn'];
			}
			else {
				$partialAccounts[$i]['description'] = $rawAccounts[$i][$ids['posixGroup_description']];
			}
			// group members
			if ($rawAccounts[$i][$ids['posixGroup_members']] != "") {
				if (get_preg($rawAccounts[$i][$ids['posixGroup_members']], 'usernameList')) {
					$partialAccounts[$i]['memberUid'] = explode(",", $rawAccounts[$i][$ids['posixGroup_members']]);
				}
				else {
					$errMsg = $this->messages['memberUID'][0];
					array_push($errMsg, $i);
					$errors[] =$errMsg;
				}
			}
			// password
			if ($rawAccounts[$i][$ids['posixGroup_password']] != "") {
				if (get_preg($rawAccounts[$i][$ids['posixGroup_password']], 'password')) {
					$partialAccounts[$i]['userPassword'] = pwd_hash($rawAccounts[$i][$ids['posixGroup_password']], true, $this->moduleSettings['posixAccount_pwdHash'][0]);
				}
				else {
					$errors[] = $this->messages['userPassword'][1];
				}
			}
		}
		return $errors;
	}


	function delete_attributes($post) {
		if ($_SESSION['cache']->in_cache($this->attributes['gidNumber'][0], 'gidNumber', 'user'))
		$return[$_SESSION[$this->base]->dn]['errors'][] = array ('ERROR', _('Primary groupmembers'), _('There are still primary members in group.'));
		return $return;
	}


	/* This function will create the html-page
	* to show a page with all attributes.
	* It will output a complete html-table
	*/
	function display_html_attributes($post) {
		if (!$profile) {
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _("Groupname").'*' ),
			1 => array ( 'kind' => 'input', 'name' => 'cn', 'type' => 'text', 'size' => '20', 'maxlength' => '20', 'value' => $this->attributes['cn'][0]),
			2 => array ('kind' => 'help', 'value' => 'cn'));
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('GID number').'*' ),
			1 => array ( 'kind' => 'input', 'name' => 'gidNumber', 'type' => 'text', 'size' => '6', 'maxlength' => '6', 'value' => $this->attributes['gidNumber'][0]),
			2 => array ('kind' => 'help', 'value' => 'gidNumber'));
		}
		$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Description') ),
		1 => array ( 'kind' => 'input', 'name' => 'description', 'type' => 'text', 'size' => '30', 'maxlength' => '255', 'value' => $this->attributes['description'][0]),
		2 => array ('kind' => 'help', 'value' => 'description'));
		if (!$profile) {
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _("Group members").'*' ),
			1 => array ( 'kind' => 'input', 'name' => 'adduser', 'type' => 'submit', 'value' => _('Edit groups')),
			2 => array ('kind' => 'help', 'value' => 'adduser'));
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Password') ),
			1 => array ( 'kind' => 'input', 'name' => 'userPassword', 'type' => 'password', 'size' => '20', 'maxlength' => '255', 'value' => $this->userPassword()),
			2 => array ( 'kind' => 'input', 'name' => 'genpass', 'type' => 'submit', 'value' => _('Generate password')));
				if ($post['userPassword2']!='') $password2 = $post['userPassword2'];
				else $password2 = $this->userPassword();
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Repeat password') ),
			1 => array ( 'kind' => 'input', 'name' => 'userPassword2', 'type' => 'password', 'size' => '20', 'maxlength' => '255', 'value' => $password2),
			2 => array ('kind' => 'help', 'value' => 'userPassword'));
		}
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Set no password') ),
			1 => array ( 'kind' => 'input', 'name' => 'userPassword_nopassword', 'type' => 'checkbox', 'checked' => $this->userPassword_nopassword),
			2 => array ('kind' => 'help', 'value' => 'userPassword_nopassword'));
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Invalid password') ),
			1 => array ( 'kind' => 'input', 'name' => 'userPassword_invalid', 'type' => 'checkbox', 'checked' => $this->userPassword_invalid),
			2 => array ('kind' => 'help', 'value' => 'userPassword_invalid'));
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Lock password') ),
			1 => array ( 'kind' => 'input', 'name' => 'userPassword_lock', 'type' => 'checkbox', 'checked' => $this->userPassword_lock),
			2 => array ('kind' => 'help', 'value' => 'userPassword_lock'));
		if ($this->attributes['gidNumber'][0]!=$this->orig['gidNumber'][0] && $this->orig['gidNumber'][0]!='' && !$profile) {
			$return[] = array ( 0 => array ( 'kind' => 'text', 'text' => _('Change GID number of users and hosts') ),
			1 => array ( 'kind' => 'input', 'name' => 'changegids', 'type' => 'checkbox', 'checked' => $this->changegids, 'value' => true),
			2 => array ('kind' => 'help', 'value' => 'changegids'));
		}
		return $return;
	}


