nextcloud / server

apps/files_trashbin/ajax/undelete.php

Indentation +43 added lines, -43 removed lines

@@ -35,25 +35,25 @@ 
 
 $dir = '/';
 if (isset($_POST['dir'])) {
-	$dir = rtrim((string)$_POST['dir'], '/'). '/';
+    $dir = rtrim((string)$_POST['dir'], '/'). '/';
 }
 $allFiles = false;
 if (isset($_POST['allfiles']) && (string)$_POST['allfiles'] === 'true') {
-	$allFiles = true;
-	$list = array();
-	$dirListing = true;
-	if ($dir === '' || $dir === '/') {
-		$dirListing = false;
-	}
-	foreach (OCA\Files_Trashbin\Helper::getTrashFiles($dir, \OCP\User::getUser()) as $file) {
-		$fileName = $file['name'];
-		if (!$dirListing) {
-			$fileName .= '.d' . $file['mtime'];
-		}
-		$list[] = $fileName;
-	}
+    $allFiles = true;
+    $list = array();
+    $dirListing = true;
+    if ($dir === '' || $dir === '/') {
+        $dirListing = false;
+    }
+    foreach (OCA\Files_Trashbin\Helper::getTrashFiles($dir, \OCP\User::getUser()) as $file) {
+        $fileName = $file['name'];
+        if (!$dirListing) {
+            $fileName .= '.d' . $file['mtime'];
+        }
+        $list[] = $fileName;
+    }
 } else {
-	$list = json_decode($_POST['files']);
+    $list = json_decode($_POST['files']);
 }
 
 $error = array();
@@ -61,38 +61,38 @@ 
 
 $i = 0;
 foreach ($list as $file) {
-	$path = $dir . '/' . $file;
-	if ($dir === '/') {
-		$file = ltrim($file, '/');
-		$delimiter = strrpos($file, '.d');
-		$filename = substr($file, 0, $delimiter);
-		$timestamp =  substr($file, $delimiter+2);
-	} else {
-		$path_parts = pathinfo($file);
-		$filename = $path_parts['basename'];
-		$timestamp = null;
-	}
+    $path = $dir . '/' . $file;
+    if ($dir === '/') {
+        $file = ltrim($file, '/');
+        $delimiter = strrpos($file, '.d');
+        $filename = substr($file, 0, $delimiter);
+        $timestamp =  substr($file, $delimiter+2);
+    } else {
+        $path_parts = pathinfo($file);
+        $filename = $path_parts['basename'];
+        $timestamp = null;
+    }
 
-	if ( !OCA\Files_Trashbin\Trashbin::restore($path, $filename, $timestamp) ) {
-		$error[] = $filename;
-		\OCP\Util::writeLog('trashbin', 'can\'t restore ' . $filename, ILogger::ERROR);
-	} else {
-		$success[$i]['filename'] = $file;
-		$success[$i]['timestamp'] = $timestamp;
-		$i++;
-	}
+    if ( !OCA\Files_Trashbin\Trashbin::restore($path, $filename, $timestamp) ) {
+        $error[] = $filename;
+        \OCP\Util::writeLog('trashbin', 'can\'t restore ' . $filename, ILogger::ERROR);
+    } else {
+        $success[$i]['filename'] = $file;
+        $success[$i]['timestamp'] = $timestamp;
+        $i++;
+    }
 
 }
 
 if ( $error ) {
-	$filelist = '';
-	foreach ( $error as $e ) {
-		$filelist .= $e.', ';
-	}
-	$l = OC::$server->getL10N('files_trashbin');
-	$message = $l->t("Couldn't restore %s", array(rtrim($filelist, ', ')));
-	\OC_JSON::error(array("data" => array("message" => $message,
-										  "success" => $success, "error" => $error)));
+    $filelist = '';
+    foreach ( $error as $e ) {
+        $filelist .= $e.', ';
+    }
+    $l = OC::$server->getL10N('files_trashbin');
+    $message = $l->t("Couldn't restore %s", array(rtrim($filelist, ', ')));
+    \OC_JSON::error(array("data" => array("message" => $message,
+                                            "success" => $success, "error" => $error)));
 } else {
-	\OC_JSON::success(array("data" => array("success" => $success)));
+    \OC_JSON::success(array("data" => array("success" => $success)));
 }

