diff --git a/plugins/ldapAuth.php b/plugins/ldapAuth.php index 3eb201c..348f555 100644 --- a/plugins/ldapAuth.php +++ b/plugins/ldapAuth.php @@ -16,7 +16,7 @@ * of admin users. */ -require_once dirname(__FILE__).'/../accesscheck.php'; +require_once __DIR__.'/../accesscheck.php'; class ldapAuth extends phplistPlugin { public $name = 'LDAP Authentication Plugin'; @@ -27,34 +27,13 @@ class ldapAuth extends phplistPlugin { public $documentationUrl = 'https://github.com/digital-me/phplist-plugin-ldap'; public $authProvider = true; + /** + * For users in $ldap_except_users this method provides a fallback to the authentication method from phpList core + */ function localValidateLogin($login,$password) { - $query - = ' select password, disabled, id' - . ' from %s' - . ' where loginname = ?'; - $query = sprintf($query, $GLOBALS['tables']['admin']); - $req = Sql_Query_Params($query, array($login)); - $admindata = Sql_Fetch_Assoc($req); - $encryptedPass = hash(ENCRYPTION_ALGO,$password); - $passwordDB = $admindata['password']; - #Password encryption verification. - if(strlen($passwordDB)<$GLOBALS['hash_length']) { // Passwords are encrypted but the actual is not. - #Encrypt the actual DB password before performing the validation below. - $encryptedPassDB = hash(ENCRYPTION_ALGO,$passwordDB); - $query = "update %s set password = '%s' where loginname = ?"; - $query = sprintf($query, $GLOBALS['tables']['admin'], $encryptedPassDB); - $passwordDB = $encryptedPassDB; - $req = Sql_Query_Params($query, array($login)); - } - if ($admindata["disabled"]) { - return array(0,s("your account has been disabled")); - } elseif (#Password validation. - !empty($passwordDB) && $encryptedPass == $passwordDB) { - return array($admindata['id'],"OK"); - } else { - return array(0,s("incorrect password")); - } - return array(0,s("Login failed")); + require_once __DIR__.'/../phpListAdminAuthentication.php'; + $core_admin_auth = new phpListAdminAuthentication(); + return $core_admin_auth->validateLogin($login,$password); } function getPassword($email) {