	function display_html_delete($post) {
		// Get list of primary groupmembers.
		return 0;
	}


	function display_html_user($post, $profile=false) {
		// load list with all groups
		$dn_users = $_SESSION['cache']->get_cache('uid', 'posixAccount', 'user');
		if (is_array($dn_users)) {
			foreach ($dn_users as $user) $users[] = $user[0];
			// sort groups
			sort($users, SORT_STRING);
			// remove groups the user is member of from grouplist
			$users = array_delete($this->attributes['memberUid'], $users);
			// Remove primary group from grouplist
			$users_dn = $_SESSION['cache']->get_cache('gidNumber', 'posixAccount', 'user');
			$DNs = array_keys($users_dn);
			for ($i=0; $i<count($DNs); $i++) {
				if ($users_dn[$DNs[$i]][0]==$this->attributes['gidNumber'][0]) {
					$thisuser = substr($DNs[$i], 4, strpos($DNs[$i], ",")-4);
					if (in_array($thisuser, $users)) {
						$users = @array_flip($users);
						unset($users[$thisuser]);
						$users = @array_flip($users);
					}
				}
			}
			// sort users
			sort($users);
		}
		$return[] = array ( 0 => array ( 'kind' => 'fieldset', 'legend' => _("Group members"), 'value' =>
		array ( 0 => array ( 0 => array ('kind' => 'fieldset', 'td' => array ('valign' => 'top'), 'legend' => _("Selected users"), 'value' =>
		array ( 0 => array ( 0 => array ( 'kind' => 'select', 'name' => 'removeusers[]', 'size' => '15', 'multiple', 'options' => $this->attributes['memberUid'])))),
		1 => array ( 'kind' => 'table', 'value' => array ( 0 => array ( 0 => array ( 'kind' => 'input', 'type' => 'submit', 'name' => 'addusers_button',
		'value' => '<=')), 1 => array ( 0 => array ( 'kind' => 'input', 'type' => 'submit', 'name' => 'removeusers_button', 'value' => '=>' )),
		2 => array ( 0 => array ( 'kind' => 'help', 'value' => 'adduser' )))),
		2 => array ('kind' => 'fieldset', 'td' => array ('valign' => 'top'), 'legend' => _("Available users"), 'value' =>
		array ( 0 => array ( 0 => array ( 'kind' => 'select', 'name' => 'addusers[]', 'size' => '15', 'multiple', 'options' => $users))))
		))));

		$return[] = array ( 0 => array ( 'kind' => 'input', 'name' => 'toattributes' ,'type' => 'submit', 'value' => _('Back') ),
		1 => array ( 'kind' => 'text'),
		2 => array ('kind' => 'text'));
		return $return;
	}


	/** This function returns all ldap attributes
	* which are part of posixGroup and returns
	* also their values.
	*/
	function get_attributes() {
		$return = $this->attributes;
		$return['userPassword'] = $this->userPassword();
		return $return;
	}