apps/provisioning_api/lib/Controller/UsersController.php

Indentation +841 added lines, -841 removed lines

@@ -52,845 +52,845 @@
 
 class UsersController extends AUserData {
 
-	/** @var IAppManager */
-	private $appManager;
-	/** @var ILogger */
-	private $logger;
-	/** @var IFactory */
-	private $l10nFactory;
-	/** @var NewUserMailHelper */
-	private $newUserMailHelper;
-	/** @var FederatedFileSharingFactory */
-	private $federatedFileSharingFactory;
-	/** @var ISecureRandom */
-	private $secureRandom;
-
-	/**
-	 * @param string $appName
-	 * @param IRequest $request
-	 * @param IUserManager $userManager
-	 * @param IConfig $config
-	 * @param IAppManager $appManager
-	 * @param IGroupManager $groupManager
-	 * @param IUserSession $userSession
-	 * @param AccountManager $accountManager
-	 * @param ILogger $logger
-	 * @param IFactory $l10nFactory
-	 * @param NewUserMailHelper $newUserMailHelper
-	 * @param FederatedFileSharingFactory $federatedFileSharingFactory
-	 * @param ISecureRandom $secureRandom
-	 */
-	public function __construct(string $appName,
-								IRequest $request,
-								IUserManager $userManager,
-								IConfig $config,
-								IAppManager $appManager,
-								IGroupManager $groupManager,
-								IUserSession $userSession,
-								AccountManager $accountManager,
-								ILogger $logger,
-								IFactory $l10nFactory,
-								NewUserMailHelper $newUserMailHelper,
-								FederatedFileSharingFactory $federatedFileSharingFactory,
-								ISecureRandom $secureRandom) {
-		parent::__construct($appName,
-							$request,
-							$userManager,
-							$config,
-							$groupManager,
-							$userSession,
-							$accountManager);
-
-		$this->appManager = $appManager;
-		$this->logger = $logger;
-		$this->l10nFactory = $l10nFactory;
-		$this->newUserMailHelper = $newUserMailHelper;
-		$this->federatedFileSharingFactory = $federatedFileSharingFactory;
-		$this->secureRandom = $secureRandom;
-	}
-
-	/**
-	 * @NoAdminRequired
-	 *
-	 * returns a list of users
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return DataResponse
-	 */
-	public function getUsers(string $search = '', $limit = null, $offset = 0): DataResponse {
-		$user = $this->userSession->getUser();
-		$users = [];
-
-		// Admin? Or SubAdmin?
-		$uid = $user->getUID();
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if ($this->groupManager->isAdmin($uid)){
-			$users = $this->userManager->search($search, $limit, $offset);
-		} else if ($subAdminManager->isSubAdmin($user)) {
-			$subAdminOfGroups = $subAdminManager->getSubAdminsGroups($user);
-			foreach ($subAdminOfGroups as $key => $group) {
-				$subAdminOfGroups[$key] = $group->getGID();
-			}
-
-			$users = [];
-			foreach ($subAdminOfGroups as $group) {
-				$users = array_merge($users, $this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
-			}
-		}
-
-		$users = array_keys($users);
-
-		return new DataResponse([
-			'users' => $users
-		]);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 *
-	 * returns a list of users and their data
-	 */
-	public function getUsersDetails(string $search = '', $limit = null, $offset = 0): DataResponse {
-		$user = $this->userSession->getUser();
-		$users = [];
-
-		// Admin? Or SubAdmin?
-		$uid = $user->getUID();
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if ($this->groupManager->isAdmin($uid)){
-			$users = $this->userManager->search($search, $limit, $offset);
-		} else if ($subAdminManager->isSubAdmin($user)) {
-			$subAdminOfGroups = $subAdminManager->getSubAdminsGroups($user);
-			foreach ($subAdminOfGroups as $key => $group) {
-				$subAdminOfGroups[$key] = $group->getGID();
-			}
-
-			$users = [];
-			foreach ($subAdminOfGroups as $group) {
-				$users = array_merge($users, $this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
-			}
-		}
-
-		$users = array_keys($users);
-		$usersDetails = [];
-		foreach ($users as $key => $userId) {
-			$userData = $this->getUserData($userId);
-			// Do not insert empty entry
-			if (!empty($userData)) {
-				$usersDetails[$userId] = $userData;
-			}
-		}
-
-		return new DataResponse([
-			'users' => $usersDetails
-		]);
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userid
-	 * @param string $password
-	 * @param string $email
-	 * @param array $groups
-	 * @param array $subadmins
-	 * @param string $quota
-	 * @param string $language
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function addUser(string $userid,
-							string $password = '',
-							string $email = '',
-							array $groups = [],
-							array $subadmin = [],
-							string $quota = '',
-							string $language = ''): DataResponse {
-		$user = $this->userSession->getUser();
-		$isAdmin = $this->groupManager->isAdmin($user->getUID());
-		$subAdminManager = $this->groupManager->getSubAdmin();
-
-		if ($this->userManager->userExists($userid)) {
-			$this->logger->error('Failed addUser attempt: User already exists.', ['app' => 'ocs_api']);
-			throw new OCSException('User already exists', 102);
-		}
-
-		if ($groups !== []) {
-			foreach ($groups as $group) {
-				if (!$this->groupManager->groupExists($group)) {
-					throw new OCSException('group '.$group.' does not exist', 104);
-				}
-				if (!$isAdmin && !$subAdminManager->isSubAdminOfGroup($user, $this->groupManager->get($group))) {
-					throw new OCSException('insufficient privileges for group '. $group, 105);
-				}
-			}
-		} else {
-			if (!$isAdmin) {
-				throw new OCSException('no group specified (required for subadmins)', 106);
-			}
-		}
-
-		$subadminGroups = [];
-		if ($subadmin !== []) {
-			foreach ($subadmin as $groupid) {
-				$group = $this->groupManager->get($groupid);
-				// Check if group exists
-				if ($group === null) {
-					throw new OCSException('Subadmin group does not exist',  102);
-				}
-				// Check if trying to make subadmin of admin group
-				if ($group->getGID() === 'admin') {
-					throw new OCSException('Cannot create subadmins for admin group', 103);
-				}
-				// Check if has permission to promote subadmins
-				if (!$subAdminManager->isSubAdminOfGroup($user, $group) && !$isAdmin) {
-					throw new OCSForbiddenException('No permissions to promote subadmins');
-				}
-				$subadminGroups[] = $group;
-			}
-		}
-
-		$generatePasswordResetToken = false;
-		if ($password === '') {
-			if ($email === '') {
-				throw new OCSException('To send a password link to the user an email address is required.', 108);
-			}
-
-			$password = $this->secureRandom->generate(10);
-			// Make sure we pass the password_policy
-			$password .= $this->secureRandom->generate(2, '$!.,;:-~+*[]{}()');
-			$generatePasswordResetToken = true;
-		}
-
-		try {
-			$newUser = $this->userManager->createUser($userid, $password);
-			$this->logger->info('Successful addUser call with userid: ' . $userid, ['app' => 'ocs_api']);
-
-			foreach ($groups as $group) {
-				$this->groupManager->get($group)->addUser($newUser);
-				$this->logger->info('Added userid ' . $userid . ' to group ' . $group, ['app' => 'ocs_api']);
-			}
-			foreach ($subadminGroups as $group) {
-				$subAdminManager->createSubAdmin($newUser, $group);
-			}
-
-			if ($quota !== '') {
-				$this->editUser($userid, 'quota', $quota);
-			}
-
-			if ($language !== '') {
-				$this->editUser($userid, 'language', $language);
-			}
-
-			// Send new user mail only if a mail is set
-			if ($email !== '') {
-				$newUser->setEMailAddress($email);
-				try {
-					$emailTemplate = $this->newUserMailHelper->generateTemplate($newUser, $generatePasswordResetToken);
-					$this->newUserMailHelper->sendMail($newUser, $emailTemplate);
-				} catch (\Exception $e) {
-					$this->logger->logException($e, [
-						'message' => "Can't send new user mail to $email",
-						'level' => ILogger::ERROR,
-						'app' => 'ocs_api',
-					]);
-					throw new OCSException('Unable to send the invitation mail', 109);
-				}
-			}
-
-			return new DataResponse();
-
-		} catch (HintException $e ) {
-			$this->logger->logException($e, [
-				'message' => 'Failed addUser attempt with hint exception.',
-				'level' => ILogger::WARN,
-				'app' => 'ocs_api',
-			]);
-			throw new OCSException($e->getHint(), 107);
-		} catch (\Exception $e) {
-			$this->logger->logException($e, [
-				'message' => 'Failed addUser attempt with exception.',
-				'level' => ILogger::ERROR,
-				'app' => 'ocs_api',
-			]);
-			throw new OCSException('Bad request', 101);
-		}
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * gets user info
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getUser(string $userId): DataResponse {
-		$data = $this->getUserData($userId);
-		// getUserData returns empty array if not enough permissions
-		if (empty($data)) {
-			throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-		}
-		return new DataResponse($data);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * gets user info from the currently logged in user
-	 *
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getCurrentUser(): DataResponse {
-		$user = $this->userSession->getUser();
-		if ($user) {
-			$data =  $this->getUserData($user->getUID());
-			// rename "displayname" to "display-name" only for this call to keep
-			// the API stable.
-			$data['display-name'] = $data['displayname'];
-			unset($data['displayname']);
-			return new DataResponse($data);
-
-		}
-
-		throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 */
-	public function getEditableFields(): DataResponse {
-		$permittedFields = [];
-
-		// Editing self (display, email)
-		if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
-			$permittedFields[] = AccountManager::PROPERTY_DISPLAYNAME;
-			$permittedFields[] = AccountManager::PROPERTY_EMAIL;
-		}
-
-		if ($this->appManager->isEnabledForUser('federatedfilesharing')) {
-			$federatedFileSharing = $this->federatedFileSharingFactory->get();
-			$shareProvider = $federatedFileSharing->getFederatedShareProvider();
-			if ($shareProvider->isLookupServerUploadEnabled()) {
-				$permittedFields[] = AccountManager::PROPERTY_PHONE;
-				$permittedFields[] = AccountManager::PROPERTY_ADDRESS;
-				$permittedFields[] = AccountManager::PROPERTY_WEBSITE;
-				$permittedFields[] = AccountManager::PROPERTY_TWITTER;
-			}
-		}
-
-		return new DataResponse($permittedFields);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * edit users
-	 *
-	 * @param string $userId
-	 * @param string $key
-	 * @param string $value
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function editUser(string $userId, string $key, string $value): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-		}
-
-		$permittedFields = [];
-		if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			// Editing self (display, email)
-			if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
-				$permittedFields[] = 'display';
-				$permittedFields[] = AccountManager::PROPERTY_DISPLAYNAME;
-				$permittedFields[] = AccountManager::PROPERTY_EMAIL;
-			}
-
-			$permittedFields[] = 'password';
-			if ($this->config->getSystemValue('force_language', false) === false ||
-				$this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
-				$permittedFields[] = 'language';
-			}
-
-			if ($this->appManager->isEnabledForUser('federatedfilesharing')) {
-				$federatedFileSharing = new \OCA\FederatedFileSharing\AppInfo\Application();
-				$shareProvider = $federatedFileSharing->getFederatedShareProvider();
-				if ($shareProvider->isLookupServerUploadEnabled()) {
-					$permittedFields[] = AccountManager::PROPERTY_PHONE;
-					$permittedFields[] = AccountManager::PROPERTY_ADDRESS;
-					$permittedFields[] = AccountManager::PROPERTY_WEBSITE;
-					$permittedFields[] = AccountManager::PROPERTY_TWITTER;
-				}
-			}
-
-			// If admin they can edit their own quota
-			if ($this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
-				$permittedFields[] = 'quota';
-			}
-		} else {
-			// Check if admin / subadmin
-			$subAdminManager = $this->groupManager->getSubAdmin();
-			if ($subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
-			|| $this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
-				// They have permissions over the user
-				$permittedFields[] = 'display';
-				$permittedFields[] = AccountManager::PROPERTY_DISPLAYNAME;
-				$permittedFields[] = AccountManager::PROPERTY_EMAIL;
-				$permittedFields[] = 'password';
-				$permittedFields[] = 'language';
-				$permittedFields[] = AccountManager::PROPERTY_PHONE;
-				$permittedFields[] = AccountManager::PROPERTY_ADDRESS;
-				$permittedFields[] = AccountManager::PROPERTY_WEBSITE;
-				$permittedFields[] = AccountManager::PROPERTY_TWITTER;
-				$permittedFields[] = 'quota';
-			} else {
-				// No rights
-				throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-			}
-		}
-		// Check if permitted to edit this field
-		if (!in_array($key, $permittedFields)) {
-			throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-		}
-		// Process the edit
-		switch($key) {
-			case 'display':
-			case AccountManager::PROPERTY_DISPLAYNAME:
-				$targetUser->setDisplayName($value);
-				break;
-			case 'quota':
-				$quota = $value;
-				if ($quota !== 'none' && $quota !== 'default') {
-					if (is_numeric($quota)) {
-						$quota = (float) $quota;
-					} else {
-						$quota = \OCP\Util::computerFileSize($quota);
-					}
-					if ($quota === false) {
-						throw new OCSException('Invalid quota value '.$value, 103);
-					}
-					if ($quota === 0) {
-						$quota = 'default';
-					}else if ($quota === -1) {
-						$quota = 'none';
-					} else {
-						$quota = \OCP\Util::humanFileSize($quota);
-					}
-				}
-				$targetUser->setQuota($quota);
-				break;
-			case 'password':
-				$targetUser->setPassword($value);
-				break;
-			case 'language':
-				$languagesCodes = $this->l10nFactory->findAvailableLanguages();
-				if (!in_array($value, $languagesCodes, true) && $value !== 'en') {
-					throw new OCSException('Invalid language', 102);
-				}
-				$this->config->setUserValue($targetUser->getUID(), 'core', 'lang', $value);
-				break;
-			case AccountManager::PROPERTY_EMAIL:
-				if (filter_var($value, FILTER_VALIDATE_EMAIL) || $value === '') {
-					$targetUser->setEMailAddress($value);
-				} else {
-					throw new OCSException('', 102);
-				}
-				break;
-			case AccountManager::PROPERTY_PHONE:
-			case AccountManager::PROPERTY_ADDRESS:
-			case AccountManager::PROPERTY_WEBSITE:
-			case AccountManager::PROPERTY_TWITTER:
-				$userAccount = $this->accountManager->getUser($targetUser);
-				if ($userAccount[$key]['value'] !== $value) {
-					$userAccount[$key]['value'] = $value;
-					$this->accountManager->updateUser($targetUser, $userAccount);
-				}
-				break;
-			default:
-				throw new OCSException('', 103);
-		}
-		return new DataResponse();
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function deleteUser(string $userId): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-
-		if ($targetUser === null || $targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			throw new OCSException('', 101);
-		}
-
-		// If not permitted
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
-			throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-		}
-
-		// Go ahead with the delete
-		if ($targetUser->delete()) {
-			return new DataResponse();
-		} else {
-			throw new OCSException('', 101);
-		}
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 * @throws OCSForbiddenException
-	 */
-	public function disableUser(string $userId): DataResponse {
-		return $this->setEnabled($userId, false);
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 * @throws OCSForbiddenException
-	 */
-	public function enableUser(string $userId): DataResponse {
-		return $this->setEnabled($userId, true);
-	}
-
-	/**
-	 * @param string $userId
-	 * @param bool $value
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	private function setEnabled(string $userId, bool $value): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null || $targetUser->getUID() === $currentLoggedInUser->getUID()) {
-			throw new OCSException('', 101);
-		}
-
-		// If not permitted
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
-			throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-		}
-
-		// enable/disable the user now
-		$targetUser->setEnabled($value);
-		return new DataResponse();
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getUsersGroups(string $userId): DataResponse {
-		$loggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', \OCP\API::RESPOND_NOT_FOUND);
-		}
-
-		if ($targetUser->getUID() === $loggedInUser->getUID() || $this->groupManager->isAdmin($loggedInUser->getUID())) {
-			// Self lookup or admin lookup
-			return new DataResponse([
-				'groups' => $this->groupManager->getUserGroupIds($targetUser)
-			]);
-		} else {
-			$subAdminManager = $this->groupManager->getSubAdmin();
-
-			// Looking up someone else
-			if ($subAdminManager->isUserAccessible($loggedInUser, $targetUser)) {
-				// Return the group that the method caller is subadmin of for the user in question
-				/** @var IGroup[] $getSubAdminsGroups */
-				$getSubAdminsGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
-				foreach ($getSubAdminsGroups as $key => $group) {
-					$getSubAdminsGroups[$key] = $group->getGID();
-				}
-				$groups = array_intersect(
-					$getSubAdminsGroups,
-					$this->groupManager->getUserGroupIds($targetUser)
-				);
-				return new DataResponse(['groups' => $groups]);
-			} else {
-				// Not permitted
-				throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-			}
-		}
-
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function addToGroup(string $userId, string $groupid = ''): DataResponse {
-		if ($groupid === '') {
-			throw new OCSException('', 101);
-		}
-
-		$group = $this->groupManager->get($groupid);
-		$targetUser = $this->userManager->get($userId);
-		if ($group === null) {
-			throw new OCSException('', 102);
-		}
-		if ($targetUser === null) {
-			throw new OCSException('', 103);
-		}
-
-		// If they're not an admin, check they are a subadmin of the group in question
-		$loggedInUser = $this->userSession->getUser();
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
-			throw new OCSException('', 104);
-		}
-
-		// Add user to group
-		$group->addUser($targetUser);
-		return new DataResponse();
-	}
-
-	/**
-	 * @PasswordConfirmationRequired
-	 * @NoAdminRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function removeFromGroup(string $userId, string $groupid): DataResponse {
-		$loggedInUser = $this->userSession->getUser();
-
-		if ($groupid === null || trim($groupid) === '') {
-			throw new OCSException('', 101);
-		}
-
-		$group = $this->groupManager->get($groupid);
-		if ($group === null) {
-			throw new OCSException('', 102);
-		}
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', 103);
-		}
-
-		// If they're not an admin, check they are a subadmin of the group in question
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
-			throw new OCSException('', 104);
-		}
-
-		// Check they aren't removing themselves from 'admin' or their 'subadmin; group
-		if ($targetUser->getUID() === $loggedInUser->getUID()) {
-			if ($this->groupManager->isAdmin($loggedInUser->getUID())) {
-				if ($group->getGID() === 'admin') {
-					throw new OCSException('Cannot remove yourself from the admin group', 105);
-				}
-			} else {
-				// Not an admin, so the user must be a subadmin of this group, but that is not allowed.
-				throw new OCSException('Cannot remove yourself from this group as you are a SubAdmin', 105);
-			}
-
-		} else if (!$this->groupManager->isAdmin($loggedInUser->getUID())) {
-			/** @var IGroup[] $subAdminGroups */
-			$subAdminGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
-			$subAdminGroups = array_map(function (IGroup $subAdminGroup) {
-				return $subAdminGroup->getGID();
-			}, $subAdminGroups);
-			$userGroups = $this->groupManager->getUserGroupIds($targetUser);
-			$userSubAdminGroups = array_intersect($subAdminGroups, $userGroups);
-
-			if (count($userSubAdminGroups) <= 1) {
-				// Subadmin must not be able to remove a user from all their subadmin groups.
-				throw new OCSException('Cannot remove user from this group as this is the only remaining group you are a SubAdmin of', 105);
-			}
-		}
-
-		// Remove user from group
-		$group->removeUser($targetUser);
-		return new DataResponse();
-	}
-
-	/**
-	 * Creates a subadmin
-	 *
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function addSubAdmin(string $userId, string $groupid): DataResponse {
-		$group = $this->groupManager->get($groupid);
-		$user = $this->userManager->get($userId);
-
-		// Check if the user exists
-		if ($user === null) {
-			throw new OCSException('User does not exist', 101);
-		}
-		// Check if group exists
-		if ($group === null) {
-			throw new OCSException('Group does not exist',  102);
-		}
-		// Check if trying to make subadmin of admin group
-		if ($group->getGID() === 'admin') {
-			throw new OCSException('Cannot create subadmins for admin group', 103);
-		}
-
-		$subAdminManager = $this->groupManager->getSubAdmin();
-
-		// We cannot be subadmin twice
-		if ($subAdminManager->isSubAdminOfGroup($user, $group)) {
-			return new DataResponse();
-		}
-		// Go
-		if ($subAdminManager->createSubAdmin($user, $group)) {
-			return new DataResponse();
-		} else {
-			throw new OCSException('Unknown error occurred', 103);
-		}
-	}
-
-	/**
-	 * Removes a subadmin from a group
-	 *
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $userId
-	 * @param string $groupid
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function removeSubAdmin(string $userId, string $groupid): DataResponse {
-		$group = $this->groupManager->get($groupid);
-		$user = $this->userManager->get($userId);
-		$subAdminManager = $this->groupManager->getSubAdmin();
-
-		// Check if the user exists
-		if ($user === null) {
-			throw new OCSException('User does not exist', 101);
-		}
-		// Check if the group exists
-		if ($group === null) {
-			throw new OCSException('Group does not exist', 101);
-		}
-		// Check if they are a subadmin of this said group
-		if (!$subAdminManager->isSubAdminOfGroup($user, $group)) {
-			throw new OCSException('User is not a subadmin of this group', 102);
-		}
-
-		// Go
-		if ($subAdminManager->deleteSubAdmin($user, $group)) {
-			return new DataResponse();
-		} else {
-			throw new OCSException('Unknown error occurred', 103);
-		}
-	}
-
-	/**
-	 * Get the groups a user is a subadmin of
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function getUserSubAdminGroups(string $userId): DataResponse {
-		$groups = $this->getUserSubAdminGroupsData($userId);
-		return new DataResponse($groups);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * resend welcome message
-	 *
-	 * @param string $userId
-	 * @return DataResponse
-	 * @throws OCSException
-	 */
-	public function resendWelcomeMessage(string $userId): DataResponse {
-		$currentLoggedInUser = $this->userSession->getUser();
-
-		$targetUser = $this->userManager->get($userId);
-		if ($targetUser === null) {
-			throw new OCSException('', \OCP\API::RESPOND_NOT_FOUND);
-		}
-
-		// Check if admin / subadmin
-		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
-			&& !$this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
-			// No rights
-			throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
-		}
-
-		$email = $targetUser->getEMailAddress();
-		if ($email === '' || $email === null) {
-			throw new OCSException('Email address not available', 101);
-		}
-		$username = $targetUser->getUID();
-		$lang = $this->config->getUserValue($username, 'core', 'lang', 'en');
-		if (!$this->l10nFactory->languageExists('settings', $lang)) {
-			$lang = 'en';
-		}
-
-		$l10n = $this->l10nFactory->get('settings', $lang);
-
-		try {
-			$this->newUserMailHelper->setL10N($l10n);
-			$emailTemplate = $this->newUserMailHelper->generateTemplate($targetUser, false);
-			$this->newUserMailHelper->sendMail($targetUser, $emailTemplate);
-		} catch(\Exception $e) {
-			$this->logger->logException($e, [
-				'message' => "Can't send new user mail to $email",
-				'level' => ILogger::ERROR,
-				'app' => 'settings',
-			]);
-			throw new OCSException('Sending email failed', 102);
-		}
-
-		return new DataResponse();
-	}
+    /** @var IAppManager */
+    private $appManager;
+    /** @var ILogger */
+    private $logger;
+    /** @var IFactory */
+    private $l10nFactory;
+    /** @var NewUserMailHelper */
+    private $newUserMailHelper;
+    /** @var FederatedFileSharingFactory */
+    private $federatedFileSharingFactory;
+    /** @var ISecureRandom */
+    private $secureRandom;
+
+    /**
+     * @param string $appName
+     * @param IRequest $request
+     * @param IUserManager $userManager
+     * @param IConfig $config
+     * @param IAppManager $appManager
+     * @param IGroupManager $groupManager
+     * @param IUserSession $userSession
+     * @param AccountManager $accountManager
+     * @param ILogger $logger
+     * @param IFactory $l10nFactory
+     * @param NewUserMailHelper $newUserMailHelper
+     * @param FederatedFileSharingFactory $federatedFileSharingFactory
+     * @param ISecureRandom $secureRandom
+     */
+    public function __construct(string $appName,
+                                IRequest $request,
+                                IUserManager $userManager,
+                                IConfig $config,
+                                IAppManager $appManager,
+                                IGroupManager $groupManager,
+                                IUserSession $userSession,
+                                AccountManager $accountManager,
+                                ILogger $logger,
+                                IFactory $l10nFactory,
+                                NewUserMailHelper $newUserMailHelper,
+                                FederatedFileSharingFactory $federatedFileSharingFactory,
+                                ISecureRandom $secureRandom) {
+        parent::__construct($appName,
+                            $request,
+                            $userManager,
+                            $config,
+                            $groupManager,
+                            $userSession,
+                            $accountManager);
+
+        $this->appManager = $appManager;
+        $this->logger = $logger;
+        $this->l10nFactory = $l10nFactory;
+        $this->newUserMailHelper = $newUserMailHelper;
+        $this->federatedFileSharingFactory = $federatedFileSharingFactory;
+        $this->secureRandom = $secureRandom;
+    }
+
+    /**
+     * @NoAdminRequired
+     *
+     * returns a list of users
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return DataResponse
+     */
+    public function getUsers(string $search = '', $limit = null, $offset = 0): DataResponse {
+        $user = $this->userSession->getUser();
+        $users = [];
+
+        // Admin? Or SubAdmin?
+        $uid = $user->getUID();
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if ($this->groupManager->isAdmin($uid)){
+            $users = $this->userManager->search($search, $limit, $offset);
+        } else if ($subAdminManager->isSubAdmin($user)) {
+            $subAdminOfGroups = $subAdminManager->getSubAdminsGroups($user);
+            foreach ($subAdminOfGroups as $key => $group) {
+                $subAdminOfGroups[$key] = $group->getGID();
+            }
+
+            $users = [];
+            foreach ($subAdminOfGroups as $group) {
+                $users = array_merge($users, $this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
+            }
+        }
+
+        $users = array_keys($users);
+
+        return new DataResponse([
+            'users' => $users
+        ]);
+    }
+
+    /**
+     * @NoAdminRequired
+     *
+     * returns a list of users and their data
+     */
+    public function getUsersDetails(string $search = '', $limit = null, $offset = 0): DataResponse {
+        $user = $this->userSession->getUser();
+        $users = [];
+
+        // Admin? Or SubAdmin?
+        $uid = $user->getUID();
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if ($this->groupManager->isAdmin($uid)){
+            $users = $this->userManager->search($search, $limit, $offset);
+        } else if ($subAdminManager->isSubAdmin($user)) {
+            $subAdminOfGroups = $subAdminManager->getSubAdminsGroups($user);
+            foreach ($subAdminOfGroups as $key => $group) {
+                $subAdminOfGroups[$key] = $group->getGID();
+            }
+
+            $users = [];
+            foreach ($subAdminOfGroups as $group) {
+                $users = array_merge($users, $this->groupManager->displayNamesInGroup($group, $search, $limit, $offset));
+            }
+        }
+
+        $users = array_keys($users);
+        $usersDetails = [];
+        foreach ($users as $key => $userId) {
+            $userData = $this->getUserData($userId);
+            // Do not insert empty entry
+            if (!empty($userData)) {
+                $usersDetails[$userId] = $userData;
+            }
+        }
+
+        return new DataResponse([
+            'users' => $usersDetails
+        ]);
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userid
+     * @param string $password
+     * @param string $email
+     * @param array $groups
+     * @param array $subadmins
+     * @param string $quota
+     * @param string $language
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function addUser(string $userid,
+                            string $password = '',
+                            string $email = '',
+                            array $groups = [],
+                            array $subadmin = [],
+                            string $quota = '',
+                            string $language = ''): DataResponse {
+        $user = $this->userSession->getUser();
+        $isAdmin = $this->groupManager->isAdmin($user->getUID());
+        $subAdminManager = $this->groupManager->getSubAdmin();
+
+        if ($this->userManager->userExists($userid)) {
+            $this->logger->error('Failed addUser attempt: User already exists.', ['app' => 'ocs_api']);
+            throw new OCSException('User already exists', 102);
+        }
+
+        if ($groups !== []) {
+            foreach ($groups as $group) {
+                if (!$this->groupManager->groupExists($group)) {
+                    throw new OCSException('group '.$group.' does not exist', 104);
+                }
+                if (!$isAdmin && !$subAdminManager->isSubAdminOfGroup($user, $this->groupManager->get($group))) {
+                    throw new OCSException('insufficient privileges for group '. $group, 105);
+                }
+            }
+        } else {
+            if (!$isAdmin) {
+                throw new OCSException('no group specified (required for subadmins)', 106);
+            }
+        }
+
+        $subadminGroups = [];
+        if ($subadmin !== []) {
+            foreach ($subadmin as $groupid) {
+                $group = $this->groupManager->get($groupid);
+                // Check if group exists
+                if ($group === null) {
+                    throw new OCSException('Subadmin group does not exist',  102);
+                }
+                // Check if trying to make subadmin of admin group
+                if ($group->getGID() === 'admin') {
+                    throw new OCSException('Cannot create subadmins for admin group', 103);
+                }
+                // Check if has permission to promote subadmins
+                if (!$subAdminManager->isSubAdminOfGroup($user, $group) && !$isAdmin) {
+                    throw new OCSForbiddenException('No permissions to promote subadmins');
+                }
+                $subadminGroups[] = $group;
+            }
+        }
+
+        $generatePasswordResetToken = false;
+        if ($password === '') {
+            if ($email === '') {
+                throw new OCSException('To send a password link to the user an email address is required.', 108);
+            }
+
+            $password = $this->secureRandom->generate(10);
+            // Make sure we pass the password_policy
+            $password .= $this->secureRandom->generate(2, '$!.,;:-~+*[]{}()');
+            $generatePasswordResetToken = true;
+        }
+
+        try {
+            $newUser = $this->userManager->createUser($userid, $password);
+            $this->logger->info('Successful addUser call with userid: ' . $userid, ['app' => 'ocs_api']);
+
+            foreach ($groups as $group) {
+                $this->groupManager->get($group)->addUser($newUser);
+                $this->logger->info('Added userid ' . $userid . ' to group ' . $group, ['app' => 'ocs_api']);
+            }
+            foreach ($subadminGroups as $group) {
+                $subAdminManager->createSubAdmin($newUser, $group);
+            }
+
+            if ($quota !== '') {
+                $this->editUser($userid, 'quota', $quota);
+            }
+
+            if ($language !== '') {
+                $this->editUser($userid, 'language', $language);
+            }
+
+            // Send new user mail only if a mail is set
+            if ($email !== '') {
+                $newUser->setEMailAddress($email);
+                try {
+                    $emailTemplate = $this->newUserMailHelper->generateTemplate($newUser, $generatePasswordResetToken);
+                    $this->newUserMailHelper->sendMail($newUser, $emailTemplate);
+                } catch (\Exception $e) {
+                    $this->logger->logException($e, [
+                        'message' => "Can't send new user mail to $email",
+                        'level' => ILogger::ERROR,
+                        'app' => 'ocs_api',
+                    ]);
+                    throw new OCSException('Unable to send the invitation mail', 109);
+                }
+            }
+
+            return new DataResponse();
+
+        } catch (HintException $e ) {
+            $this->logger->logException($e, [
+                'message' => 'Failed addUser attempt with hint exception.',
+                'level' => ILogger::WARN,
+                'app' => 'ocs_api',
+            ]);
+            throw new OCSException($e->getHint(), 107);
+        } catch (\Exception $e) {
+            $this->logger->logException($e, [
+                'message' => 'Failed addUser attempt with exception.',
+                'level' => ILogger::ERROR,
+                'app' => 'ocs_api',
+            ]);
+            throw new OCSException('Bad request', 101);
+        }
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * gets user info
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getUser(string $userId): DataResponse {
+        $data = $this->getUserData($userId);
+        // getUserData returns empty array if not enough permissions
+        if (empty($data)) {
+            throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+        }
+        return new DataResponse($data);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * gets user info from the currently logged in user
+     *
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getCurrentUser(): DataResponse {
+        $user = $this->userSession->getUser();
+        if ($user) {
+            $data =  $this->getUserData($user->getUID());
+            // rename "displayname" to "display-name" only for this call to keep
+            // the API stable.
+            $data['display-name'] = $data['displayname'];
+            unset($data['displayname']);
+            return new DataResponse($data);
+
+        }
+
+        throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     */
+    public function getEditableFields(): DataResponse {
+        $permittedFields = [];
+
+        // Editing self (display, email)
+        if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
+            $permittedFields[] = AccountManager::PROPERTY_DISPLAYNAME;
+            $permittedFields[] = AccountManager::PROPERTY_EMAIL;
+        }
+
+        if ($this->appManager->isEnabledForUser('federatedfilesharing')) {
+            $federatedFileSharing = $this->federatedFileSharingFactory->get();
+            $shareProvider = $federatedFileSharing->getFederatedShareProvider();
+            if ($shareProvider->isLookupServerUploadEnabled()) {
+                $permittedFields[] = AccountManager::PROPERTY_PHONE;
+                $permittedFields[] = AccountManager::PROPERTY_ADDRESS;
+                $permittedFields[] = AccountManager::PROPERTY_WEBSITE;
+                $permittedFields[] = AccountManager::PROPERTY_TWITTER;
+            }
+        }
+
+        return new DataResponse($permittedFields);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     * @PasswordConfirmationRequired
+     *
+     * edit users
+     *
+     * @param string $userId
+     * @param string $key
+     * @param string $value
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function editUser(string $userId, string $key, string $value): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+        }
+
+        $permittedFields = [];
+        if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            // Editing self (display, email)
+            if ($this->config->getSystemValue('allow_user_to_change_display_name', true) !== false) {
+                $permittedFields[] = 'display';
+                $permittedFields[] = AccountManager::PROPERTY_DISPLAYNAME;
+                $permittedFields[] = AccountManager::PROPERTY_EMAIL;
+            }
+
+            $permittedFields[] = 'password';
+            if ($this->config->getSystemValue('force_language', false) === false ||
+                $this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
+                $permittedFields[] = 'language';
+            }
+
+            if ($this->appManager->isEnabledForUser('federatedfilesharing')) {
+                $federatedFileSharing = new \OCA\FederatedFileSharing\AppInfo\Application();
+                $shareProvider = $federatedFileSharing->getFederatedShareProvider();
+                if ($shareProvider->isLookupServerUploadEnabled()) {
+                    $permittedFields[] = AccountManager::PROPERTY_PHONE;
+                    $permittedFields[] = AccountManager::PROPERTY_ADDRESS;
+                    $permittedFields[] = AccountManager::PROPERTY_WEBSITE;
+                    $permittedFields[] = AccountManager::PROPERTY_TWITTER;
+                }
+            }
+
+            // If admin they can edit their own quota
+            if ($this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
+                $permittedFields[] = 'quota';
+            }
+        } else {
+            // Check if admin / subadmin
+            $subAdminManager = $this->groupManager->getSubAdmin();
+            if ($subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
+            || $this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
+                // They have permissions over the user
+                $permittedFields[] = 'display';
+                $permittedFields[] = AccountManager::PROPERTY_DISPLAYNAME;
+                $permittedFields[] = AccountManager::PROPERTY_EMAIL;
+                $permittedFields[] = 'password';
+                $permittedFields[] = 'language';
+                $permittedFields[] = AccountManager::PROPERTY_PHONE;
+                $permittedFields[] = AccountManager::PROPERTY_ADDRESS;
+                $permittedFields[] = AccountManager::PROPERTY_WEBSITE;
+                $permittedFields[] = AccountManager::PROPERTY_TWITTER;
+                $permittedFields[] = 'quota';
+            } else {
+                // No rights
+                throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+            }
+        }
+        // Check if permitted to edit this field
+        if (!in_array($key, $permittedFields)) {
+            throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+        }
+        // Process the edit
+        switch($key) {
+            case 'display':
+            case AccountManager::PROPERTY_DISPLAYNAME:
+                $targetUser->setDisplayName($value);
+                break;
+            case 'quota':
+                $quota = $value;
+                if ($quota !== 'none' && $quota !== 'default') {
+                    if (is_numeric($quota)) {
+                        $quota = (float) $quota;
+                    } else {
+                        $quota = \OCP\Util::computerFileSize($quota);
+                    }
+                    if ($quota === false) {
+                        throw new OCSException('Invalid quota value '.$value, 103);
+                    }
+                    if ($quota === 0) {
+                        $quota = 'default';
+                    }else if ($quota === -1) {
+                        $quota = 'none';
+                    } else {
+                        $quota = \OCP\Util::humanFileSize($quota);
+                    }
+                }
+                $targetUser->setQuota($quota);
+                break;
+            case 'password':
+                $targetUser->setPassword($value);
+                break;
+            case 'language':
+                $languagesCodes = $this->l10nFactory->findAvailableLanguages();
+                if (!in_array($value, $languagesCodes, true) && $value !== 'en') {
+                    throw new OCSException('Invalid language', 102);
+                }
+                $this->config->setUserValue($targetUser->getUID(), 'core', 'lang', $value);
+                break;
+            case AccountManager::PROPERTY_EMAIL:
+                if (filter_var($value, FILTER_VALIDATE_EMAIL) || $value === '') {
+                    $targetUser->setEMailAddress($value);
+                } else {
+                    throw new OCSException('', 102);
+                }
+                break;
+            case AccountManager::PROPERTY_PHONE:
+            case AccountManager::PROPERTY_ADDRESS:
+            case AccountManager::PROPERTY_WEBSITE:
+            case AccountManager::PROPERTY_TWITTER:
+                $userAccount = $this->accountManager->getUser($targetUser);
+                if ($userAccount[$key]['value'] !== $value) {
+                    $userAccount[$key]['value'] = $value;
+                    $this->accountManager->updateUser($targetUser, $userAccount);
+                }
+                break;
+            default:
+                throw new OCSException('', 103);
+        }
+        return new DataResponse();
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function deleteUser(string $userId): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+
+        if ($targetUser === null || $targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            throw new OCSException('', 101);
+        }
+
+        // If not permitted
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
+            throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+        }
+
+        // Go ahead with the delete
+        if ($targetUser->delete()) {
+            return new DataResponse();
+        } else {
+            throw new OCSException('', 101);
+        }
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     * @throws OCSForbiddenException
+     */
+    public function disableUser(string $userId): DataResponse {
+        return $this->setEnabled($userId, false);
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     * @throws OCSForbiddenException
+     */
+    public function enableUser(string $userId): DataResponse {
+        return $this->setEnabled($userId, true);
+    }
+
+    /**
+     * @param string $userId
+     * @param bool $value
+     * @return DataResponse
+     * @throws OCSException
+     */
+    private function setEnabled(string $userId, bool $value): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null || $targetUser->getUID() === $currentLoggedInUser->getUID()) {
+            throw new OCSException('', 101);
+        }
+
+        // If not permitted
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($currentLoggedInUser->getUID()) && !$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)) {
+            throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+        }
+
+        // enable/disable the user now
+        $targetUser->setEnabled($value);
+        return new DataResponse();
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getUsersGroups(string $userId): DataResponse {
+        $loggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', \OCP\API::RESPOND_NOT_FOUND);
+        }
+
+        if ($targetUser->getUID() === $loggedInUser->getUID() || $this->groupManager->isAdmin($loggedInUser->getUID())) {
+            // Self lookup or admin lookup
+            return new DataResponse([
+                'groups' => $this->groupManager->getUserGroupIds($targetUser)
+            ]);
+        } else {
+            $subAdminManager = $this->groupManager->getSubAdmin();
+
+            // Looking up someone else
+            if ($subAdminManager->isUserAccessible($loggedInUser, $targetUser)) {
+                // Return the group that the method caller is subadmin of for the user in question
+                /** @var IGroup[] $getSubAdminsGroups */
+                $getSubAdminsGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
+                foreach ($getSubAdminsGroups as $key => $group) {
+                    $getSubAdminsGroups[$key] = $group->getGID();
+                }
+                $groups = array_intersect(
+                    $getSubAdminsGroups,
+                    $this->groupManager->getUserGroupIds($targetUser)
+                );
+                return new DataResponse(['groups' => $groups]);
+            } else {
+                // Not permitted
+                throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+            }
+        }
+
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function addToGroup(string $userId, string $groupid = ''): DataResponse {
+        if ($groupid === '') {
+            throw new OCSException('', 101);
+        }
+
+        $group = $this->groupManager->get($groupid);
+        $targetUser = $this->userManager->get($userId);
+        if ($group === null) {
+            throw new OCSException('', 102);
+        }
+        if ($targetUser === null) {
+            throw new OCSException('', 103);
+        }
+
+        // If they're not an admin, check they are a subadmin of the group in question
+        $loggedInUser = $this->userSession->getUser();
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
+            throw new OCSException('', 104);
+        }
+
+        // Add user to group
+        $group->addUser($targetUser);
+        return new DataResponse();
+    }
+
+    /**
+     * @PasswordConfirmationRequired
+     * @NoAdminRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function removeFromGroup(string $userId, string $groupid): DataResponse {
+        $loggedInUser = $this->userSession->getUser();
+
+        if ($groupid === null || trim($groupid) === '') {
+            throw new OCSException('', 101);
+        }
+
+        $group = $this->groupManager->get($groupid);
+        if ($group === null) {
+            throw new OCSException('', 102);
+        }
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', 103);
+        }
+
+        // If they're not an admin, check they are a subadmin of the group in question
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
+            throw new OCSException('', 104);
+        }
+
+        // Check they aren't removing themselves from 'admin' or their 'subadmin; group
+        if ($targetUser->getUID() === $loggedInUser->getUID()) {
+            if ($this->groupManager->isAdmin($loggedInUser->getUID())) {
+                if ($group->getGID() === 'admin') {
+                    throw new OCSException('Cannot remove yourself from the admin group', 105);
+                }
+            } else {
+                // Not an admin, so the user must be a subadmin of this group, but that is not allowed.
+                throw new OCSException('Cannot remove yourself from this group as you are a SubAdmin', 105);
+            }
+
+        } else if (!$this->groupManager->isAdmin($loggedInUser->getUID())) {
+            /** @var IGroup[] $subAdminGroups */
+            $subAdminGroups = $subAdminManager->getSubAdminsGroups($loggedInUser);
+            $subAdminGroups = array_map(function (IGroup $subAdminGroup) {
+                return $subAdminGroup->getGID();
+            }, $subAdminGroups);
+            $userGroups = $this->groupManager->getUserGroupIds($targetUser);
+            $userSubAdminGroups = array_intersect($subAdminGroups, $userGroups);
+
+            if (count($userSubAdminGroups) <= 1) {
+                // Subadmin must not be able to remove a user from all their subadmin groups.
+                throw new OCSException('Cannot remove user from this group as this is the only remaining group you are a SubAdmin of', 105);
+            }
+        }
+
+        // Remove user from group
+        $group->removeUser($targetUser);
+        return new DataResponse();
+    }
+
+    /**
+     * Creates a subadmin
+     *
+     * @PasswordConfirmationRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function addSubAdmin(string $userId, string $groupid): DataResponse {
+        $group = $this->groupManager->get($groupid);
+        $user = $this->userManager->get($userId);
+
+        // Check if the user exists
+        if ($user === null) {
+            throw new OCSException('User does not exist', 101);
+        }
+        // Check if group exists
+        if ($group === null) {
+            throw new OCSException('Group does not exist',  102);
+        }
+        // Check if trying to make subadmin of admin group
+        if ($group->getGID() === 'admin') {
+            throw new OCSException('Cannot create subadmins for admin group', 103);
+        }
+
+        $subAdminManager = $this->groupManager->getSubAdmin();
+
+        // We cannot be subadmin twice
+        if ($subAdminManager->isSubAdminOfGroup($user, $group)) {
+            return new DataResponse();
+        }
+        // Go
+        if ($subAdminManager->createSubAdmin($user, $group)) {
+            return new DataResponse();
+        } else {
+            throw new OCSException('Unknown error occurred', 103);
+        }
+    }
+
+    /**
+     * Removes a subadmin from a group
+     *
+     * @PasswordConfirmationRequired
+     *
+     * @param string $userId
+     * @param string $groupid
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function removeSubAdmin(string $userId, string $groupid): DataResponse {
+        $group = $this->groupManager->get($groupid);
+        $user = $this->userManager->get($userId);
+        $subAdminManager = $this->groupManager->getSubAdmin();
+
+        // Check if the user exists
+        if ($user === null) {
+            throw new OCSException('User does not exist', 101);
+        }
+        // Check if the group exists
+        if ($group === null) {
+            throw new OCSException('Group does not exist', 101);
+        }
+        // Check if they are a subadmin of this said group
+        if (!$subAdminManager->isSubAdminOfGroup($user, $group)) {
+            throw new OCSException('User is not a subadmin of this group', 102);
+        }
+
+        // Go
+        if ($subAdminManager->deleteSubAdmin($user, $group)) {
+            return new DataResponse();
+        } else {
+            throw new OCSException('Unknown error occurred', 103);
+        }
+    }
+
+    /**
+     * Get the groups a user is a subadmin of
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function getUserSubAdminGroups(string $userId): DataResponse {
+        $groups = $this->getUserSubAdminGroupsData($userId);
+        return new DataResponse($groups);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @PasswordConfirmationRequired
+     *
+     * resend welcome message
+     *
+     * @param string $userId
+     * @return DataResponse
+     * @throws OCSException
+     */
+    public function resendWelcomeMessage(string $userId): DataResponse {
+        $currentLoggedInUser = $this->userSession->getUser();
+
+        $targetUser = $this->userManager->get($userId);
+        if ($targetUser === null) {
+            throw new OCSException('', \OCP\API::RESPOND_NOT_FOUND);
+        }
+
+        // Check if admin / subadmin
+        $subAdminManager = $this->groupManager->getSubAdmin();
+        if (!$subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser)
+            && !$this->groupManager->isAdmin($currentLoggedInUser->getUID())) {
+            // No rights
+            throw new OCSException('', \OCP\API::RESPOND_UNAUTHORISED);
+        }
+
+        $email = $targetUser->getEMailAddress();
+        if ($email === '' || $email === null) {
+            throw new OCSException('Email address not available', 101);
+        }
+        $username = $targetUser->getUID();
+        $lang = $this->config->getUserValue($username, 'core', 'lang', 'en');
+        if (!$this->l10nFactory->languageExists('settings', $lang)) {
+            $lang = 'en';
+        }
+
+        $l10n = $this->l10nFactory->get('settings', $lang);
+
+        try {
+            $this->newUserMailHelper->setL10N($l10n);
+            $emailTemplate = $this->newUserMailHelper->generateTemplate($targetUser, false);
+            $this->newUserMailHelper->sendMail($targetUser, $emailTemplate);
+        } catch(\Exception $e) {
+            $this->logger->logException($e, [
+                'message' => "Can't send new user mail to $email",
+                'level' => ILogger::ERROR,
+                'app' => 'settings',
+            ]);
+            throw new OCSException('Sending email failed', 102);
+        }
+
+        return new DataResponse();
+    }
 }

apps/files_external/lib/Service/LegacyStoragesService.php

Indentation +171 added lines, -171 removed lines

@@ -31,179 +31,179 @@
  * Read mount config from legacy mount.json
  */
 abstract class LegacyStoragesService {
-	/** @var BackendService */
-	protected $backendService;
+    /** @var BackendService */
+    protected $backendService;
 
-	/**
-	 * Read legacy config data
-	 *
-	 * @return array list of mount configs
-	 */
-	abstract protected function readLegacyConfig();
+    /**
+     * Read legacy config data
+     *
+     * @return array list of mount configs
+     */
+    abstract protected function readLegacyConfig();
 
-	/**
-	 * Copy legacy storage options into the given storage config object.
-	 *
-	 * @param StorageConfig $storageConfig storage config to populate
-	 * @param string $mountType mount type
-	 * @param string $applicable applicable user or group
-	 * @param array $storageOptions legacy storage options
-	 *
-	 * @return StorageConfig populated storage config
-	 */
-	protected function populateStorageConfigWithLegacyOptions(
-		&$storageConfig,
-		$mountType,
-		$applicable,
-		$storageOptions
-	) {
-		$backend = $this->backendService->getBackend($storageOptions['backend']);
-		if (!$backend) {
-			throw new \UnexpectedValueException('Invalid backend ' . $storageOptions['backend']);
-		}
-		$storageConfig->setBackend($backend);
-		if (isset($storageOptions['authMechanism']) && $storageOptions['authMechanism'] !== 'builtin::builtin') {
-			$authMechanism = $this->backendService->getAuthMechanism($storageOptions['authMechanism']);
-		} else {
-			$authMechanism = $backend->getLegacyAuthMechanism($storageOptions);
-			$storageOptions['authMechanism'] = 'null'; // to make error handling easier
-		}
-		if (!$authMechanism) {
-			throw new \UnexpectedValueException('Invalid authentication mechanism ' . $storageOptions['authMechanism']);
-		}
-		$storageConfig->setAuthMechanism($authMechanism);
-		$storageConfig->setBackendOptions($storageOptions['options']);
-		if (isset($storageOptions['mountOptions'])) {
-			$storageConfig->setMountOptions($storageOptions['mountOptions']);
-		}
-		if (!isset($storageOptions['priority'])) {
-			$storageOptions['priority'] = $backend->getPriority();
-		}
-		$storageConfig->setPriority($storageOptions['priority']);
-		if ($mountType === \OC_Mount_Config::MOUNT_TYPE_USER) {
-			$applicableUsers = $storageConfig->getApplicableUsers();
-			if ($applicable !== 'all') {
-				$applicableUsers[] = $applicable;
-				$storageConfig->setApplicableUsers($applicableUsers);
-			}
-		} else if ($mountType === \OC_Mount_Config::MOUNT_TYPE_GROUP) {
-			$applicableGroups = $storageConfig->getApplicableGroups();
-			$applicableGroups[] = $applicable;
-			$storageConfig->setApplicableGroups($applicableGroups);
-		}
-		return $storageConfig;
-	}
+    /**
+     * Copy legacy storage options into the given storage config object.
+     *
+     * @param StorageConfig $storageConfig storage config to populate
+     * @param string $mountType mount type
+     * @param string $applicable applicable user or group
+     * @param array $storageOptions legacy storage options
+     *
+     * @return StorageConfig populated storage config
+     */
+    protected function populateStorageConfigWithLegacyOptions(
+        &$storageConfig,
+        $mountType,
+        $applicable,
+        $storageOptions
+    ) {
+        $backend = $this->backendService->getBackend($storageOptions['backend']);
+        if (!$backend) {
+            throw new \UnexpectedValueException('Invalid backend ' . $storageOptions['backend']);
+        }
+        $storageConfig->setBackend($backend);
+        if (isset($storageOptions['authMechanism']) && $storageOptions['authMechanism'] !== 'builtin::builtin') {
+            $authMechanism = $this->backendService->getAuthMechanism($storageOptions['authMechanism']);
+        } else {
+            $authMechanism = $backend->getLegacyAuthMechanism($storageOptions);
+            $storageOptions['authMechanism'] = 'null'; // to make error handling easier
+        }
+        if (!$authMechanism) {
+            throw new \UnexpectedValueException('Invalid authentication mechanism ' . $storageOptions['authMechanism']);
+        }
+        $storageConfig->setAuthMechanism($authMechanism);
+        $storageConfig->setBackendOptions($storageOptions['options']);
+        if (isset($storageOptions['mountOptions'])) {
+            $storageConfig->setMountOptions($storageOptions['mountOptions']);
+        }
+        if (!isset($storageOptions['priority'])) {
+            $storageOptions['priority'] = $backend->getPriority();
+        }
+        $storageConfig->setPriority($storageOptions['priority']);
+        if ($mountType === \OC_Mount_Config::MOUNT_TYPE_USER) {
+            $applicableUsers = $storageConfig->getApplicableUsers();
+            if ($applicable !== 'all') {
+                $applicableUsers[] = $applicable;
+                $storageConfig->setApplicableUsers($applicableUsers);
+            }
+        } else if ($mountType === \OC_Mount_Config::MOUNT_TYPE_GROUP) {
+            $applicableGroups = $storageConfig->getApplicableGroups();
+            $applicableGroups[] = $applicable;
+            $storageConfig->setApplicableGroups($applicableGroups);
+        }
+        return $storageConfig;
+    }
 