	
	/**
	* Returns meta data that is interpreted by parent class
	*
	* @return array array with meta data
	*/
	function get_metaData() {
		$return = array();
		// manages group accounts
		$return["account_types"] = array("group");
		if ($this->get_scope() == "group") {
			// this is a base module
			$return["is_base"] = true;
			// LDAP filter
			$return["ldap_filter"] = array('or' => "(objectClass=posixGroup)");
		}
		// alias name
		$return["alias"] = _('Unix');
		// RDN attribute
		$return["RDN"] = array("cn" => "normal");
		// module dependencies
		$return['dependencies'] = array('depends' => array(), 'conflicts' => array('inetOrgPerson', 'account', 'sambaDomain'));
		// configuration options
		$return['config_options']['group'] = array(
		array(
		0 => array('kind' => 'text', 'text' => '<b>' . _('Minimum GID number') . " *: </b>"),
		1 => array('kind' => 'input', 'name' => 'posixGroup_minGID', 'type' => 'text', 'size' => '10', 'maxlength' => '255'),
		2 => array('kind' => 'text', 'value' => '&nbsp;'),
		3 => array('kind' => 'text', 'text' => '<b>' . _('Maximum GID number') . " *: </b>"),
		4 => array('kind' => 'input', 'name' => 'posixGroup_maxGID', 'type' => 'text', 'size' => '10', 'maxlength' => '255'),
		5 => array('kind' => 'help', 'value' => 'minMaxGID'))
		);
		$return['config_options']['all'] = array(
		array(
		0 => array('kind' => 'text', 'text' => '<b>' . _("Password hash type") . ': &nbsp;</b>'),
		1 => array('kind' => 'select', 'name' => 'posixGroup_pwdHash', 'size' => '1',
		'options' => array("CRYPT", "SHA", "SSHA", "MD5", "SMD5", "PLAIN"), 'options_selected' => array('SSHA')),
		2 => array('kind' => 'text', 'value' => '&nbsp;'),
		3 => array('kind' => 'text', 'value' => '&nbsp;'),
		4 => array('kind' => 'text', 'value' => '&nbsp;'),
		5 => array('kind' => 'help', 'value' => 'pwdHash'))
		);
		// configuration descriptions
		$return['config_descriptions'] = array(
		'legend' => _("GID ranges for Unix groups"),
		'descriptions' => array(
		'posixGroup_minGID' => _("Minimum GID number for Unix groups"),
		'posixGroup_maxGID' => _("Maximum GID number for Unix groups"),
		'posixGroup_pwdHash' => _("Password hash type"),
		)
		);
		// configuration checks
		$return['config_checks']['group']['posixGroup_minGID'] = array (
			'type' => 'ext_preg',
			'regex' => 'digit',
			'required' => true,
			'required_message' => $this->messages['gidNumber'][5],
			'error_message' => $this->messages['gidNumber'][5]);
		$return['config_checks']['group']['posixGroup_maxGID'] = array (
			'type' => 'ext_preg',
			'regex' => 'digit',
			'required' => true,
			'required_message' => $this->messages['gidNumber'][6],
			'error_message' => $this->messages['gidNumber'][6]);
		$return['config_checks']['group']['cmpGID'] = array (
			'type' => 'int_greater',
			'cmp_name1' => 'posixGroup_maxGID',
			'cmp_name2' => 'posixGroup_minGID',
			'error_message' => $this->messages['gidNumber'][7]);
		// available PDF fields
		$return['PDF_fields'] = array(	'cn',
		'gidNumber',
		'memberUid',
		'description');
		// upload fields
		$return['upload_columns'] = array(
		array(
		'name' => 'posixGroup_cn',
		'description' => _('Group name'),
		'help' => 'cn',
		'example' => _('adminstrators'),
		'required' => true,
		'unique' => true
		),
		array(
		'name' => 'posixGroup_gid',
		'description' => _('GID number'),
		'help' => 'gidNumber',
		'example' => '2034'
		),
		array(
		'name' => 'posixGroup_description',
		'description' => _('Group description'),
		'help' => 'description',
		'example' => _('Administrators group')
		),
		array(
		'name' => 'posixGroup_members',
		'description' => _('Group members'),
		'help' => 'upload_members',
		'example' => _('user01,user02,user03')
		),
		array(
		'name' => 'posixGroup_password',
		'description' => _('Group password'),
		'help' => 'password',
		'example' => _('secret')
		)
		);
		// help Entries
		$return['help'] = array(
		'cn' =>	array(
			"ext" => "FALSE",
			"Headline" => _("Groupname"),
			"Text" => _("Group name of the group which should be created. Valid characters are: a-z,0-9, .-_. Lam does not allow a number as first character because groupadd also does not allow it. Lam does not allow capital letters A-Z because it can cause several problems. If groupname is already used groupname will be expanded with a number. The next free number will be used.")),
		'gidNumber'	=> array(
			"ext" => "FALSE",
			"Headline" => _("GID number"),
			"Text" => _("If empty GID number will be generated automaticly depending on your configuration settings.")),
		'description' => array(
			"ext" => "FALSE",
			"Headline" => _("Description"),
			"Text" => _("Group description. If left empty group name will be used.")),
		'members' => array(
			"ext" => "FALSE",
			"Headline" => _("Group members"),
			"Text" => _("Users also being member of the current group."). ' '. _("Can be left empty.")),
		'upload_members' => array(
			"ext" => "FALSE",
			"Headline" => _("Group members"),
			"Text" => _("Users also being member of the current group. Users are separated by semicolons.")),
		'password' => array(
			"ext" => "FALSE",
			"Headline" => _("Group password"),
			"Text" => _("Sets the group password.")),
		'userPassword_no' => array(
			"ext" => "FALSE",
			"Headline" => _("Use no password"),
			"Text" => _("If checked no password will be used.")),
		/*'userPassword_lock'	=>	*/
		'minMaxGID' => array(
			"ext" => "FALSE",
			"Headline" => _("GID number"),
			"Text" => _("These are the minimum and maximum numbers to use for group IDs when creating new group accounts. New group accounts will always get the highest number in use plus one.")),
		'pwdHash' => array(
			"ext" => "FALSE",
			"Headline" => _("Password hash type"),
			"Text" => _("LAM supports CRYPT, SHA, SSHA, MD5 and SMD5 to generate the hash value of passwords. SSHA and CRYPT are the most common but CRYPT does not support passwords greater than 8 letters. We do not recommend to use plain text passwords."))
		);

		return $return;
	}


	/*
	* (non-PHPDoc)
	* @see baseModule#get_pdfEntries
	*/
	function get_pdfEntries($account_type = "group") {
		return array(	'posixGroup_cn' => array('<block><key>' . _('Groupname') . '</key><value>' . $this->attributes['cn'][0] . '</value></block>'),
		'posixGroup_gidNumber' => array('<block><key>' . _('GID number') . '</key><value>' . $this->attributes['gidNumber'][0] . '</value></block>'),
		'posixGroup_memberUid' => array('<block><key>' . _('Group members') . '</key><value>' . $this->attributes['memberUid'][0] . '</value></block>'),
		'posixGroup_description' => array('<block><key>' . _('Description') . '</key><value>' . $this->attributes['description'][0] . '</value></block>'));
	}


	/** This functin will be called when the module will be loaded **/
	function init($base) {
		// call parent init
		parent::init($base);
		$this->changegids=false;
	}


	/* This function loads all attributes into the object
	* $attr is an array as it's retured from ldap_get_attributes
	*/
	function load_attributes($attr) {
		$this->load_ldap_attributes($attr);
		// Delete password. We don't want to show an encrypted password because it makes no sense
		$this->userPassword('');
		return 0;
	}


	/** this functin fills the error message array with messages
	**/
	function load_Messages() {
		$this->messages['userPassword'][0] = array('ERROR', _('Password'), _('Please enter the same password in both password-fields.'));
		$this->messages['userPassword'][1] = array('ERROR', _('Password'), _('Password contains invalid characters. Valid characters are: a-z, A-Z, 0-9 and #*,.;:_-+!$%&/|?{[()]}= !'));
		$this->messages['userPassword'][3] = array('ERROR', _('Password'), _('You cannot use this password options at the same time.'));
		$this->messages['gidNumber'][0] = array('INFO', _('GID number'), _('GID number has changed. Please select checkbox to change GID number of users and hosts.'));
		$this->messages['gidNumber'][2] = array('WARN', _('ID-Number'), _('It is possible that this ID-number is reused. This can cause several problems because files with old permissions might still exist. To avoid this warning set maxUID to a higher value.'));
		$this->messages['gidNumber'][3] = array('ERROR', _('ID-Number'), _('No free ID-Number!'));
		$this->messages['gidNumber'][4] = array('ERROR', _('ID-Number'), _('ID is already in use'));
		$this->messages['gidNumber'][5] = array('ERROR', _('Minimum GID number'), _('Minimum GID number is invalid or empty!'));
		$this->messages['gidNumber'][6] = array('ERROR', _('Maximum GID number'), _('Maximum GID number is invalid or empty!'));
		$this->messages['gidNumber'][7] = array('ERROR', _('Maximum GID number'), _('Maximum GID number must be greater than minimum GID number!'));
		$this->messages['gidNumber'][8] = array('ERROR', _('Account %s: posixGroup_gid'), _('GID number has to be a numeric value!'));
		$this->messages['cn'][0] = array('WARN', _('Groupname'), _('You are using a capital letters. This can cause problems because windows isn\'t case-sensitive.'));
		$this->messages['cn'][1] = array('WARN', _('Groupname'), _('Groupname in use. Selected next free groupname.'));
		$this->messages['cn'][2] = array('ERROR', _('Groupname'), _('Groupname contains invalid characters. Valid characters are: a-z, A-Z, 0-9 and .-_ !'));
		$this->messages['cn'][3] = array('ERROR', _('Account %s: posixGroup_cn'), _('Groupname contains invalid characters. Valid characters are: a-z, A-Z, 0-9 and .-_ !'));
		$this->messages['memberUID'][0] = array('ERROR', _('Account %s: posixGroup_members'), _("This value must be a list of user names separated by semicolons."));
		} 