-	/**
-	 * Read the external storages config
-	 *
-	 * @return StorageConfig[] map of storage id to storage config
-	 */
-	public function getAllStorages() {
-		$mountPoints = $this->readLegacyConfig();
-		/**
-		 * Here is the how the horribly messy mount point array looks like
-		 * from the mount.json file:
-		 *
-		 * $storageOptions = $mountPoints[$mountType][$applicable][$mountPath]
-		 *
-		 * - $mountType is either "user" or "group"
-		 * - $applicable is the name of a user or group (or the current user for personal mounts)
-		 * - $mountPath is the mount point path (where the storage must be mounted)
-		 * - $storageOptions is a map of storage options:
-		 *     - "priority": storage priority
-		 *     - "backend": backend identifier
-		 *     - "class": LEGACY backend class name
-		 *     - "options": backend-specific options
-		 *     - "authMechanism": authentication mechanism identifier
-		 *     - "mountOptions": mount-specific options (ex: disable previews, scanner, etc)
-		 */
-		// group by storage id
-		/** @var StorageConfig[] $storages */
-		$storages = [];
-		// for storages without id (legacy), group by config hash for
-		// later processing
-		$storagesWithConfigHash = [];
-		foreach ($mountPoints as $mountType => $applicables) {
-			foreach ($applicables as $applicable => $mountPaths) {
-				foreach ($mountPaths as $rootMountPath => $storageOptions) {
-					$currentStorage = null;
-					/**
-					 * Flag whether the config that was read already has an id.
-					 * If not, it will use a config hash instead and generate
-					 * a proper id later
-					 *
-					 * @var boolean
-					 */
-					$hasId = false;
-					// the root mount point is in the format "/$user/files/the/mount/point"
-					// we remove the "/$user/files" prefix
-					$parts = explode('/', ltrim($rootMountPath, '/'), 3);
-					if (count($parts) < 3) {
-						// something went wrong, skip
-						\OC::$server->getLogger()->error('Could not parse mount point "' . $rootMountPath . '"', ['app' => 'files_external']);
-						continue;
-					}
-					$relativeMountPath = rtrim($parts[2], '/');
-					// note: we cannot do this after the loop because the decrypted config
-					// options might be needed for the config hash
-					$storageOptions['options'] = \OC_Mount_Config::decryptPasswords($storageOptions['options']);
-					if (!isset($storageOptions['backend'])) {
-						$storageOptions['backend'] = $storageOptions['class']; // legacy compat
-					}
-					if (!isset($storageOptions['authMechanism'])) {
-						$storageOptions['authMechanism'] = null; // ensure config hash works
-					}
-					if (isset($storageOptions['id'])) {
-						$configId = (int)$storageOptions['id'];
-						if (isset($storages[$configId])) {
-							$currentStorage = $storages[$configId];
-						}
-						$hasId = true;
-					} else {
-						// missing id in legacy config, need to generate
-						// but at this point we don't know the max-id, so use
-						// first group it by config hash
-						$storageOptions['mountpoint'] = $rootMountPath;
-						$configId = \OC_Mount_Config::makeConfigHash($storageOptions);
-						if (isset($storagesWithConfigHash[$configId])) {
-							$currentStorage = $storagesWithConfigHash[$configId];
-						}
-					}
-					if (is_null($currentStorage)) {
-						// create new
-						$currentStorage = new StorageConfig($configId);
-						$currentStorage->setMountPoint($relativeMountPath);
-					}
-					try {
-						$this->populateStorageConfigWithLegacyOptions(
-							$currentStorage,
-							$mountType,
-							$applicable,
-							$storageOptions
-						);
-						if ($hasId) {
-							$storages[$configId] = $currentStorage;
-						} else {
-							$storagesWithConfigHash[$configId] = $currentStorage;
-						}
-					} catch (\UnexpectedValueException $e) {
-						// don't die if a storage backend doesn't exist
-						\OC::$server->getLogger()->logException($e, [
-							'message' => 'Could not load storage.',
-							'level' => ILogger::ERROR,
-							'app' => 'files_external',
-						]);
-					}
-				}
-			}
-		}
+    /**
+     * Read the external storages config
+     *
+     * @return StorageConfig[] map of storage id to storage config
+     */
+    public function getAllStorages() {
+        $mountPoints = $this->readLegacyConfig();
+        /**
+         * Here is the how the horribly messy mount point array looks like
+         * from the mount.json file:
+         *
+         * $storageOptions = $mountPoints[$mountType][$applicable][$mountPath]
+         *
+         * - $mountType is either "user" or "group"
+         * - $applicable is the name of a user or group (or the current user for personal mounts)
+         * - $mountPath is the mount point path (where the storage must be mounted)
+         * - $storageOptions is a map of storage options:
+         *     - "priority": storage priority
+         *     - "backend": backend identifier
+         *     - "class": LEGACY backend class name
+         *     - "options": backend-specific options
+         *     - "authMechanism": authentication mechanism identifier
+         *     - "mountOptions": mount-specific options (ex: disable previews, scanner, etc)
+         */
+        // group by storage id
+        /** @var StorageConfig[] $storages */
+        $storages = [];
+        // for storages without id (legacy), group by config hash for
+        // later processing
+        $storagesWithConfigHash = [];
+        foreach ($mountPoints as $mountType => $applicables) {
+            foreach ($applicables as $applicable => $mountPaths) {
+                foreach ($mountPaths as $rootMountPath => $storageOptions) {
+                    $currentStorage = null;
+                    /**
+                     * Flag whether the config that was read already has an id.
+                     * If not, it will use a config hash instead and generate
+                     * a proper id later
+                     *
+                     * @var boolean
+                     */
+                    $hasId = false;
+                    // the root mount point is in the format "/$user/files/the/mount/point"
+                    // we remove the "/$user/files" prefix
+                    $parts = explode('/', ltrim($rootMountPath, '/'), 3);
+                    if (count($parts) < 3) {
+                        // something went wrong, skip
+                        \OC::$server->getLogger()->error('Could not parse mount point "' . $rootMountPath . '"', ['app' => 'files_external']);
+                        continue;
+                    }
+                    $relativeMountPath = rtrim($parts[2], '/');
+                    // note: we cannot do this after the loop because the decrypted config
+                    // options might be needed for the config hash
+                    $storageOptions['options'] = \OC_Mount_Config::decryptPasswords($storageOptions['options']);
+                    if (!isset($storageOptions['backend'])) {
+                        $storageOptions['backend'] = $storageOptions['class']; // legacy compat
+                    }
+                    if (!isset($storageOptions['authMechanism'])) {
+                        $storageOptions['authMechanism'] = null; // ensure config hash works
+                    }
+                    if (isset($storageOptions['id'])) {
+                        $configId = (int)$storageOptions['id'];
+                        if (isset($storages[$configId])) {
+                            $currentStorage = $storages[$configId];
+                        }
+                        $hasId = true;
+                    } else {
+                        // missing id in legacy config, need to generate
+                        // but at this point we don't know the max-id, so use
+                        // first group it by config hash
+                        $storageOptions['mountpoint'] = $rootMountPath;
+                        $configId = \OC_Mount_Config::makeConfigHash($storageOptions);
+                        if (isset($storagesWithConfigHash[$configId])) {
+                            $currentStorage = $storagesWithConfigHash[$configId];
+                        }
+                    }
+                    if (is_null($currentStorage)) {
+                        // create new
+                        $currentStorage = new StorageConfig($configId);
+                        $currentStorage->setMountPoint($relativeMountPath);
+                    }
+                    try {
+                        $this->populateStorageConfigWithLegacyOptions(
+                            $currentStorage,
+                            $mountType,
+                            $applicable,
+                            $storageOptions
+                        );
+                        if ($hasId) {
+                            $storages[$configId] = $currentStorage;
+                        } else {
+                            $storagesWithConfigHash[$configId] = $currentStorage;
+                        }
+                    } catch (\UnexpectedValueException $e) {
+                        // don't die if a storage backend doesn't exist
+                        \OC::$server->getLogger()->logException($e, [
+                            'message' => 'Could not load storage.',
+                            'level' => ILogger::ERROR,
+                            'app' => 'files_external',
+                        ]);
+                    }
+                }
+            }
+        }
 
-		// convert parameter values
-		foreach ($storages as $storage) {
-			$storage->getBackend()->validateStorageDefinition($storage);
-			$storage->getAuthMechanism()->validateStorageDefinition($storage);
-		}
-		return $storages;
-	}
+        // convert parameter values
+        foreach ($storages as $storage) {
+            $storage->getBackend()->validateStorageDefinition($storage);
+            $storage->getAuthMechanism()->validateStorageDefinition($storage);
+        }
+        return $storages;
+    }
 }