	/* This functions return true
	* if all needed settings are done
	*/
	function module_complete() {
		if (!$this->module_ready()) return false;
		if ($this->attributes['cn'][0] == '') return false;
		if ($this->attributes['gidNumber'][0] == '') return false;
		return true;
	}


	function module_ready() {
		return true;
	}


	/* This function returns a list of all html-pages in module
	* This is usefull for mass upload and pdf-files
	* because lam can walk trough all pages itself and do some
	* error checkings
	*/
	function pages() {
		return array('attributes', 'user');
	}


	/* Write variables into object and do some regexp checks
	*/
	function proccess_attributes($post, $profile=false) {
		$this->attributes['description'][0] = $post['description'];

		If (!$profile) {
			if (($post['userPassword_lock'] && $post['userPassword_invalid']) || ($post['userPassword_nopassword'] && $post['userPassword_invalid'])) {
				// found invalid password parameter combination
				$errors['userPassword'][] = $this->messages['userPassword'][3];
			}
			else {
				if ($post['userPassword_nopassword']) {
					$this->userPassword_nopassword=true;
					$this->userPassword_invalid=false;
					$this->userPassword('');
					$post['userPassword2'] = '';
					if ($post['userPassword_lock'])
						$this->userPassword_lock=true;
					else $this->userPassword_lock=false;
				}
				else {
					$this->userPassword_nopassword=false;
					if ($post['userPassword_invalid']) {
						$this->userPassword_invalid=true;
						$this->userPassword_lock=false;
						$this->userPassword('');
						$post['userPassword2'] = '';
					}
					else {
						$this->userPassword_invalid=false;
						if ($post['genpass']) $this->userPassword(genpasswd());
						else {
							if ($post['userPassword'] != $post['userPassword2'])
								$errors['userPassword'][] = $this->messages['userPassword'][0];
							else $this->userPassword($post['userPassword']);
							if (!get_preg($this->userPassword(), 'password'))
								$errors['userPassword'][] = $this->messages['userPassword'][1];
						}
						if ($post['userPassword_lock']) $this->userPassword_lock=true;
						else $this->userPassword_lock=false;
					}
				}
			if ($post['changegids']) $this->changegids=true;
			else $this->changegids=false;
			if ($this->attributes['gidNumber'][0]!=$post['gidNumber'] || ($this->errors['gidNumber'][0]='ERROR')) {
				// Check if GID is valid. If none value was entered, the next useable value will be inserted
				// load min and may uidNumber
				$minID = intval($this->moduleSettings['posixGroup_minGID'][0]);
				$maxID = intval($this->moduleSettings['posixGroup_maxGID'][0]);
				$dn_gids = $_SESSION['cache']->get_cache('gidNumber', 'posixGroup', '*');
				// get_cache will return an array ( dn1 => array(uidnumber1), dn2 => array(uidnumber2), ... )
				if(is_array($dn_gids)) {
					foreach ($dn_gids as $gid) $gids[] = $gid[0];
					sort ($gids, SORT_NUMERIC);
				}
				$this->attributes['gidNumber'][0]=$post['gidNumber'];
					if ($this->attributes['gidNumber'][0]=='') {
					// No id-number given
					if ($this->orig['gidNumber'][0]=='') {
						// new account -> we have to find a free id-number
						if (count($gids)!=0) {
							// There are some uids
							// Store highest id-number
							$id = $gids[count($gids)-1];
							// Return minimum allowed id-number if all found id-numbers are too low
							if ($id < $minID) $this->attributes['gidNumber'][0] = $minID;
							// Return higesht used id-number + 1 if it's still in valid range
							if ($id < $maxID) $this->attributes['gidNumber'][0] = $id+1;
							/* If this function is still running we have to fid a free id-number between
							* the used id-numbers
							*/
							$i = intval($minID);
							while (in_array($i, $gids)) $i++;
							if ($i>$maxID)
							$errors['gidNumber'][] = $this->messages['gidNumber'][3];
							else {
								$this->attributes['gidNumber'][0] = $i;
								$errors['gidNumber'][] = $this->messages['gidNumber'][2];
							}
						}
						else $this->attributes['gidNumber'][0] = $minID;
						// return minimum allowed id-number if no id-numbers are found
					}
					else $this->attributes['gidNumber'][0] = $this->orig['gidNumber'][0];