apps/files_external/lib/Service/StoragesService.php

Indentation +489 added lines, -489 removed lines

@@ -44,493 +44,493 @@
  */
 abstract class StoragesService {
 
-	/** @var BackendService */
-	protected $backendService;
-
-	/**
-	 * @var DBConfigService
-	 */
-	protected $dbConfig;
-
-	/**
-	 * @var IUserMountCache
-	 */
-	protected $userMountCache;
-
-	/**
-	 * @param BackendService $backendService
-	 * @param DBConfigService $dbConfigService
-	 * @param IUserMountCache $userMountCache
-	 */
-	public function __construct(BackendService $backendService, DBConfigService $dbConfigService, IUserMountCache $userMountCache) {
-		$this->backendService = $backendService;
-		$this->dbConfig = $dbConfigService;
-		$this->userMountCache = $userMountCache;
-	}
-
-	protected function readDBConfig() {
-		return $this->dbConfig->getAdminMounts();
-	}
-
-	protected function getStorageConfigFromDBMount(array $mount) {
-		$applicableUsers = array_filter($mount['applicable'], function ($applicable) {
-			return $applicable['type'] === DBConfigService::APPLICABLE_TYPE_USER;
-		});
-		$applicableUsers = array_map(function ($applicable) {
-			return $applicable['value'];
-		}, $applicableUsers);
-
-		$applicableGroups = array_filter($mount['applicable'], function ($applicable) {
-			return $applicable['type'] === DBConfigService::APPLICABLE_TYPE_GROUP;
-		});
-		$applicableGroups = array_map(function ($applicable) {
-			return $applicable['value'];
-		}, $applicableGroups);
-
-		try {
-			$config = $this->createStorage(
-				$mount['mount_point'],
-				$mount['storage_backend'],
-				$mount['auth_backend'],
-				$mount['config'],
-				$mount['options'],
-				array_values($applicableUsers),
-				array_values($applicableGroups),
-				$mount['priority']
-			);
-			$config->setType($mount['type']);
-			$config->setId((int)$mount['mount_id']);
-			return $config;
-		} catch (\UnexpectedValueException $e) {
-			// don't die if a storage backend doesn't exist
-			\OC::$server->getLogger()->logException($e, [
-				'message' => 'Could not load storage.',
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-			return null;
-		} catch (\InvalidArgumentException $e) {
-			\OC::$server->getLogger()->logException($e, [
-				'message' => 'Could not load storage.',
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-			return null;
-		}
-	}
-
-	/**
-	 * Read the external storages config
-	 *
-	 * @return array map of storage id to storage config
-	 */
-	protected function readConfig() {
-		$mounts = $this->readDBConfig();
-		$configs = array_map([$this, 'getStorageConfigFromDBMount'], $mounts);
-		$configs = array_filter($configs, function ($config) {
-			return $config instanceof StorageConfig;
-		});
-
-		$keys = array_map(function (StorageConfig $config) {
-			return $config->getId();
-		}, $configs);
-
-		return array_combine($keys, $configs);
-	}
-
-	/**
-	 * Get a storage with status
-	 *
-	 * @param int $id storage id
-	 *
-	 * @return StorageConfig
-	 * @throws NotFoundException if the storage with the given id was not found
-	 */
-	public function getStorage($id) {
-		$mount = $this->dbConfig->getMountById($id);
-
-		if (!is_array($mount)) {
-			throw new NotFoundException('Storage with ID "' . $id . '" not found');
-		}
-
-		$config = $this->getStorageConfigFromDBMount($mount);
-		if ($this->isApplicable($config)) {
-			return $config;
-		} else {
-			throw new NotFoundException('Storage with ID "' . $id . '" not found');
-		}
-	}
-
-	/**
-	 * Check whether this storage service should provide access to a storage
-	 *
-	 * @param StorageConfig $config
-	 * @return bool
-	 */
-	abstract protected function isApplicable(StorageConfig $config);
-
-	/**
-	 * Gets all storages, valid or not
-	 *
-	 * @return StorageConfig[] array of storage configs
-	 */
-	public function getAllStorages() {
-		return $this->readConfig();
-	}
-
-	/**
-	 * Gets all valid storages
-	 *
-	 * @return StorageConfig[]
-	 */
-	public function getStorages() {
-		return array_filter($this->getAllStorages(), [$this, 'validateStorage']);
-	}
-
-	/**
-	 * Validate storage
-	 * FIXME: De-duplicate with StoragesController::validate()
-	 *
-	 * @param StorageConfig $storage
-	 * @return bool
-	 */
-	protected function validateStorage(StorageConfig $storage) {
-		/** @var Backend */
-		$backend = $storage->getBackend();
-		/** @var AuthMechanism */
-		$authMechanism = $storage->getAuthMechanism();
-
-		if (!$backend->isVisibleFor($this->getVisibilityType())) {
-			// not permitted to use backend
-			return false;
-		}
-		if (!$authMechanism->isVisibleFor($this->getVisibilityType())) {
-			// not permitted to use auth mechanism
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * Get the visibility type for this controller, used in validation
-	 *
-	 * @return string BackendService::VISIBILITY_* constants
-	 */
-	abstract public function getVisibilityType();
-
-	/**
-	 * @return integer
-	 */
-	protected function getType() {
-		return DBConfigService::MOUNT_TYPE_ADMIN;
-	}
-
-	/**
-	 * Add new storage to the configuration
-	 *
-	 * @param StorageConfig $newStorage storage attributes
-	 *
-	 * @return StorageConfig storage config, with added id
-	 */
-	public function addStorage(StorageConfig $newStorage) {
-		$allStorages = $this->readConfig();
-
-		$configId = $this->dbConfig->addMount(
-			$newStorage->getMountPoint(),
-			$newStorage->getBackend()->getIdentifier(),
-			$newStorage->getAuthMechanism()->getIdentifier(),
-			$newStorage->getPriority(),
-			$this->getType()
-		);
-
-		$newStorage->setId($configId);
-
-		foreach ($newStorage->getApplicableUsers() as $user) {
-			$this->dbConfig->addApplicable($configId, DBConfigService::APPLICABLE_TYPE_USER, $user);
-		}
-		foreach ($newStorage->getApplicableGroups() as $group) {
-			$this->dbConfig->addApplicable($configId, DBConfigService::APPLICABLE_TYPE_GROUP, $group);
-		}
-		foreach ($newStorage->getBackendOptions() as $key => $value) {
-			$this->dbConfig->setConfig($configId, $key, $value);
-		}
-		foreach ($newStorage->getMountOptions() as $key => $value) {
-			$this->dbConfig->setOption($configId, $key, $value);
-		}
-
-		if (count($newStorage->getApplicableUsers()) === 0 && count($newStorage->getApplicableGroups()) === 0) {
-			$this->dbConfig->addApplicable($configId, DBConfigService::APPLICABLE_TYPE_GLOBAL, null);
-		}
-
-		// add new storage
-		$allStorages[$configId] = $newStorage;
-
-		$this->triggerHooks($newStorage, Filesystem::signal_create_mount);
-
-		$newStorage->setStatus(StorageNotAvailableException::STATUS_SUCCESS);
-		return $newStorage;
-	}
-
-	/**
-	 * Create a storage from its parameters
-	 *
-	 * @param string $mountPoint storage mount point
-	 * @param string $backendIdentifier backend identifier
-	 * @param string $authMechanismIdentifier authentication mechanism identifier
-	 * @param array $backendOptions backend-specific options
-	 * @param array|null $mountOptions mount-specific options
-	 * @param array|null $applicableUsers users for which to mount the storage
-	 * @param array|null $applicableGroups groups for which to mount the storage
-	 * @param int|null $priority priority
-	 *
-	 * @return StorageConfig
-	 */
-	public function createStorage(
-		$mountPoint,
-		$backendIdentifier,
-		$authMechanismIdentifier,
-		$backendOptions,
-		$mountOptions = null,
-		$applicableUsers = null,
-		$applicableGroups = null,
-		$priority = null
-	) {
-		$backend = $this->backendService->getBackend($backendIdentifier);
-		if (!$backend) {
-			$backend = new InvalidBackend($backendIdentifier);
-		}
-		$authMechanism = $this->backendService->getAuthMechanism($authMechanismIdentifier);
-		if (!$authMechanism) {
-			$authMechanism = new InvalidAuth($authMechanismIdentifier);
-		}
-		$newStorage = new StorageConfig();
-		$newStorage->setMountPoint($mountPoint);
-		$newStorage->setBackend($backend);
-		$newStorage->setAuthMechanism($authMechanism);
-		$newStorage->setBackendOptions($backendOptions);
-		if (isset($mountOptions)) {
-			$newStorage->setMountOptions($mountOptions);
-		}
-		if (isset($applicableUsers)) {
-			$newStorage->setApplicableUsers($applicableUsers);
-		}
-		if (isset($applicableGroups)) {
-			$newStorage->setApplicableGroups($applicableGroups);
-		}
-		if (isset($priority)) {
-			$newStorage->setPriority($priority);
-		}
-
-		return $newStorage;
-	}
-
-	/**
-	 * Triggers the given hook signal for all the applicables given
-	 *
-	 * @param string $signal signal
-	 * @param string $mountPoint hook mount pount param
-	 * @param string $mountType hook mount type param
-	 * @param array $applicableArray array of applicable users/groups for which to trigger the hook
-	 */
-	protected function triggerApplicableHooks($signal, $mountPoint, $mountType, $applicableArray) {
-		foreach ($applicableArray as $applicable) {
-			\OCP\Util::emitHook(
-				Filesystem::CLASSNAME,
-				$signal,
-				[
-					Filesystem::signal_param_path => $mountPoint,
-					Filesystem::signal_param_mount_type => $mountType,
-					Filesystem::signal_param_users => $applicable,
-				]
-			);
-		}
-	}
-
-	/**
-	 * Triggers $signal for all applicable users of the given
-	 * storage
-	 *
-	 * @param StorageConfig $storage storage data
-	 * @param string $signal signal to trigger
-	 */
-	abstract protected function triggerHooks(StorageConfig $storage, $signal);
-
-	/**
-	 * Triggers signal_create_mount or signal_delete_mount to
-	 * accommodate for additions/deletions in applicableUsers
-	 * and applicableGroups fields.
-	 *
-	 * @param StorageConfig $oldStorage old storage data
-	 * @param StorageConfig $newStorage new storage data
-	 */
-	abstract protected function triggerChangeHooks(StorageConfig $oldStorage, StorageConfig $newStorage);
-
-	/**
-	 * Update storage to the configuration
-	 *
-	 * @param StorageConfig $updatedStorage storage attributes
-	 *
-	 * @return StorageConfig storage config
-	 * @throws NotFoundException if the given storage does not exist in the config
-	 */
-	public function updateStorage(StorageConfig $updatedStorage) {
-		$id = $updatedStorage->getId();
-
-		$existingMount = $this->dbConfig->getMountById($id);
-
-		if (!is_array($existingMount)) {
-			throw new NotFoundException('Storage with ID "' . $id . '" not found while updating storage');
-		}
-
-		$oldStorage = $this->getStorageConfigFromDBMount($existingMount);
-
-		if ($oldStorage->getBackend() instanceof InvalidBackend) {
-			throw new NotFoundException('Storage with id "' . $id . '" cannot be edited due to missing backend');
-		}
-
-		$removedUsers = array_diff($oldStorage->getApplicableUsers(), $updatedStorage->getApplicableUsers());
-		$removedGroups = array_diff($oldStorage->getApplicableGroups(), $updatedStorage->getApplicableGroups());
-		$addedUsers = array_diff($updatedStorage->getApplicableUsers(), $oldStorage->getApplicableUsers());
-		$addedGroups = array_diff($updatedStorage->getApplicableGroups(), $oldStorage->getApplicableGroups());
-
-		$oldUserCount = count($oldStorage->getApplicableUsers());
-		$oldGroupCount = count($oldStorage->getApplicableGroups());
-		$newUserCount = count($updatedStorage->getApplicableUsers());
-		$newGroupCount = count($updatedStorage->getApplicableGroups());
-		$wasGlobal = ($oldUserCount + $oldGroupCount) === 0;
-		$isGlobal = ($newUserCount + $newGroupCount) === 0;
-
-		foreach ($removedUsers as $user) {
-			$this->dbConfig->removeApplicable($id, DBConfigService::APPLICABLE_TYPE_USER, $user);
-		}
-		foreach ($removedGroups as $group) {
-			$this->dbConfig->removeApplicable($id, DBConfigService::APPLICABLE_TYPE_GROUP, $group);
-		}
-		foreach ($addedUsers as $user) {
-			$this->dbConfig->addApplicable($id, DBConfigService::APPLICABLE_TYPE_USER, $user);
-		}
-		foreach ($addedGroups as $group) {
-			$this->dbConfig->addApplicable($id, DBConfigService::APPLICABLE_TYPE_GROUP, $group);
-		}
-
-		if ($wasGlobal && !$isGlobal) {
-			$this->dbConfig->removeApplicable($id, DBConfigService::APPLICABLE_TYPE_GLOBAL, null);
-		} else if (!$wasGlobal && $isGlobal) {
-			$this->dbConfig->addApplicable($id, DBConfigService::APPLICABLE_TYPE_GLOBAL, null);
-		}
-
-		$changedConfig = array_diff_assoc($updatedStorage->getBackendOptions(), $oldStorage->getBackendOptions());
-		$changedOptions = array_diff_assoc($updatedStorage->getMountOptions(), $oldStorage->getMountOptions());
-
-		foreach ($changedConfig as $key => $value) {
-			$this->dbConfig->setConfig($id, $key, $value);
-		}
-		foreach ($changedOptions as $key => $value) {
-			$this->dbConfig->setOption($id, $key, $value);
-		}
-
-		if ($updatedStorage->getMountPoint() !== $oldStorage->getMountPoint()) {
-			$this->dbConfig->setMountPoint($id, $updatedStorage->getMountPoint());
-		}
-
-		if ($updatedStorage->getAuthMechanism()->getIdentifier() !== $oldStorage->getAuthMechanism()->getIdentifier()) {
-			$this->dbConfig->setAuthBackend($id, $updatedStorage->getAuthMechanism()->getIdentifier());
-		}
-
-		$this->triggerChangeHooks($oldStorage, $updatedStorage);
-
-		if (($wasGlobal && !$isGlobal) || count($removedGroups) > 0) { // to expensive to properly handle these on the fly
-			$this->userMountCache->remoteStorageMounts($this->getStorageId($updatedStorage));
-		} else {
-			$storageId = $this->getStorageId($updatedStorage);
-			foreach ($removedUsers as $userId) {
-				$this->userMountCache->removeUserStorageMount($storageId, $userId);
-			}
-		}
-
-		return $this->getStorage($id);
-	}
-
-	/**
-	 * Delete the storage with the given id.
-	 *
-	 * @param int $id storage id
-	 *
-	 * @throws NotFoundException if no storage was found with the given id
-	 */
-	public function removeStorage($id) {
-		$existingMount = $this->dbConfig->getMountById($id);
-
-		if (!is_array($existingMount)) {
-			throw new NotFoundException('Storage with ID "' . $id . '" not found');
-		}
-
-		$this->dbConfig->removeMount($id);
-
-		$deletedStorage = $this->getStorageConfigFromDBMount($existingMount);
-		$this->triggerHooks($deletedStorage, Filesystem::signal_delete_mount);
-
-		// delete oc_storages entries and oc_filecache
-		try {
-			$rustyStorageId = $this->getRustyStorageIdFromConfig($deletedStorage);
-			\OC\Files\Cache\Storage::remove($rustyStorageId);
-		} catch (\Exception $e) {
-			// can happen either for invalid configs where the storage could not
-			// be instantiated or whenever $user vars where used, in which case
-			// the storage id could not be computed
-			\OC::$server->getLogger()->logException($e, [
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-		}
-	}
-
-	/**
-	 * Returns the rusty storage id from oc_storages from the given storage config.
-	 *
-	 * @param StorageConfig $storageConfig
-	 * @return string rusty storage id
-	 */
-	private function getRustyStorageIdFromConfig(StorageConfig $storageConfig) {
-		// if any of the storage options contains $user, it is not possible
-		// to compute the possible storage id as we don't know which users
-		// mounted it already (and we certainly don't want to iterate over ALL users)
-		foreach ($storageConfig->getBackendOptions() as $value) {
-			if (strpos($value, '$user') !== false) {
-				throw new \Exception('Cannot compute storage id for deletion due to $user vars in the configuration');
-			}
-		}
-
-		// note: similar to ConfigAdapter->prepateStorageConfig()
-		$storageConfig->getAuthMechanism()->manipulateStorageConfig($storageConfig);
-		$storageConfig->getBackend()->manipulateStorageConfig($storageConfig);
-
-		$class = $storageConfig->getBackend()->getStorageClass();
-		$storageImpl = new $class($storageConfig->getBackendOptions());
-
-		return $storageImpl->getId();
-	}
-
-	/**
-	 * Construct the storage implementation
-	 *
-	 * @param StorageConfig $storageConfig
-	 * @return int
-	 */
-	private function getStorageId(StorageConfig $storageConfig) {
-		try {
-			$class = $storageConfig->getBackend()->getStorageClass();
-			/** @var \OC\Files\Storage\Storage $storage */
-			$storage = new $class($storageConfig->getBackendOptions());
-
-			// auth mechanism should fire first
-			$storage = $storageConfig->getBackend()->wrapStorage($storage);
-			$storage = $storageConfig->getAuthMechanism()->wrapStorage($storage);
-
-			return $storage->getStorageCache()->getNumericId();
-		} catch (\Exception $e) {
-			return -1;
-		}
-	}
+    /** @var BackendService */
+    protected $backendService;
+
+    /**
+     * @var DBConfigService
+     */
+    protected $dbConfig;
+
+    /**
+     * @var IUserMountCache
+     */
+    protected $userMountCache;
+
+    /**
+     * @param BackendService $backendService
+     * @param DBConfigService $dbConfigService
+     * @param IUserMountCache $userMountCache
+     */
+    public function __construct(BackendService $backendService, DBConfigService $dbConfigService, IUserMountCache $userMountCache) {
+        $this->backendService = $backendService;
+        $this->dbConfig = $dbConfigService;
+        $this->userMountCache = $userMountCache;
+    }
+
+    protected function readDBConfig() {
+        return $this->dbConfig->getAdminMounts();
+    }
+
+    protected function getStorageConfigFromDBMount(array $mount) {
+        $applicableUsers = array_filter($mount['applicable'], function ($applicable) {
+            return $applicable['type'] === DBConfigService::APPLICABLE_TYPE_USER;
+        });
+        $applicableUsers = array_map(function ($applicable) {
+            return $applicable['value'];
+        }, $applicableUsers);
+
+        $applicableGroups = array_filter($mount['applicable'], function ($applicable) {
+            return $applicable['type'] === DBConfigService::APPLICABLE_TYPE_GROUP;
+        });
+        $applicableGroups = array_map(function ($applicable) {
+            return $applicable['value'];
+        }, $applicableGroups);
+
+        try {
+            $config = $this->createStorage(
+                $mount['mount_point'],
+                $mount['storage_backend'],
+                $mount['auth_backend'],
+                $mount['config'],
+                $mount['options'],
+                array_values($applicableUsers),
+                array_values($applicableGroups),
+                $mount['priority']
+            );
+            $config->setType($mount['type']);
+            $config->setId((int)$mount['mount_id']);
+            return $config;
+        } catch (\UnexpectedValueException $e) {
+            // don't die if a storage backend doesn't exist
+            \OC::$server->getLogger()->logException($e, [
+                'message' => 'Could not load storage.',
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+            return null;
+        } catch (\InvalidArgumentException $e) {
+            \OC::$server->getLogger()->logException($e, [
+                'message' => 'Could not load storage.',
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+            return null;
+        }
+    }
+
+    /**
+     * Read the external storages config
+     *
+     * @return array map of storage id to storage config
+     */
+    protected function readConfig() {
+        $mounts = $this->readDBConfig();
+        $configs = array_map([$this, 'getStorageConfigFromDBMount'], $mounts);
+        $configs = array_filter($configs, function ($config) {
+            return $config instanceof StorageConfig;
+        });
+
+        $keys = array_map(function (StorageConfig $config) {
+            return $config->getId();
+        }, $configs);
+
+        return array_combine($keys, $configs);
+    }
+
+    /**
+     * Get a storage with status
+     *
+     * @param int $id storage id
+     *
+     * @return StorageConfig
+     * @throws NotFoundException if the storage with the given id was not found
+     */
+    public function getStorage($id) {
+        $mount = $this->dbConfig->getMountById($id);
+
+        if (!is_array($mount)) {
+            throw new NotFoundException('Storage with ID "' . $id . '" not found');
+        }
+
+        $config = $this->getStorageConfigFromDBMount($mount);
+        if ($this->isApplicable($config)) {
+            return $config;
+        } else {
+            throw new NotFoundException('Storage with ID "' . $id . '" not found');
+        }
+    }
+
+    /**
+     * Check whether this storage service should provide access to a storage
+     *
+     * @param StorageConfig $config
+     * @return bool
+     */
+    abstract protected function isApplicable(StorageConfig $config);
+
+    /**
+     * Gets all storages, valid or not
+     *
+     * @return StorageConfig[] array of storage configs
+     */
+    public function getAllStorages() {
+        return $this->readConfig();
+    }
+
+    /**
+     * Gets all valid storages
+     *
+     * @return StorageConfig[]
+     */
+    public function getStorages() {
+        return array_filter($this->getAllStorages(), [$this, 'validateStorage']);
+    }
+
+    /**
+     * Validate storage
+     * FIXME: De-duplicate with StoragesController::validate()
+     *
+     * @param StorageConfig $storage
+     * @return bool
+     */
+    protected function validateStorage(StorageConfig $storage) {
+        /** @var Backend */
+        $backend = $storage->getBackend();
+        /** @var AuthMechanism */
+        $authMechanism = $storage->getAuthMechanism();
+
+        if (!$backend->isVisibleFor($this->getVisibilityType())) {
+            // not permitted to use backend
+            return false;
+        }
+        if (!$authMechanism->isVisibleFor($this->getVisibilityType())) {
+            // not permitted to use auth mechanism
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Get the visibility type for this controller, used in validation
+     *
+     * @return string BackendService::VISIBILITY_* constants
+     */
+    abstract public function getVisibilityType();
+
+    /**
+     * @return integer
+     */
+    protected function getType() {
+        return DBConfigService::MOUNT_TYPE_ADMIN;
+    }
+
+    /**
+     * Add new storage to the configuration
+     *
+     * @param StorageConfig $newStorage storage attributes
+     *
+     * @return StorageConfig storage config, with added id
+     */
+    public function addStorage(StorageConfig $newStorage) {
+        $allStorages = $this->readConfig();
+
+        $configId = $this->dbConfig->addMount(
+            $newStorage->getMountPoint(),
+            $newStorage->getBackend()->getIdentifier(),
+            $newStorage->getAuthMechanism()->getIdentifier(),
+            $newStorage->getPriority(),
+            $this->getType()
+        );
+
+        $newStorage->setId($configId);
+
+        foreach ($newStorage->getApplicableUsers() as $user) {
+            $this->dbConfig->addApplicable($configId, DBConfigService::APPLICABLE_TYPE_USER, $user);
+        }
+        foreach ($newStorage->getApplicableGroups() as $group) {
+            $this->dbConfig->addApplicable($configId, DBConfigService::APPLICABLE_TYPE_GROUP, $group);
+        }
+        foreach ($newStorage->getBackendOptions() as $key => $value) {
+            $this->dbConfig->setConfig($configId, $key, $value);
+        }
+        foreach ($newStorage->getMountOptions() as $key => $value) {
+            $this->dbConfig->setOption($configId, $key, $value);
+        }
+
+        if (count($newStorage->getApplicableUsers()) === 0 && count($newStorage->getApplicableGroups()) === 0) {
+            $this->dbConfig->addApplicable($configId, DBConfigService::APPLICABLE_TYPE_GLOBAL, null);
+        }
+
+        // add new storage
+        $allStorages[$configId] = $newStorage;
+
+        $this->triggerHooks($newStorage, Filesystem::signal_create_mount);
+
+        $newStorage->setStatus(StorageNotAvailableException::STATUS_SUCCESS);
+        return $newStorage;
+    }
+
+    /**
+     * Create a storage from its parameters
+     *
+     * @param string $mountPoint storage mount point
+     * @param string $backendIdentifier backend identifier
+     * @param string $authMechanismIdentifier authentication mechanism identifier
+     * @param array $backendOptions backend-specific options
+     * @param array|null $mountOptions mount-specific options
+     * @param array|null $applicableUsers users for which to mount the storage
+     * @param array|null $applicableGroups groups for which to mount the storage
+     * @param int|null $priority priority
+     *
+     * @return StorageConfig
+     */
+    public function createStorage(
+        $mountPoint,
+        $backendIdentifier,
+        $authMechanismIdentifier,
+        $backendOptions,
+        $mountOptions = null,
+        $applicableUsers = null,
+        $applicableGroups = null,
+        $priority = null
+    ) {
+        $backend = $this->backendService->getBackend($backendIdentifier);
+        if (!$backend) {
+            $backend = new InvalidBackend($backendIdentifier);
+        }
+        $authMechanism = $this->backendService->getAuthMechanism($authMechanismIdentifier);
+        if (!$authMechanism) {
+            $authMechanism = new InvalidAuth($authMechanismIdentifier);
+        }
+        $newStorage = new StorageConfig();
+        $newStorage->setMountPoint($mountPoint);
+        $newStorage->setBackend($backend);
+        $newStorage->setAuthMechanism($authMechanism);
+        $newStorage->setBackendOptions($backendOptions);
+        if (isset($mountOptions)) {
+            $newStorage->setMountOptions($mountOptions);
+        }
+        if (isset($applicableUsers)) {
+            $newStorage->setApplicableUsers($applicableUsers);
+        }
+        if (isset($applicableGroups)) {
+            $newStorage->setApplicableGroups($applicableGroups);
+        }
+        if (isset($priority)) {
+            $newStorage->setPriority($priority);
+        }
+
+        return $newStorage;
+    }
+
+    /**
+     * Triggers the given hook signal for all the applicables given
+     *
+     * @param string $signal signal
+     * @param string $mountPoint hook mount pount param
+     * @param string $mountType hook mount type param
+     * @param array $applicableArray array of applicable users/groups for which to trigger the hook
+     */
+    protected function triggerApplicableHooks($signal, $mountPoint, $mountType, $applicableArray) {
+        foreach ($applicableArray as $applicable) {
+            \OCP\Util::emitHook(
+                Filesystem::CLASSNAME,
+                $signal,
+                [
+                    Filesystem::signal_param_path => $mountPoint,
+                    Filesystem::signal_param_mount_type => $mountType,
+                    Filesystem::signal_param_users => $applicable,
+                ]
+            );
+        }
+    }
+
+    /**
+     * Triggers $signal for all applicable users of the given
+     * storage
+     *
+     * @param StorageConfig $storage storage data
+     * @param string $signal signal to trigger
+     */
+    abstract protected function triggerHooks(StorageConfig $storage, $signal);
+
+    /**
+     * Triggers signal_create_mount or signal_delete_mount to
+     * accommodate for additions/deletions in applicableUsers
+     * and applicableGroups fields.
+     *
+     * @param StorageConfig $oldStorage old storage data
+     * @param StorageConfig $newStorage new storage data
+     */
+    abstract protected function triggerChangeHooks(StorageConfig $oldStorage, StorageConfig $newStorage);
+
+    /**
+     * Update storage to the configuration
+     *
+     * @param StorageConfig $updatedStorage storage attributes
+     *
+     * @return StorageConfig storage config
+     * @throws NotFoundException if the given storage does not exist in the config
+     */
+    public function updateStorage(StorageConfig $updatedStorage) {
+        $id = $updatedStorage->getId();
+
+        $existingMount = $this->dbConfig->getMountById($id);
+
+        if (!is_array($existingMount)) {
+            throw new NotFoundException('Storage with ID "' . $id . '" not found while updating storage');
+        }
+
+        $oldStorage = $this->getStorageConfigFromDBMount($existingMount);
+
+        if ($oldStorage->getBackend() instanceof InvalidBackend) {
+            throw new NotFoundException('Storage with id "' . $id . '" cannot be edited due to missing backend');
+        }
+
+        $removedUsers = array_diff($oldStorage->getApplicableUsers(), $updatedStorage->getApplicableUsers());
+        $removedGroups = array_diff($oldStorage->getApplicableGroups(), $updatedStorage->getApplicableGroups());
+        $addedUsers = array_diff($updatedStorage->getApplicableUsers(), $oldStorage->getApplicableUsers());
+        $addedGroups = array_diff($updatedStorage->getApplicableGroups(), $oldStorage->getApplicableGroups());
+
+        $oldUserCount = count($oldStorage->getApplicableUsers());
+        $oldGroupCount = count($oldStorage->getApplicableGroups());
+        $newUserCount = count($updatedStorage->getApplicableUsers());
+        $newGroupCount = count($updatedStorage->getApplicableGroups());
+        $wasGlobal = ($oldUserCount + $oldGroupCount) === 0;
+        $isGlobal = ($newUserCount + $newGroupCount) === 0;
+
+        foreach ($removedUsers as $user) {
+            $this->dbConfig->removeApplicable($id, DBConfigService::APPLICABLE_TYPE_USER, $user);
+        }
+        foreach ($removedGroups as $group) {
+            $this->dbConfig->removeApplicable($id, DBConfigService::APPLICABLE_TYPE_GROUP, $group);
+        }
+        foreach ($addedUsers as $user) {
+            $this->dbConfig->addApplicable($id, DBConfigService::APPLICABLE_TYPE_USER, $user);
+        }
+        foreach ($addedGroups as $group) {
+            $this->dbConfig->addApplicable($id, DBConfigService::APPLICABLE_TYPE_GROUP, $group);
+        }
+
+        if ($wasGlobal && !$isGlobal) {
+            $this->dbConfig->removeApplicable($id, DBConfigService::APPLICABLE_TYPE_GLOBAL, null);
+        } else if (!$wasGlobal && $isGlobal) {
+            $this->dbConfig->addApplicable($id, DBConfigService::APPLICABLE_TYPE_GLOBAL, null);
+        }
+
+        $changedConfig = array_diff_assoc($updatedStorage->getBackendOptions(), $oldStorage->getBackendOptions());
+        $changedOptions = array_diff_assoc($updatedStorage->getMountOptions(), $oldStorage->getMountOptions());
+
+        foreach ($changedConfig as $key => $value) {
+            $this->dbConfig->setConfig($id, $key, $value);
+        }
+        foreach ($changedOptions as $key => $value) {
+            $this->dbConfig->setOption($id, $key, $value);
+        }
+
+        if ($updatedStorage->getMountPoint() !== $oldStorage->getMountPoint()) {
+            $this->dbConfig->setMountPoint($id, $updatedStorage->getMountPoint());
+        }
+
+        if ($updatedStorage->getAuthMechanism()->getIdentifier() !== $oldStorage->getAuthMechanism()->getIdentifier()) {
+            $this->dbConfig->setAuthBackend($id, $updatedStorage->getAuthMechanism()->getIdentifier());
+        }
+
+        $this->triggerChangeHooks($oldStorage, $updatedStorage);
+
+        if (($wasGlobal && !$isGlobal) || count($removedGroups) > 0) { // to expensive to properly handle these on the fly
+            $this->userMountCache->remoteStorageMounts($this->getStorageId($updatedStorage));
+        } else {
+            $storageId = $this->getStorageId($updatedStorage);
+            foreach ($removedUsers as $userId) {
+                $this->userMountCache->removeUserStorageMount($storageId, $userId);
+            }
+        }
+
+        return $this->getStorage($id);
+    }
+
+    /**
+     * Delete the storage with the given id.
+     *
+     * @param int $id storage id
+     *
+     * @throws NotFoundException if no storage was found with the given id
+     */
+    public function removeStorage($id) {
+        $existingMount = $this->dbConfig->getMountById($id);
+
+        if (!is_array($existingMount)) {
+            throw new NotFoundException('Storage with ID "' . $id . '" not found');
+        }
+
+        $this->dbConfig->removeMount($id);
+
+        $deletedStorage = $this->getStorageConfigFromDBMount($existingMount);
+        $this->triggerHooks($deletedStorage, Filesystem::signal_delete_mount);
+
+        // delete oc_storages entries and oc_filecache
+        try {
+            $rustyStorageId = $this->getRustyStorageIdFromConfig($deletedStorage);
+            \OC\Files\Cache\Storage::remove($rustyStorageId);
+        } catch (\Exception $e) {
+            // can happen either for invalid configs where the storage could not
+            // be instantiated or whenever $user vars where used, in which case
+            // the storage id could not be computed
+            \OC::$server->getLogger()->logException($e, [
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+        }
+    }
+
+    /**
+     * Returns the rusty storage id from oc_storages from the given storage config.
+     *
+     * @param StorageConfig $storageConfig
+     * @return string rusty storage id
+     */
+    private function getRustyStorageIdFromConfig(StorageConfig $storageConfig) {
+        // if any of the storage options contains $user, it is not possible
+        // to compute the possible storage id as we don't know which users
+        // mounted it already (and we certainly don't want to iterate over ALL users)
+        foreach ($storageConfig->getBackendOptions() as $value) {
+            if (strpos($value, '$user') !== false) {
+                throw new \Exception('Cannot compute storage id for deletion due to $user vars in the configuration');
+            }
+        }
+
+        // note: similar to ConfigAdapter->prepateStorageConfig()
+        $storageConfig->getAuthMechanism()->manipulateStorageConfig($storageConfig);
+        $storageConfig->getBackend()->manipulateStorageConfig($storageConfig);
+
+        $class = $storageConfig->getBackend()->getStorageClass();
+        $storageImpl = new $class($storageConfig->getBackendOptions());
+
+        return $storageImpl->getId();
+    }
+
+    /**
+     * Construct the storage implementation
+     *
+     * @param StorageConfig $storageConfig
+     * @return int
+     */
+    private function getStorageId(StorageConfig $storageConfig) {
+        try {
+            $class = $storageConfig->getBackend()->getStorageClass();
+            /** @var \OC\Files\Storage\Storage $storage */
+            $storage = new $class($storageConfig->getBackendOptions());
+
+            // auth mechanism should fire first
+            $storage = $storageConfig->getBackend()->wrapStorage($storage);
+            $storage = $storageConfig->getAuthMechanism()->wrapStorage($storage);
+
+            return $storage->getStorageCache()->getNumericId();
+        } catch (\Exception $e) {
+            return -1;
+        }
+    }
 }