					// old account -> return id-number which has been used
				}
				else {
					// Check manual ID
					// id-number is out of valid range
					if ( ($this->attributes['gidNumber'][0]!=$post['gidNumber']) && ($this->attributes['gidNumber'][0] < $minID || $this->attributes['gidNumber'][0] > $maxID)) $errors['gidNumber'][] = array('ERROR', _('ID-Number'), sprintf(_('Please enter a value between %s and %s!'), $minID, $maxID));
					// $uids is allways an array but not if no entries were found
					if (is_array($gids)) {
						// id-number is in use and account is a new account
						if ((in_array($this->attributes['gidNumber'][0], $gids)) && $this->orig['gidNumber'][0]=='') $errors['gidNumber'][] = array('ERROR', _('ID-Number'), _('ID is already in use'));
						// id-number is in use, account is existing account and id-number is not used by itself
						if ((in_array($this->attributes['gidNumber'][0], $gids)) && $this->orig['gidNumber'][0]!='' && ($this->orig['gidNumber'][0] != $this->attributes['gidNumber'][0]) ) {
							$errors['gidNumber'][] = $this->messages['gidNumber'][4];
							$this->attributes['gidNumber'][0] = $this->orig['gidNumber'][0];
						}
					}
				}
			}
			if ($this->attributes['cn'][0]!=$post['cn'] || ($this->errors['cn'][0]='ERROR')) {
				$this->attributes['cn'][0] = $post['cn'];
				if (($this->attributes['cn'][0] != $post['cn']) &&  ereg('[A-Z]$', $post['cn']))
				$errors['cn'][] = $this->messages['cn'][0];
				// Check if Groupname contains only valid characters
				if ( !get_preg($this->attributes['cn'][0],'groupname'))
				$errors['cn'][] = $this->messages['cn'][2];
				// Create automatic useraccount with number if original user already exists
				// Reset name to original name if new name is in use
				// Set username back to original name if new username is in use
				if ($_SESSION['cache']->in_cache($this->attributes['cn'][0],'cn', '*')!=false && ($this->orig['cn'][0]!='')) {
					$this->attributes['cn'][0] = $this->orig['cn'][0];
				}
				// Change gid to a new gid until a free gid is found
				else while ($_SESSION['cache']->in_cache($this->attributes['cn'][0], 'cn', '*')) {
					// get last character of username
					$lastchar = substr($this->attributes['cn'][0], strlen($this->attributes['cn'][0])-1, 1);
					// Last character is no number
					if ( !ereg('^([0-9])+$', $lastchar))
					/* Last character is no number. Therefore we only have to
					* add "2" to it.
					*/
					$this->attributes['cn'][0] = $this->attributes['cn'][0] . '2';
					else {
						/* Last character is a number -> we have to increase the number until we've
						* found a groupname with trailing number which is not in use.
						*
						* $i will show us were we have to split groupname so we get a part
						* with the groupname and a part with the trailing number
						*/
						$i=strlen($this->attributes['cn'][0])-1;
						$mark = false;
						// Set $i to the last character which is a number in $account_new->general_username
						while (!$mark) {
							if (ereg('^([0-9])+$',substr($this->attributes['cn'][0], $i, strlen($this->attributes['cn'][0])-$i))) $i--;
							else $mark=true;
						}
						// increase last number with one
						$firstchars = substr($this->attributes['cn'][0], 0, $i+1);
						$lastchars = substr($this->attributes['cn'][0], $i+1, strlen($this->attributes['cn'][0])-$i);
						// Put username together
						$this->attributes['cn'][0] = $firstchars . (intval($lastchars)+1);
					}
				}
				// Show warning if lam has changed username
				if ($this->attributes['cn'][0] != $post['cn']) {
					$errors['cn'][] = $this->messages['cn'][0];
				}
			// show info when gidnumber has changed
			if (($this->orig['gidNumber'][0]!=$this->attributes['gidNumber'][0]) && $this->orig['gidNumber'][0]!='' && $post['gidNumber']!=$this->attributes['gidNumber'][0])
			$errors['gidNumber'][] = $this->messages['gidNumber'][0];
			}
		}
		}
		// Return error-messages
		if (count($errors)!=0) {
			$this->errors = $errors;
			return $errors;
		}
		else $this->errors = array();
		// Go to additional group page when no error did ocour and button was pressed
		if ($post['adduser'])  return 'user';
		return 0;
	}