apps/files_external/lib/Lib/Storage/SMB.php

Indentation +480 added lines, -480 removed lines

@@ -56,484 +56,484 @@
 use OCP\Util;
 
 class SMB extends Common implements INotifyStorage {
-	/**
-	 * @var \Icewind\SMB\Server
-	 */
-	protected $server;
-
-	/**
-	 * @var \Icewind\SMB\Share
-	 */
-	protected $share;
-
-	/**
-	 * @var string
-	 */
-	protected $root;
-
-	/**
-	 * @var \Icewind\SMB\FileInfo[]
-	 */
-	protected $statCache;
-
-	public function __construct($params) {
-		if (isset($params['host']) && isset($params['user']) && isset($params['password']) && isset($params['share'])) {
-			if (Server::NativeAvailable()) {
-				$this->server = new NativeServer($params['host'], $params['user'], $params['password']);
-			} else {
-				$this->server = new Server($params['host'], $params['user'], $params['password']);
-			}
-			$this->share = $this->server->getShare(trim($params['share'], '/'));
-
-			$this->root = $params['root'] ?? '/';
-			$this->root = '/' . ltrim($this->root, '/');
-			$this->root = rtrim($this->root, '/') . '/';
-		} else {
-			throw new \Exception('Invalid configuration');
-		}
-		$this->statCache = new CappedMemoryCache();
-		parent::__construct($params);
-	}
-
-	/**
-	 * @return string
-	 */
-	public function getId() {
-		// FIXME: double slash to keep compatible with the old storage ids,
-		// failure to do so will lead to creation of a new storage id and
-		// loss of shares from the storage
-		return 'smb::' . $this->server->getUser() . '@' . $this->server->getHost() . '//' . $this->share->getName() . '/' . $this->root;
-	}
-
-	/**
-	 * @param string $path
-	 * @return string
-	 */
-	protected function buildPath($path) {
-		return Filesystem::normalizePath($this->root . '/' . $path, true, false, true);
-	}
-
-	protected function relativePath($fullPath) {
-		if ($fullPath === $this->root) {
-			return '';
-		} else if (substr($fullPath, 0, strlen($this->root)) === $this->root) {
-			return substr($fullPath, strlen($this->root));
-		} else {
-			return null;
-		}
-	}
-
-	/**
-	 * @param string $path
-	 * @return \Icewind\SMB\IFileInfo
-	 * @throws StorageNotAvailableException
-	 */
-	protected function getFileInfo($path) {
-		try {
-			$path = $this->buildPath($path);
-			if (!isset($this->statCache[$path])) {
-				$this->statCache[$path] = $this->share->stat($path);
-			}
-			return $this->statCache[$path];
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	/**
-	 * @param string $path
-	 * @return \Icewind\SMB\IFileInfo[]
-	 * @throws StorageNotAvailableException
-	 */
-	protected function getFolderContents($path) {
-		try {
-			$path = $this->buildPath($path);
-			$files = $this->share->dir($path);
-			foreach ($files as $file) {
-				$this->statCache[$path . '/' . $file->getName()] = $file;
-			}
-			return array_filter($files, function (IFileInfo $file) {
-				try {
-					return !$file->isHidden();
-				} catch (ForbiddenException $e) {
-					return false;
-				} catch (NotFoundException $e) {
-					return false;
-				}
-			});
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	/**
-	 * @param \Icewind\SMB\IFileInfo $info
-	 * @return array
-	 */
-	protected function formatInfo($info) {
-		$result = [
-			'size' => $info->getSize(),
-			'mtime' => $info->getMTime(),
-		];
-		if ($info->isDirectory()) {
-			$result['type'] = 'dir';
-		} else {
-			$result['type'] = 'file';
-		}
-		return $result;
-	}
-
-	/**
-	 * Rename the files. If the source or the target is the root, the rename won't happen.
-	 *
-	 * @param string $source the old name of the path
-	 * @param string $target the new name of the path
-	 * @return bool true if the rename is successful, false otherwise
-	 */
-	public function rename($source, $target) {
-		if ($this->isRootDir($source) || $this->isRootDir($target)) {
-			return false;
-		}
-
-		$absoluteSource = $this->buildPath($source);
-		$absoluteTarget = $this->buildPath($target);
-		try {
-			$result = $this->share->rename($absoluteSource, $absoluteTarget);
-		} catch (AlreadyExistsException $e) {
-			$this->remove($target);
-			$result = $this->share->rename($absoluteSource, $absoluteTarget);
-		} catch (\Exception $e) {
-			\OC::$server->getLogger()->logException($e, ['level' => ILogger::WARN]);
-			return false;
-		}
-		unset($this->statCache[$absoluteSource], $this->statCache[$absoluteTarget]);
-		return $result;
-	}
-
-	public function stat($path) {
-		try {
-			$result = $this->formatInfo($this->getFileInfo($path));
-		} catch (ForbiddenException $e) {
-			return false;
-		} catch (NotFoundException $e) {
-			return false;
-		}
-		if ($this->remoteIsShare() && $this->isRootDir($path)) {
-			$result['mtime'] = $this->shareMTime();
-		}
-		return $result;
-	}
-
-	/**
-	 * get the best guess for the modification time of the share
-	 *
-	 * @return int
-	 */
-	private function shareMTime() {
-		$highestMTime = 0;
-		$files = $this->share->dir($this->root);
-		foreach ($files as $fileInfo) {
-			try {
-				if ($fileInfo->getMTime() > $highestMTime) {
-					$highestMTime = $fileInfo->getMTime();
-				}
-			} catch (NotFoundException $e) {
-				// Ignore this, can happen on unavailable DFS shares
-			}
-		}
-		return $highestMTime;
-	}
-
-	/**
-	 * Check if the path is our root dir (not the smb one)
-	 *
-	 * @param string $path the path
-	 * @return bool
-	 */
-	private function isRootDir($path) {
-		return $path === '' || $path === '/' || $path === '.';
-	}
-
-	/**
-	 * Check if our root points to a smb share
-	 *
-	 * @return bool true if our root points to a share false otherwise
-	 */
-	private function remoteIsShare() {
-		return $this->share->getName() && (!$this->root || $this->root === '/');
-	}
-
-	/**
-	 * @param string $path
-	 * @return bool
-	 */
-	public function unlink($path) {
-		if ($this->isRootDir($path)) {
-			return false;
-		}
-
-		try {
-			if ($this->is_dir($path)) {
-				return $this->rmdir($path);
-			} else {
-				$path = $this->buildPath($path);
-				unset($this->statCache[$path]);
-				$this->share->del($path);
-				return true;
-			}
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	/**
-	 * check if a file or folder has been updated since $time
-	 *
-	 * @param string $path
-	 * @param int $time
-	 * @return bool
-	 */
-	public function hasUpdated($path, $time) {
-		if (!$path and $this->root === '/') {
-			// mtime doesn't work for shares, but giving the nature of the backend,
-			// doing a full update is still just fast enough
-			return true;
-		} else {
-			$actualTime = $this->filemtime($path);
-			return $actualTime > $time;
-		}
-	}
-
-	/**
-	 * @param string $path
-	 * @param string $mode
-	 * @return resource|false
-	 */
-	public function fopen($path, $mode) {
-		$fullPath = $this->buildPath($path);
-		try {
-			switch ($mode) {
-				case 'r':
-				case 'rb':
-					if (!$this->file_exists($path)) {
-						return false;
-					}
-					return $this->share->read($fullPath);
-				case 'w':
-				case 'wb':
-					$source = $this->share->write($fullPath);
-					return CallBackWrapper::wrap($source, null, null, function () use ($fullPath) {
-						unset($this->statCache[$fullPath]);
-					});
-				case 'a':
-				case 'ab':
-				case 'r+':
-				case 'w+':
-				case 'wb+':
-				case 'a+':
-				case 'x':
-				case 'x+':
-				case 'c':
-				case 'c+':
-					//emulate these
-					if (strrpos($path, '.') !== false) {
-						$ext = substr($path, strrpos($path, '.'));
-					} else {
-						$ext = '';
-					}
-					if ($this->file_exists($path)) {
-						if (!$this->isUpdatable($path)) {
-							return false;
-						}
-						$tmpFile = $this->getCachedFile($path);
-					} else {
-						if (!$this->isCreatable(dirname($path))) {
-							return false;
-						}
-						$tmpFile = \OC::$server->getTempManager()->getTemporaryFile($ext);
-					}
-					$source = fopen($tmpFile, $mode);
-					$share = $this->share;
-					return CallbackWrapper::wrap($source, null, null, function () use ($tmpFile, $fullPath, $share) {
-						unset($this->statCache[$fullPath]);
-						$share->put($tmpFile, $fullPath);
-						unlink($tmpFile);
-					});
-			}
-			return false;
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	public function rmdir($path) {
-		if ($this->isRootDir($path)) {
-			return false;
-		}
-
-		try {
-			$this->statCache = array();
-			$content = $this->share->dir($this->buildPath($path));
-			foreach ($content as $file) {
-				if ($file->isDirectory()) {
-					$this->rmdir($path . '/' . $file->getName());
-				} else {
-					$this->share->del($file->getPath());
-				}
-			}
-			$this->share->rmdir($this->buildPath($path));
-			return true;
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	public function touch($path, $time = null) {
-		try {
-			if (!$this->file_exists($path)) {
-				$fh = $this->share->write($this->buildPath($path));
-				fclose($fh);
-				return true;
-			}
-			return false;
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	public function opendir($path) {
-		try {
-			$files = $this->getFolderContents($path);
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		}
-		$names = array_map(function ($info) {
-			/** @var \Icewind\SMB\IFileInfo $info */
-			return $info->getName();
-		}, $files);
-		return IteratorDirectory::wrap($names);
-	}
-
-	public function filetype($path) {
-		try {
-			return $this->getFileInfo($path)->isDirectory() ? 'dir' : 'file';
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		}
-	}
-
-	public function mkdir($path) {
-		$path = $this->buildPath($path);
-		try {
-			$this->share->mkdir($path);
-			return true;
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		} catch (Exception $e) {
-			return false;
-		}
-	}
-
-	public function file_exists($path) {
-		try {
-			$this->getFileInfo($path);
-			return true;
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		} catch (ConnectException $e) {
-			throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
-		}
-	}
-
-	public function isReadable($path) {
-		try {
-			$info = $this->getFileInfo($path);
-			return !$info->isHidden();
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		}
-	}
-
-	public function isUpdatable($path) {
-		try {
-			$info = $this->getFileInfo($path);
-			// following windows behaviour for read-only folders: they can be written into
-			// (https://support.microsoft.com/en-us/kb/326549 - "cause" section)
-			return !$info->isHidden() && (!$info->isReadOnly() || $this->is_dir($path));
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		}
-	}
-
-	public function isDeletable($path) {
-		try {
-			$info = $this->getFileInfo($path);
-			return !$info->isHidden() && !$info->isReadOnly();
-		} catch (NotFoundException $e) {
-			return false;
-		} catch (ForbiddenException $e) {
-			return false;
-		}
-	}
-
-	/**
-	 * check if smbclient is installed
-	 */
-	public static function checkDependencies() {
-		return (
-			(bool)\OC_Helper::findBinaryPath('smbclient')
-			|| Server::NativeAvailable()
-		) ? true : ['smbclient'];
-	}
-
-	/**
-	 * Test a storage for availability
-	 *
-	 * @return bool
-	 */
-	public function test() {
-		try {
-			return parent::test();
-		} catch (Exception $e) {
-			return false;
-		}
-	}
-
-	public function listen($path, callable $callback) {
-		$this->notify($path)->listen(function (IChange $change) use ($callback) {
-			if ($change instanceof IRenameChange) {
-				return $callback($change->getType(), $change->getPath(), $change->getTargetPath());
-			} else {
-				return $callback($change->getType(), $change->getPath());
-			}
-		});
-	}
-
-	public function notify($path) {
-		$path = '/' . ltrim($path, '/');
-		$shareNotifyHandler = $this->share->notify($this->buildPath($path));
-		return new SMBNotifyHandler($shareNotifyHandler, $this->root);
-	}
+    /**
+     * @var \Icewind\SMB\Server
+     */
+    protected $server;
+
+    /**
+     * @var \Icewind\SMB\Share
+     */
+    protected $share;
+
+    /**
+     * @var string
+     */
+    protected $root;
+
+    /**
+     * @var \Icewind\SMB\FileInfo[]
+     */
+    protected $statCache;
+
+    public function __construct($params) {
+        if (isset($params['host']) && isset($params['user']) && isset($params['password']) && isset($params['share'])) {
+            if (Server::NativeAvailable()) {
+                $this->server = new NativeServer($params['host'], $params['user'], $params['password']);
+            } else {
+                $this->server = new Server($params['host'], $params['user'], $params['password']);
+            }
+            $this->share = $this->server->getShare(trim($params['share'], '/'));
+
+            $this->root = $params['root'] ?? '/';
+            $this->root = '/' . ltrim($this->root, '/');
+            $this->root = rtrim($this->root, '/') . '/';
+        } else {
+            throw new \Exception('Invalid configuration');
+        }
+        $this->statCache = new CappedMemoryCache();
+        parent::__construct($params);
+    }
+
+    /**
+     * @return string
+     */
+    public function getId() {
+        // FIXME: double slash to keep compatible with the old storage ids,
+        // failure to do so will lead to creation of a new storage id and
+        // loss of shares from the storage
+        return 'smb::' . $this->server->getUser() . '@' . $this->server->getHost() . '//' . $this->share->getName() . '/' . $this->root;
+    }
+
+    /**
+     * @param string $path
+     * @return string
+     */
+    protected function buildPath($path) {
+        return Filesystem::normalizePath($this->root . '/' . $path, true, false, true);
+    }
+
+    protected function relativePath($fullPath) {
+        if ($fullPath === $this->root) {
+            return '';
+        } else if (substr($fullPath, 0, strlen($this->root)) === $this->root) {
+            return substr($fullPath, strlen($this->root));
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * @param string $path
+     * @return \Icewind\SMB\IFileInfo
+     * @throws StorageNotAvailableException
+     */
+    protected function getFileInfo($path) {
+        try {
+            $path = $this->buildPath($path);
+            if (!isset($this->statCache[$path])) {
+                $this->statCache[$path] = $this->share->stat($path);
+            }
+            return $this->statCache[$path];
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    /**
+     * @param string $path
+     * @return \Icewind\SMB\IFileInfo[]
+     * @throws StorageNotAvailableException
+     */
+    protected function getFolderContents($path) {
+        try {
+            $path = $this->buildPath($path);
+            $files = $this->share->dir($path);
+            foreach ($files as $file) {
+                $this->statCache[$path . '/' . $file->getName()] = $file;
+            }
+            return array_filter($files, function (IFileInfo $file) {
+                try {
+                    return !$file->isHidden();
+                } catch (ForbiddenException $e) {
+                    return false;
+                } catch (NotFoundException $e) {
+                    return false;
+                }
+            });
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    /**
+     * @param \Icewind\SMB\IFileInfo $info
+     * @return array
+     */
+    protected function formatInfo($info) {
+        $result = [
+            'size' => $info->getSize(),
+            'mtime' => $info->getMTime(),
+        ];
+        if ($info->isDirectory()) {
+            $result['type'] = 'dir';
+        } else {
+            $result['type'] = 'file';
+        }
+        return $result;
+    }
+
+    /**
+     * Rename the files. If the source or the target is the root, the rename won't happen.
+     *
+     * @param string $source the old name of the path
+     * @param string $target the new name of the path
+     * @return bool true if the rename is successful, false otherwise
+     */
+    public function rename($source, $target) {
+        if ($this->isRootDir($source) || $this->isRootDir($target)) {
+            return false;
+        }
+
+        $absoluteSource = $this->buildPath($source);
+        $absoluteTarget = $this->buildPath($target);
+        try {
+            $result = $this->share->rename($absoluteSource, $absoluteTarget);
+        } catch (AlreadyExistsException $e) {
+            $this->remove($target);
+            $result = $this->share->rename($absoluteSource, $absoluteTarget);
+        } catch (\Exception $e) {
+            \OC::$server->getLogger()->logException($e, ['level' => ILogger::WARN]);
+            return false;
+        }
+        unset($this->statCache[$absoluteSource], $this->statCache[$absoluteTarget]);
+        return $result;
+    }
+
+    public function stat($path) {
+        try {
+            $result = $this->formatInfo($this->getFileInfo($path));
+        } catch (ForbiddenException $e) {
+            return false;
+        } catch (NotFoundException $e) {
+            return false;
+        }
+        if ($this->remoteIsShare() && $this->isRootDir($path)) {
+            $result['mtime'] = $this->shareMTime();
+        }
+        return $result;
+    }
+
+    /**
+     * get the best guess for the modification time of the share
+     *
+     * @return int
+     */
+    private function shareMTime() {
+        $highestMTime = 0;
+        $files = $this->share->dir($this->root);
+        foreach ($files as $fileInfo) {
+            try {
+                if ($fileInfo->getMTime() > $highestMTime) {
+                    $highestMTime = $fileInfo->getMTime();
+                }
+            } catch (NotFoundException $e) {
+                // Ignore this, can happen on unavailable DFS shares
+            }
+        }
+        return $highestMTime;
+    }
+
+    /**
+     * Check if the path is our root dir (not the smb one)
+     *
+     * @param string $path the path
+     * @return bool
+     */
+    private function isRootDir($path) {
+        return $path === '' || $path === '/' || $path === '.';
+    }
+
+    /**
+     * Check if our root points to a smb share
+     *
+     * @return bool true if our root points to a share false otherwise
+     */
+    private function remoteIsShare() {
+        return $this->share->getName() && (!$this->root || $this->root === '/');
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    public function unlink($path) {
+        if ($this->isRootDir($path)) {
+            return false;
+        }
+
+        try {
+            if ($this->is_dir($path)) {
+                return $this->rmdir($path);
+            } else {
+                $path = $this->buildPath($path);
+                unset($this->statCache[$path]);
+                $this->share->del($path);
+                return true;
+            }
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    /**
+     * check if a file or folder has been updated since $time
+     *
+     * @param string $path
+     * @param int $time
+     * @return bool
+     */
+    public function hasUpdated($path, $time) {
+        if (!$path and $this->root === '/') {
+            // mtime doesn't work for shares, but giving the nature of the backend,
+            // doing a full update is still just fast enough
+            return true;
+        } else {
+            $actualTime = $this->filemtime($path);
+            return $actualTime > $time;
+        }
+    }
+
+    /**
+     * @param string $path
+     * @param string $mode
+     * @return resource|false
+     */
+    public function fopen($path, $mode) {
+        $fullPath = $this->buildPath($path);
+        try {
+            switch ($mode) {
+                case 'r':
+                case 'rb':
+                    if (!$this->file_exists($path)) {
+                        return false;
+                    }
+                    return $this->share->read($fullPath);
+                case 'w':
+                case 'wb':
+                    $source = $this->share->write($fullPath);
+                    return CallBackWrapper::wrap($source, null, null, function () use ($fullPath) {
+                        unset($this->statCache[$fullPath]);
+                    });
+                case 'a':
+                case 'ab':
+                case 'r+':
+                case 'w+':
+                case 'wb+':
+                case 'a+':
+                case 'x':
+                case 'x+':
+                case 'c':
+                case 'c+':
+                    //emulate these
+                    if (strrpos($path, '.') !== false) {
+                        $ext = substr($path, strrpos($path, '.'));
+                    } else {
+                        $ext = '';
+                    }
+                    if ($this->file_exists($path)) {
+                        if (!$this->isUpdatable($path)) {
+                            return false;
+                        }
+                        $tmpFile = $this->getCachedFile($path);
+                    } else {
+                        if (!$this->isCreatable(dirname($path))) {
+                            return false;
+                        }
+                        $tmpFile = \OC::$server->getTempManager()->getTemporaryFile($ext);
+                    }
+                    $source = fopen($tmpFile, $mode);
+                    $share = $this->share;
+                    return CallbackWrapper::wrap($source, null, null, function () use ($tmpFile, $fullPath, $share) {
+                        unset($this->statCache[$fullPath]);
+                        $share->put($tmpFile, $fullPath);
+                        unlink($tmpFile);
+                    });
+            }
+            return false;
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    public function rmdir($path) {
+        if ($this->isRootDir($path)) {
+            return false;
+        }
+
+        try {
+            $this->statCache = array();
+            $content = $this->share->dir($this->buildPath($path));
+            foreach ($content as $file) {
+                if ($file->isDirectory()) {
+                    $this->rmdir($path . '/' . $file->getName());
+                } else {
+                    $this->share->del($file->getPath());
+                }
+            }
+            $this->share->rmdir($this->buildPath($path));
+            return true;
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    public function touch($path, $time = null) {
+        try {
+            if (!$this->file_exists($path)) {
+                $fh = $this->share->write($this->buildPath($path));
+                fclose($fh);
+                return true;
+            }
+            return false;
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    public function opendir($path) {
+        try {
+            $files = $this->getFolderContents($path);
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        }
+        $names = array_map(function ($info) {
+            /** @var \Icewind\SMB\IFileInfo $info */
+            return $info->getName();
+        }, $files);
+        return IteratorDirectory::wrap($names);
+    }
+
+    public function filetype($path) {
+        try {
+            return $this->getFileInfo($path)->isDirectory() ? 'dir' : 'file';
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        }
+    }
+
+    public function mkdir($path) {
+        $path = $this->buildPath($path);
+        try {
+            $this->share->mkdir($path);
+            return true;
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        } catch (Exception $e) {
+            return false;
+        }
+    }
+
+    public function file_exists($path) {
+        try {
+            $this->getFileInfo($path);
+            return true;
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        } catch (ConnectException $e) {
+            throw new StorageNotAvailableException($e->getMessage(), $e->getCode(), $e);
+        }
+    }
+
+    public function isReadable($path) {
+        try {
+            $info = $this->getFileInfo($path);
+            return !$info->isHidden();
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        }
+    }
+
+    public function isUpdatable($path) {
+        try {
+            $info = $this->getFileInfo($path);
+            // following windows behaviour for read-only folders: they can be written into
+            // (https://support.microsoft.com/en-us/kb/326549 - "cause" section)
+            return !$info->isHidden() && (!$info->isReadOnly() || $this->is_dir($path));
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        }
+    }
+
+    public function isDeletable($path) {
+        try {
+            $info = $this->getFileInfo($path);
+            return !$info->isHidden() && !$info->isReadOnly();
+        } catch (NotFoundException $e) {
+            return false;
+        } catch (ForbiddenException $e) {
+            return false;
+        }
+    }
+
+    /**
+     * check if smbclient is installed
+     */
+    public static function checkDependencies() {
+        return (
+            (bool)\OC_Helper::findBinaryPath('smbclient')
+            || Server::NativeAvailable()
+        ) ? true : ['smbclient'];
+    }
+
+    /**
+     * Test a storage for availability
+     *
+     * @return bool
+     */
+    public function test() {
+        try {
+            return parent::test();
+        } catch (Exception $e) {
+            return false;
+        }
+    }
+
+    public function listen($path, callable $callback) {
+        $this->notify($path)->listen(function (IChange $change) use ($callback) {
+            if ($change instanceof IRenameChange) {
+                return $callback($change->getType(), $change->getPath(), $change->getTargetPath());
+            } else {
+                return $callback($change->getType(), $change->getPath());
+            }
+        });
+    }
+
+    public function notify($path) {
+        $path = '/' . ltrim($path, '/');
+        $shareNotifyHandler = $this->share->notify($this->buildPath($path));
+        return new SMBNotifyHandler($shareNotifyHandler, $this->root);
+    }
 }

apps/files_external/lib/Lib/Storage/Swift.php

Indentation +569 added lines, -569 removed lines

@@ -50,577 +50,577 @@
 use OpenStack\ObjectStore\v1\Models\StorageObject;
 
 class Swift extends \OC\Files\Storage\Common {
-	/** @var SwiftFactory */
-	private $connectionFactory;
-	/**
-	 * @var \OpenStack\ObjectStore\v1\Models\Container
-	 */
-	private $container;
-	/**
-	 * @var string
-	 */
-	private $bucket;
-	/**
-	 * Connection parameters
-	 *
-	 * @var array
-	 */
-	private $params;
-
-	/** @var string */
-	private $id;
-
-	/** @var \OC\Files\ObjectStore\Swift */
-	private $objectStore;
-
-	/**
-	 * Key value cache mapping path to data object. Maps path to
-	 * \OpenCloud\OpenStack\ObjectStorage\Resource\DataObject for existing
-	 * paths and path to false for not existing paths.
-	 *
-	 * @var \OCP\ICache
-	 */
-	private $objectCache;
-
-	/**
-	 * @param string $path
-	 * @return mixed|string
-	 */
-	private function normalizePath(string $path) {
-		$path = trim($path, '/');
-
-		if (!$path) {
-			$path = '.';
-		}
-
-		$path = str_replace('#', '%23', $path);
-
-		return $path;
-	}
-
-	const SUBCONTAINER_FILE = '.subcontainers';
-
-	/**
-	 * translate directory path to container name
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-
-	/**
-	 * Fetches an object from the API.
-	 * If the object is cached already or a
-	 * failed "doesn't exist" response was cached,
-	 * that one will be returned.
-	 *
-	 * @param string $path
-	 * @return StorageObject|bool object
-	 * or false if the object did not exist
-	 * @throws \OCP\Files\StorageAuthException
-	 * @throws \OCP\Files\StorageNotAvailableException
-	 */
-	private function fetchObject(string $path) {
-		if ($this->objectCache->hasKey($path)) {
-			// might be "false" if object did not exist from last check
-			return $this->objectCache->get($path);
-		}
-		try {
-			$object = $this->getContainer()->getObject($path);
-			$object->retrieve();
-			$this->objectCache->set($path, $object);
-			return $object;
-		} catch (BadResponseError $e) {
-			// Expected response is "404 Not Found", so only log if it isn't
-			if ($e->getResponse()->getStatusCode() !== 404) {
-				\OC::$server->getLogger()->logException($e, [
-					'level' => ILogger::ERROR,
-					'app' => 'files_external',
-				]);
-			}
-			$this->objectCache->set($path, false);
-			return false;
-		}
-	}
-
-	/**
-	 * Returns whether the given path exists.
-	 *
-	 * @param string $path
-	 *
-	 * @return bool true if the object exist, false otherwise
-	 * @throws \OCP\Files\StorageAuthException
-	 * @throws \OCP\Files\StorageNotAvailableException
-	 */
-	private function doesObjectExist($path) {
-		return $this->fetchObject($path) !== false;
-	}
-
-	public function __construct($params) {
-		if ((empty($params['key']) and empty($params['password']))
-			or (empty($params['user']) && empty($params['userid'])) or empty($params['bucket'])
-			or empty($params['region'])
-		) {
-			throw new StorageBadConfigException("API Key or password, Username, Bucket and Region have to be configured.");
-		}
-
-		$user = $params['user'];
-		$this->id = 'swift::' . $user . md5($params['bucket']);
-
-		$bucketUrl = new Uri($params['bucket']);
-		if ($bucketUrl->getHost()) {
-			$params['bucket'] = basename($bucketUrl->getPath());
-			$params['endpoint_url'] = (string)$bucketUrl->withPath(dirname($bucketUrl->getPath()));
-		}
-
-		if (empty($params['url'])) {
-			$params['url'] = 'https://identity.api.rackspacecloud.com/v2.0/';
-		}
-
-		if (empty($params['service_name'])) {
-			$params['service_name'] = 'cloudFiles';
-		}
-
-		$params['autocreate'] = true;
-
-		if (isset($params['domain'])) {
-			$params['user'] = [
-				'name' => $params['user'],
-				'password' => $params['password'],
-				'domain' => [
-					'name' => $params['domain'],
-				]
-			];
-		}
-
-		$this->params = $params;
-		// FIXME: private class...
-		$this->objectCache = new \OC\Cache\CappedMemoryCache();
-		$this->connectionFactory = new SwiftFactory(
-			\OC::$server->getMemCacheFactory()->createDistributed('swift/'),
-			$this->params,
-			\OC::$server->getLogger()
-		);
-		$this->objectStore = new \OC\Files\ObjectStore\Swift($this->params, $this->connectionFactory);
-		$this->bucket = $params['bucket'];
-	}
-
-	public function mkdir($path) {
-		$path = $this->normalizePath($path);
-
-		if ($this->is_dir($path)) {
-			return false;
-		}
-
-		if ($path !== '.') {
-			$path .= '/';
-		}
-
-		try {
-			$this->getContainer()->createObject([
-				'name' => $path,
-				'content' => '',
-				'headers' => ['content-type' => 'httpd/unix-directory']
-			]);
-			// invalidate so that the next access gets the real object
-			// with all properties
-			$this->objectCache->remove($path);
-		} catch (BadResponseError $e) {
-			\OC::$server->getLogger()->logException($e, [
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-			return false;
-		}
-
-		return true;
-	}
-
-	public function file_exists($path) {
-		$path = $this->normalizePath($path);
-
-		if ($path !== '.' && $this->is_dir($path)) {
-			$path .= '/';
-		}
-
-		return $this->doesObjectExist($path);
-	}
-
-	public function rmdir($path) {
-		$path = $this->normalizePath($path);
-
-		if (!$this->is_dir($path) || !$this->isDeletable($path)) {
-			return false;
-		}
-
-		$dh = $this->opendir($path);
-		while ($file = readdir($dh)) {
-			if (\OC\Files\Filesystem::isIgnoredDir($file)) {
-				continue;
-			}
-
-			if ($this->is_dir($path . '/' . $file)) {
-				$this->rmdir($path . '/' . $file);
-			} else {
-				$this->unlink($path . '/' . $file);
-			}
-		}
-
-		try {
-			$this->objectStore->deleteObject($path . '/');
-			$this->objectCache->remove($path . '/');
-		} catch (BadResponseError $e) {
-			\OC::$server->getLogger()->logException($e, [
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-			return false;
-		}
-
-		return true;
-	}
-
-	public function opendir($path) {
-		$path = $this->normalizePath($path);
-
-		if ($path === '.') {
-			$path = '';
-		} else {
-			$path .= '/';
-		}
+    /** @var SwiftFactory */
+    private $connectionFactory;
+    /**
+     * @var \OpenStack\ObjectStore\v1\Models\Container
+     */
+    private $container;
+    /**
+     * @var string
+     */
+    private $bucket;
+    /**
+     * Connection parameters
+     *
+     * @var array
+     */
+    private $params;
+
+    /** @var string */
+    private $id;
+
+    /** @var \OC\Files\ObjectStore\Swift */
+    private $objectStore;
+
+    /**
+     * Key value cache mapping path to data object. Maps path to
+     * \OpenCloud\OpenStack\ObjectStorage\Resource\DataObject for existing
+     * paths and path to false for not existing paths.
+     *
+     * @var \OCP\ICache
+     */
+    private $objectCache;
+
+    /**
+     * @param string $path
+     * @return mixed|string
+     */
+    private function normalizePath(string $path) {
+        $path = trim($path, '/');
+
+        if (!$path) {
+            $path = '.';
+        }
+
+        $path = str_replace('#', '%23', $path);
+
+        return $path;
+    }
+
+    const SUBCONTAINER_FILE = '.subcontainers';
+
+    /**
+     * translate directory path to container name
+     *
+     * @param string $path
+     * @return string
+     */
+
+    /**
+     * Fetches an object from the API.
+     * If the object is cached already or a
+     * failed "doesn't exist" response was cached,
+     * that one will be returned.
+     *
+     * @param string $path
+     * @return StorageObject|bool object
+     * or false if the object did not exist
+     * @throws \OCP\Files\StorageAuthException
+     * @throws \OCP\Files\StorageNotAvailableException
+     */
+    private function fetchObject(string $path) {
+        if ($this->objectCache->hasKey($path)) {
+            // might be "false" if object did not exist from last check
+            return $this->objectCache->get($path);
+        }
+        try {
+            $object = $this->getContainer()->getObject($path);
+            $object->retrieve();
+            $this->objectCache->set($path, $object);
+            return $object;
+        } catch (BadResponseError $e) {
+            // Expected response is "404 Not Found", so only log if it isn't
+            if ($e->getResponse()->getStatusCode() !== 404) {
+                \OC::$server->getLogger()->logException($e, [
+                    'level' => ILogger::ERROR,
+                    'app' => 'files_external',
+                ]);
+            }
+            $this->objectCache->set($path, false);
+            return false;
+        }
+    }
+
+    /**
+     * Returns whether the given path exists.
+     *
+     * @param string $path
+     *
+     * @return bool true if the object exist, false otherwise
+     * @throws \OCP\Files\StorageAuthException
+     * @throws \OCP\Files\StorageNotAvailableException
+     */
+    private function doesObjectExist($path) {
+        return $this->fetchObject($path) !== false;
+    }
+
+    public function __construct($params) {
+        if ((empty($params['key']) and empty($params['password']))
+            or (empty($params['user']) && empty($params['userid'])) or empty($params['bucket'])
+            or empty($params['region'])
+        ) {
+            throw new StorageBadConfigException("API Key or password, Username, Bucket and Region have to be configured.");
+        }
+
+        $user = $params['user'];
+        $this->id = 'swift::' . $user . md5($params['bucket']);
+
+        $bucketUrl = new Uri($params['bucket']);
+        if ($bucketUrl->getHost()) {
+            $params['bucket'] = basename($bucketUrl->getPath());
+            $params['endpoint_url'] = (string)$bucketUrl->withPath(dirname($bucketUrl->getPath()));
+        }
+
+        if (empty($params['url'])) {
+            $params['url'] = 'https://identity.api.rackspacecloud.com/v2.0/';
+        }
+
+        if (empty($params['service_name'])) {
+            $params['service_name'] = 'cloudFiles';
+        }
+
+        $params['autocreate'] = true;
+
+        if (isset($params['domain'])) {
+            $params['user'] = [
+                'name' => $params['user'],
+                'password' => $params['password'],
+                'domain' => [
+                    'name' => $params['domain'],
+                ]
+            ];
+        }
+
+        $this->params = $params;
+        // FIXME: private class...
+        $this->objectCache = new \OC\Cache\CappedMemoryCache();
+        $this->connectionFactory = new SwiftFactory(
+            \OC::$server->getMemCacheFactory()->createDistributed('swift/'),
+            $this->params,
+            \OC::$server->getLogger()
+        );
+        $this->objectStore = new \OC\Files\ObjectStore\Swift($this->params, $this->connectionFactory);
+        $this->bucket = $params['bucket'];
+    }
+
+    public function mkdir($path) {
+        $path = $this->normalizePath($path);
+
+        if ($this->is_dir($path)) {
+            return false;
+        }
+
+        if ($path !== '.') {
+            $path .= '/';
+        }
+
+        try {
+            $this->getContainer()->createObject([
+                'name' => $path,
+                'content' => '',
+                'headers' => ['content-type' => 'httpd/unix-directory']
+            ]);
+            // invalidate so that the next access gets the real object
+            // with all properties
+            $this->objectCache->remove($path);
+        } catch (BadResponseError $e) {
+            \OC::$server->getLogger()->logException($e, [
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+            return false;
+        }
+
+        return true;
+    }
+
+    public function file_exists($path) {
+        $path = $this->normalizePath($path);
+
+        if ($path !== '.' && $this->is_dir($path)) {
+            $path .= '/';
+        }
+
+        return $this->doesObjectExist($path);
+    }
+
+    public function rmdir($path) {
+        $path = $this->normalizePath($path);
+
+        if (!$this->is_dir($path) || !$this->isDeletable($path)) {
+            return false;
+        }
+
+        $dh = $this->opendir($path);
+        while ($file = readdir($dh)) {
+            if (\OC\Files\Filesystem::isIgnoredDir($file)) {
+                continue;
+            }
+
+            if ($this->is_dir($path . '/' . $file)) {
+                $this->rmdir($path . '/' . $file);
+            } else {
+                $this->unlink($path . '/' . $file);
+            }
+        }
+
+        try {
+            $this->objectStore->deleteObject($path . '/');
+            $this->objectCache->remove($path . '/');
+        } catch (BadResponseError $e) {
+            \OC::$server->getLogger()->logException($e, [
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+            return false;
+        }
+
+        return true;
+    }
+
+    public function opendir($path) {
+        $path = $this->normalizePath($path);
+
+        if ($path === '.') {
+            $path = '';
+        } else {
+            $path .= '/';
+        }
 
 //		$path = str_replace('%23', '#', $path); // the prefix is sent as a query param, so revert the encoding of #
 