	/* Write variables into object and do some regexp checks
	*/
	function proccess_user($post, $profile=false) {
		do { // X-Or, only one if() can be true
		if (isset($post['addusers']) && isset($post['addusers_button'])) { // Add groups to list
		// Add new user
		$this->attributes['memberUid'] = @array_merge($this->attributes['memberUid'], $post['addusers']);
		// remove doubles
		$this->attributes['memberUid'] = @array_flip($this->attributes['memberUid']);
		array_unique($this->attributes['memberUid']);
		$this->attributes['memberUid'] = @array_flip($this->attributes['memberUid']);
		// sort groups
		sort($this->attributes['memberUid']);
		break;
		}
		if (isset($post['removeusers']) && isset($post['removeusers_button'])) { // remove groups from list
		$this->attributes['memberUid'] = array_delete($post['removeusers'], $this->attributes['memberUid']);
		break;
		}
		} while(0);
		if (isset($post['adduser_button']) || isset($post['removeuser_button'])) return 'user';
		if ($post['toattributes']) return 'attributes';
		return 0;
	}


	/* This function returns an array with 3 entries:
	* array( DN1 ('add' => array($attr), 'remove' => array($attr), 'modify' => array($attr)), DN2 .... )
	* DN is the DN to change. It may be possible to change several DNs,
	* e.g. create a new user and add him to some groups via attribute memberUid
	* add are attributes which have to be added to ldap entry
	* remove are attributes which have to be removed from ldap entry
	* modify are attributes which have to been modified in ldap entry
	*/
	function save_attributes() {
		$return = $_SESSION[$this->base]->save_module_attributes($this->attributes, $this->orig);

		// unset password when needed
		if (isset($return[$_SESSION[$this->base]->dn]['add']['userPassword']))
		unset($return[$_SESSION[$this->base]->dn]['add']['userPassword']);
		if (isset($return[$_SESSION[$this->base]->dn]['modify']['userPassword']))
		unset($return[$_SESSION[$this->base]->dn]['modify']['userPassword']);
		if (isset($return[$_SESSION[$this->base]->dn]['notchanged']['userPassword']))
		unset($return[$_SESSION[$this->base]->dn]['notchanged']['userPassword']);
		// Set unix password
		if (isset($this->orig['userPassword'][0])) {
			if ($this->userPassword_nopassword) // use no password
				$return[$_SESSION[$this->base]->dn]['modify']['userPassword'][0] = pwd_hash('', !$this->userPassword_lock, $this->moduleSettings['posixAccount_pwdHash'][0]);
			else if ($this->userPassword_invalid) // use '*' as password
				$return[$_SESSION[$this->base]->dn]['modify']['userPassword'][0] = '*';
			else if (($this->attributes['userPassword'][0] != $this->orig['userPassword'][0]) && $this->userPassword()!='') // set password if set
				$return[$_SESSION[$this->base]->dn]['modify']['userPassword'][0] = pwd_hash($this->userPassword(), !$this->userPassword_lock, $this->moduleSettings['posixAccount_pwdHash'][0]);
			else if ($this->userPassword_lock && (pwd_disable($this->orig['userPassword'][0]) != $this->orig['userPassword'][0])) // lock account if required
				$return[$_SESSION[$this->base]->dn]['modify']['userPassword'][0] = pwd_disable($this->orig['userPassword'][0]);
			else // password hasn't changed
				$return[$_SESSION[$this->base]->dn]['notchanged']['userPassword'][0] = $this->orig['userPassword'][0];
		}
		else {
			// New user or no old password set
			if ($this->userPassword_nopassword) // use no password
				$return[$_SESSION[$this->base]->dn]['add']['userPassword'][0] = pwd_hash('', !$this->userPassword_lock, $this->moduleSettings['posixAccount_pwdHash'][0]);
			else if ($this->userPassword_invalid) // use '*' as password
				$return[$_SESSION[$this->base]->dn]['add']['userPassword'][0] = '*';
			else if ($this->userPassword()!='') // set password if set
				$return[$_SESSION[$this->base]->dn]['add']['userPassword'][0] = pwd_hash($this->userPassword(), !$this->userPassword_lock, $this->moduleSettings['posixAccount_pwdHash'][0]);
		}

		// Remove primary group from users from memberUid
		$users_dn = $_SESSION['cache']->get_cache('gidNumber', 'posixAccount', 'user');
		if (is_array($users_dn)) {
			$DNs = array_keys($users_dn);
			for ($i=0; $i<count($DNs); $i++) {
				if ($users_dn[$DNs[$i]][0]==$this->attributes['gidNumber'][0]) {
					$thisuser = substr($DNs[$i], 4, strpos($DNs[$i], ",")-4);
					if (@in_array($thisuser, $this->attribtues['memberUid'])) {
						$this->attribtues['memberUid'] = @array_flip($this->attribtues['memberUid']);
						unset($this->attribtues['memberUid'][$thisuser]);
						$this->attribtues['memberUid'] = @array_flip($this->attribtues['memberUid']);
					}
				}
			}
		}


		// Change gids of users and hosts?
		if ($this->changegids) {
			// get gidNumber
			$line=-1;
			for ($i=0; $i<count($_SESSION['ldap']->objectClasses) || $i==-1; $i++) {
				if (strpos($_SESSION['ldap']->objectClasses[$i], "NAME 'posixAccount'")) $line = $i;
			}
			if ($line!=-1) {
				$result = $_SESSION['cache']->get_cache('gidNumber', 'posixAccount', '*');
				if (is_array($result)) {
					$DNs = array_keys($result);
					for ($i=0; $i<count($DNs); $i++)
					if ($result[$DNs[$i]][0] == $this->orig['gidNumber'][0]) $return[$DNs[$i]]['modify']['gidNumber'][0] = $this->attributes['gidNumber'][0];
				}
			}
			// change primaryGroupID
			$line=-1;
			for ($i=0; $i<count($_SESSION['ldap']->objectClasses) || $i==-1; $i++) {
				if (strpos($_SESSION['ldap']->objectClasses[$i], "NAME 'sambaAccount'")) $line = $i;
			}
			if ($line!=-1) {
				$result = $_SESSION['cache']->get_cache('primaryGroupID', 'sambaAccount', '*');
				if (is_array($result)) {
					$DNs = array_keys($result);
					for ($i=0; $i<count($DNs); $i++) {
						if ($result[$DNs[$i]][0] == $this->orig['gidNumber'][0]*2+1001 ) $return[$DNs[$i]]['modify']['PrimaryGroupID'][0] = $this->attributes['gidNumber'][0]*2+1001;
					}
				}
			}
			// change sambaPrimaryGroupSID
			$line=-1;
			for ($i=0; $i<count($_SESSION['ldap']->objectClasses) || $i==-1; $i++) {
				if (strpos($_SESSION['ldap']->objectClasses[$i], "NAME 'sambaSamAccount'")) $line = $i;
			}
			if ($line!=-1) {
				$result = $_SESSION['cache']->get_cache('sambaPrimaryGroupSID', 'sambaSamAccount', '*');
				if (is_array($result)) {
					$DNs = array_keys($result);
					for ($i=0; $i<count($DNs); $i++) {
						// Get Domain SID from name
						$sambaDomains = search_domains($_SESSION['config']->get_domainSuffix());
						// Get Domain-SID from group SID
						$domainSID = substr($result[$DNs[$i]], 0, strrpos($result[$DNs[$i]], "-"));
						for ($i=0; $i<count($sambaDomains); $i++ )
						if ($domainSID==$sambaDomains[$i]->SID)
						$RIDbase = $sambaDomains[$i]->RIDbase;
						if ($result[$DNs[$i]][0] == $SID . "-" . $this->orig['gidNumber'][0]*2+1+$RIDbase ) $return[$DNs[$i]]['modify']['sambaPrimaryGroupSID'][0] = $SID . "-" . $this->attributes['gidNumber'][0]*2+1+$RIDbase;
					}
				}
			}
		}
		return $return;
	}


	/** $attribute['userPassword'] can't accessed directly because it's enrcypted
	* To read / write password function userPassword is needed
	* This function will return the unencrypted password when
	* called without a variable
	* If it's called with a new password, the
	* new password will be stored encrypted
	*/
	function userPassword($newpassword=false) {
		if (is_string($newpassword)) {
			// Write new password
			if ($newpassword=='')
				$this->attributes['userPassword'][0] = '';
			else $this->attributes['userPassword'][0] = base64_encode($_SESSION['ldap']->encrypt($newpassword));
			return 0;
		}
		else {
			if ($this->attributes['userPassword'][0]!='') // Read existing password if set
				return $_SESSION['ldap']->decrypt(base64_decode($this->attributes['userPassword'][0]));
			else return '';
		}
	}
}

?>