-		try {
-			$files = [];
-			$objects = $this->getContainer()->listObjects([
-				'prefix' => $path,
-				'delimiter' => '/'
-			]);
-
-			/** @var StorageObject $object */
-			foreach ($objects as $object) {
-				$file = basename($object->name);
-				if ($file !== basename($path) && $file !== '.') {
-					$files[] = $file;
-				}
-			}
-
-			return IteratorDirectory::wrap($files);
-		} catch (\Exception $e) {
-			\OC::$server->getLogger()->logException($e, [
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-			return false;
-		}
-
-	}
-
-	public function stat($path) {
-		$path = $this->normalizePath($path);
-
-		if ($path === '.') {
-			$path = '';
-		} else if ($this->is_dir($path)) {
-			$path .= '/';
-		}
-
-		try {
-			$object = $this->fetchObject($path);
-			if (!$object) {
-				return false;
-			}
-		} catch (BadResponseError $e) {
-			\OC::$server->getLogger()->logException($e, [
-				'level' => ILogger::ERROR,
-				'app' => 'files_external',
-			]);
-			return false;
-		}
-
-		$dateTime = $object->lastModified ? \DateTime::createFromFormat(\DateTime::RFC1123, $object->lastModified) : false;
-		$mtime = $dateTime ? $dateTime->getTimestamp() : null;
-		$objectMetadata = $object->getMetadata();
-		if (isset($objectMetadata['timestamp'])) {
-			$mtime = $objectMetadata['timestamp'];
-		}
-
-		if (!empty($mtime)) {
-			$mtime = floor($mtime);
-		}
-
-		$stat = array();
-		$stat['size'] = (int)$object->contentLength;
-		$stat['mtime'] = $mtime;
-		$stat['atime'] = time();
-		return $stat;
-	}
-
-	public function filetype($path) {
-		$path = $this->normalizePath($path);
-
-		if ($path !== '.' && $this->doesObjectExist($path)) {
-			return 'file';
-		}
-
-		if ($path !== '.') {
-			$path .= '/';
-		}
-
-		if ($this->doesObjectExist($path)) {
-			return 'dir';
-		}
-	}
-
-	public function unlink($path) {
-		$path = $this->normalizePath($path);
-
-		if ($this->is_dir($path)) {
-			return $this->rmdir($path);
-		}
-
-		try {
-			$this->objectStore->deleteObject($path);
-			$this->objectCache->remove($path);
-			$this->objectCache->remove($path . '/');
-		} catch (BadResponseError $e) {
-			if ($e->getResponse()->getStatusCode() !== 404) {
-				\OC::$server->getLogger()->logException($e, [
-					'level' => ILogger::ERROR,
-					'app' => 'files_external',
-				]);
-				throw $e;
-			}
-		}
-
-		return true;
-	}
-
-	public function fopen($path, $mode) {
-		$path = $this->normalizePath($path);
-
-		switch ($mode) {
-			case 'a':
-			case 'ab':
-			case 'a+':
-				return false;
-			case 'r':
-			case 'rb':
-				try {
-					return $this->objectStore->readObject($path);
-				} catch (BadResponseError $e) {
-					\OC::$server->getLogger()->logException($e, [
-						'level' => ILogger::ERROR,
-						'app' => 'files_external',
-					]);
-					return false;
-				}
-			case 'w':
-			case 'wb':
-			case 'r+':
-			case 'w+':
-			case 'wb+':
-			case 'x':
-			case 'x+':
-			case 'c':
-			case 'c+':
-				if (strrpos($path, '.') !== false) {
-					$ext = substr($path, strrpos($path, '.'));
-				} else {
-					$ext = '';
-				}
-				$tmpFile = \OC::$server->getTempManager()->getTemporaryFile($ext);
-				// Fetch existing file if required
-				if ($mode[0] !== 'w' && $this->file_exists($path)) {
-					if ($mode[0] === 'x') {
-						// File cannot already exist
-						return false;
-					}
-					$source = $this->fopen($path, 'r');
-					file_put_contents($tmpFile, $source);
-				}
-				$handle = fopen($tmpFile, $mode);
-				return CallbackWrapper::wrap($handle, null, null, function () use ($path, $tmpFile) {
-					$this->writeBack($tmpFile, $path);
-				});
-		}
-	}
-
-	public function touch($path, $mtime = null) {
-		$path = $this->normalizePath($path);
-		if (is_null($mtime)) {
-			$mtime = time();
-		}
-		$metadata = ['timestamp' => $mtime];
-		if ($this->file_exists($path)) {
-			if ($this->is_dir($path) && $path !== '.') {
-				$path .= '/';
-			}
-
-			$object = $this->fetchObject($path);
-			if ($object->mergeMetadata($metadata)) {
-				// invalidate target object to force repopulation on fetch
-				$this->objectCache->remove($path);
-			}
-			return true;
-		} else {
-			$mimeType = \OC::$server->getMimeTypeDetector()->detectPath($path);
-			$this->getContainer()->createObject([
-				'name' => $path,
-				'content' => '',
-				'headers' => ['content-type' => 'httpd/unix-directory']
-			]);
-			// invalidate target object to force repopulation on fetch
-			$this->objectCache->remove($path);
-			return true;
-		}
-	}
-
-	public function copy($path1, $path2) {
-		$path1 = $this->normalizePath($path1);
-		$path2 = $this->normalizePath($path2);
-
-		$fileType = $this->filetype($path1);
-		if ($fileType) {
-			// make way
-			$this->unlink($path2);
-		}
-
-		if ($fileType === 'file') {
-			try {
-				$source = $this->fetchObject($path1);
-				$source->copy([
-					'destination' => $this->bucket . '/' . $path2
-				]);
-				// invalidate target object to force repopulation on fetch
-				$this->objectCache->remove($path2);
-				$this->objectCache->remove($path2 . '/');
-			} catch (BadResponseError $e) {
-				\OC::$server->getLogger()->logException($e, [
-					'level' => ILogger::ERROR,
-					'app' => 'files_external',
-				]);
-				return false;
-			}
-
-		} else if ($fileType === 'dir') {
-			try {
-				$source = $this->fetchObject($path1 . '/');
-				$source->copy([
-					'destination' => $this->bucket . '/' . $path2 . '/'
-				]);
-				// invalidate target object to force repopulation on fetch
-				$this->objectCache->remove($path2);
-				$this->objectCache->remove($path2 . '/');
-			} catch (BadResponseError $e) {
-				\OC::$server->getLogger()->logException($e, [
-					'level' => ILogger::ERROR,
-					'app' => 'files_external',
-				]);
-				return false;
-			}
-
-			$dh = $this->opendir($path1);
-			while ($file = readdir($dh)) {
-				if (\OC\Files\Filesystem::isIgnoredDir($file)) {
-					continue;
-				}
-
-				$source = $path1 . '/' . $file;
-				$target = $path2 . '/' . $file;
-				$this->copy($source, $target);
-			}
-
-		} else {
-			//file does not exist
-			return false;
-		}
-
-		return true;
-	}
-
-	public function rename($path1, $path2) {
-		$path1 = $this->normalizePath($path1);
-		$path2 = $this->normalizePath($path2);
-
-		$fileType = $this->filetype($path1);
-
-		if ($fileType === 'dir' || $fileType === 'file') {
-			// copy
-			if ($this->copy($path1, $path2) === false) {
-				return false;
-			}
-
-			// cleanup
-			if ($this->unlink($path1) === false) {
-				throw new \Exception('failed to remove original');
-				$this->unlink($path2);
-				return false;
-			}
-
-			return true;
-		}
-
-		return false;
-	}
-
-	public function getId() {
-		return $this->id;
-	}
-
-	/**
-	 * Returns the initialized object store container.
-	 *
-	 * @return \OpenStack\ObjectStore\v1\Models\Container
-	 * @throws \OCP\Files\StorageAuthException
-	 * @throws \OCP\Files\StorageNotAvailableException
-	 */
-	public function getContainer() {
-		if (is_null($this->container)) {
-			$this->container = $this->connectionFactory->getContainer();
-
-			if (!$this->file_exists('.')) {
-				$this->mkdir('.');
-			}
-		}
-		return $this->container;
-	}
-
-	public function writeBack($tmpFile, $path) {
-		$fileData = fopen($tmpFile, 'r');
-		$this->objectStore->writeObject($path, $fileData);
-		// invalidate target object to force repopulation on fetch
-		$this->objectCache->remove($path);
-		unlink($tmpFile);
-	}
-
-	public function hasUpdated($path, $time) {
-		if ($this->is_file($path)) {
-			return parent::hasUpdated($path, $time);
-		}
-		$path = $this->normalizePath($path);
-		$dh = $this->opendir($path);
-		$content = array();
-		while (($file = readdir($dh)) !== false) {
-			$content[] = $file;
-		}
-		if ($path === '.') {
-			$path = '';
-		}
-		$cachedContent = $this->getCache()->getFolderContents($path);
-		$cachedNames = array_map(function ($content) {
-			return $content['name'];
-		}, $cachedContent);
-		sort($cachedNames);
-		sort($content);
-		return $cachedNames !== $content;
-	}
-
-	/**
-	 * check if curl is installed
-	 */
-	public static function checkDependencies() {
-		return true;
-	}
+        try {
+            $files = [];
+            $objects = $this->getContainer()->listObjects([
+                'prefix' => $path,
+                'delimiter' => '/'
+            ]);
+
+            /** @var StorageObject $object */
+            foreach ($objects as $object) {
+                $file = basename($object->name);
+                if ($file !== basename($path) && $file !== '.') {
+                    $files[] = $file;
+                }
+            }
+
+            return IteratorDirectory::wrap($files);
+        } catch (\Exception $e) {
+            \OC::$server->getLogger()->logException($e, [
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+            return false;
+        }
+
+    }
+
+    public function stat($path) {
+        $path = $this->normalizePath($path);
+
+        if ($path === '.') {
+            $path = '';
+        } else if ($this->is_dir($path)) {
+            $path .= '/';
+        }
+
+        try {
+            $object = $this->fetchObject($path);
+            if (!$object) {
+                return false;
+            }
+        } catch (BadResponseError $e) {
+            \OC::$server->getLogger()->logException($e, [
+                'level' => ILogger::ERROR,
+                'app' => 'files_external',
+            ]);
+            return false;
+        }
+
+        $dateTime = $object->lastModified ? \DateTime::createFromFormat(\DateTime::RFC1123, $object->lastModified) : false;
+        $mtime = $dateTime ? $dateTime->getTimestamp() : null;
+        $objectMetadata = $object->getMetadata();
+        if (isset($objectMetadata['timestamp'])) {
+            $mtime = $objectMetadata['timestamp'];
+        }
+
+        if (!empty($mtime)) {
+            $mtime = floor($mtime);
+        }
+
+        $stat = array();
+        $stat['size'] = (int)$object->contentLength;
+        $stat['mtime'] = $mtime;
+        $stat['atime'] = time();
+        return $stat;
+    }
+
+    public function filetype($path) {
+        $path = $this->normalizePath($path);
+
+        if ($path !== '.' && $this->doesObjectExist($path)) {
+            return 'file';
+        }
+
+        if ($path !== '.') {
+            $path .= '/';
+        }
+
+        if ($this->doesObjectExist($path)) {
+            return 'dir';
+        }
+    }
+
+    public function unlink($path) {
+        $path = $this->normalizePath($path);
+
+        if ($this->is_dir($path)) {
+            return $this->rmdir($path);
+        }
+
+        try {
+            $this->objectStore->deleteObject($path);
+            $this->objectCache->remove($path);
+            $this->objectCache->remove($path . '/');
+        } catch (BadResponseError $e) {
+            if ($e->getResponse()->getStatusCode() !== 404) {
+                \OC::$server->getLogger()->logException($e, [
+                    'level' => ILogger::ERROR,
+                    'app' => 'files_external',
+                ]);
+                throw $e;
+            }
+        }
+
+        return true;
+    }
+
+    public function fopen($path, $mode) {
+        $path = $this->normalizePath($path);
+
+        switch ($mode) {
+            case 'a':
+            case 'ab':
+            case 'a+':
+                return false;
+            case 'r':
+            case 'rb':
+                try {
+                    return $this->objectStore->readObject($path);
+                } catch (BadResponseError $e) {
+                    \OC::$server->getLogger()->logException($e, [
+                        'level' => ILogger::ERROR,
+                        'app' => 'files_external',
+                    ]);
+                    return false;
+                }
+            case 'w':
+            case 'wb':
+            case 'r+':
+            case 'w+':
+            case 'wb+':
+            case 'x':
+            case 'x+':
+            case 'c':
+            case 'c+':
+                if (strrpos($path, '.') !== false) {
+                    $ext = substr($path, strrpos($path, '.'));
+                } else {
+                    $ext = '';
+                }
+                $tmpFile = \OC::$server->getTempManager()->getTemporaryFile($ext);
+                // Fetch existing file if required
+                if ($mode[0] !== 'w' && $this->file_exists($path)) {
+                    if ($mode[0] === 'x') {
+                        // File cannot already exist
+                        return false;
+                    }
+                    $source = $this->fopen($path, 'r');
+                    file_put_contents($tmpFile, $source);
+                }
+                $handle = fopen($tmpFile, $mode);
+                return CallbackWrapper::wrap($handle, null, null, function () use ($path, $tmpFile) {
+                    $this->writeBack($tmpFile, $path);
+                });
+        }
+    }
+
+    public function touch($path, $mtime = null) {
+        $path = $this->normalizePath($path);
+        if (is_null($mtime)) {
+            $mtime = time();
+        }
+        $metadata = ['timestamp' => $mtime];
+        if ($this->file_exists($path)) {
+            if ($this->is_dir($path) && $path !== '.') {
+                $path .= '/';
+            }
+
+            $object = $this->fetchObject($path);
+            if ($object->mergeMetadata($metadata)) {
+                // invalidate target object to force repopulation on fetch
+                $this->objectCache->remove($path);
+            }
+            return true;
+        } else {
+            $mimeType = \OC::$server->getMimeTypeDetector()->detectPath($path);
+            $this->getContainer()->createObject([
+                'name' => $path,
+                'content' => '',
+                'headers' => ['content-type' => 'httpd/unix-directory']
+            ]);
+            // invalidate target object to force repopulation on fetch
+            $this->objectCache->remove($path);
+            return true;
+        }
+    }
+
+    public function copy($path1, $path2) {
+        $path1 = $this->normalizePath($path1);
+        $path2 = $this->normalizePath($path2);
+
+        $fileType = $this->filetype($path1);
+        if ($fileType) {
+            // make way
+            $this->unlink($path2);
+        }
+
+        if ($fileType === 'file') {
+            try {
+                $source = $this->fetchObject($path1);
+                $source->copy([
+                    'destination' => $this->bucket . '/' . $path2
+                ]);
+                // invalidate target object to force repopulation on fetch
+                $this->objectCache->remove($path2);
+                $this->objectCache->remove($path2 . '/');
+            } catch (BadResponseError $e) {
+                \OC::$server->getLogger()->logException($e, [
+                    'level' => ILogger::ERROR,
+                    'app' => 'files_external',
+                ]);
+                return false;
+            }
+
+        } else if ($fileType === 'dir') {
+            try {
+                $source = $this->fetchObject($path1 . '/');
+                $source->copy([
+                    'destination' => $this->bucket . '/' . $path2 . '/'
+                ]);
+                // invalidate target object to force repopulation on fetch
+                $this->objectCache->remove($path2);
+                $this->objectCache->remove($path2 . '/');
+            } catch (BadResponseError $e) {
+                \OC::$server->getLogger()->logException($e, [
+                    'level' => ILogger::ERROR,
+                    'app' => 'files_external',
+                ]);
+                return false;
+            }
+
+            $dh = $this->opendir($path1);
+            while ($file = readdir($dh)) {
+                if (\OC\Files\Filesystem::isIgnoredDir($file)) {
+                    continue;
+                }
+
+                $source = $path1 . '/' . $file;
+                $target = $path2 . '/' . $file;
+                $this->copy($source, $target);
+            }
+
+        } else {
+            //file does not exist
+            return false;
+        }
+
+        return true;
+    }
+
+    public function rename($path1, $path2) {
+        $path1 = $this->normalizePath($path1);
+        $path2 = $this->normalizePath($path2);
+
+        $fileType = $this->filetype($path1);
+
+        if ($fileType === 'dir' || $fileType === 'file') {
+            // copy
+            if ($this->copy($path1, $path2) === false) {
+                return false;
+            }
+
+            // cleanup
+            if ($this->unlink($path1) === false) {
+                throw new \Exception('failed to remove original');
+                $this->unlink($path2);
+                return false;
+            }
+
+            return true;
+        }
+
+        return false;
+    }
+
+    public function getId() {
+        return $this->id;
+    }
+
+    /**
+     * Returns the initialized object store container.
+     *
+     * @return \OpenStack\ObjectStore\v1\Models\Container
+     * @throws \OCP\Files\StorageAuthException
+     * @throws \OCP\Files\StorageNotAvailableException
+     */
+    public function getContainer() {
+        if (is_null($this->container)) {
+            $this->container = $this->connectionFactory->getContainer();
+
+            if (!$this->file_exists('.')) {
+                $this->mkdir('.');
+            }
+        }
+        return $this->container;
+    }
+
+    public function writeBack($tmpFile, $path) {
+        $fileData = fopen($tmpFile, 'r');
+        $this->objectStore->writeObject($path, $fileData);
+        // invalidate target object to force repopulation on fetch
+        $this->objectCache->remove($path);
+        unlink($tmpFile);
+    }
+
+    public function hasUpdated($path, $time) {
+        if ($this->is_file($path)) {
+            return parent::hasUpdated($path, $time);
+        }
+        $path = $this->normalizePath($path);
+        $dh = $this->opendir($path);
+        $content = array();
+        while (($file = readdir($dh)) !== false) {
+            $content[] = $file;
+        }
+        if ($path === '.') {
+            $path = '';
+        }
+        $cachedContent = $this->getCache()->getFolderContents($path);
+        $cachedNames = array_map(function ($content) {
+            return $content['name'];
+        }, $cachedContent);
+        sort($cachedNames);
+        sort($content);
+        return $cachedNames !== $content;
+    }
+
+    /**
+     * check if curl is installed
+     */
+    public static function checkDependencies() {
+        return true;
+    }
 
 }

apps/user_ldap/lib/Jobs/UpdateGroups.php

Indentation +164 added lines, -164 removed lines

@@ -46,183 +46,183 @@
 use OCP\ILogger;
 
 class UpdateGroups extends \OC\BackgroundJob\TimedJob {
-	static private $groupsFromDB;
-
-	static private $groupBE;
-
-	public function __construct(){
-		$this->interval = self::getRefreshInterval();
-	}
-
-	/**
-	 * @param mixed $argument
-	 */
-	public function run($argument){
-		self::updateGroups();
-	}
-
-	static public function updateGroups() {
-		\OCP\Util::writeLog('user_ldap', 'Run background job "updateGroups"', ILogger::DEBUG);
-
-		$knownGroups = array_keys(self::getKnownGroups());
-		$actualGroups = self::getGroupBE()->getGroups();
-
-		if(empty($actualGroups) && empty($knownGroups)) {
-			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – groups do not seem to be configured properly, aborting.',
-				ILogger::INFO);
-			return;
-		}
-
-		self::handleKnownGroups(array_intersect($actualGroups, $knownGroups));
-		self::handleCreatedGroups(array_diff($actualGroups, $knownGroups));
-		self::handleRemovedGroups(array_diff($knownGroups, $actualGroups));
-
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – Finished.', ILogger::DEBUG);
-	}
-
-	/**
-	 * @return int
-	 */
-	static private function getRefreshInterval() {
-		//defaults to every hour
-		return \OC::$server->getConfig()->getAppValue('user_ldap', 'bgjRefreshInterval', 3600);
-	}
-
-	/**
-	 * @param string[] $groups
-	 */
-	static private function handleKnownGroups($groups) {
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – Dealing with known Groups.', ILogger::DEBUG);
-		$query = \OC_DB::prepare('
+    static private $groupsFromDB;
+
+    static private $groupBE;
+
+    public function __construct(){
+        $this->interval = self::getRefreshInterval();
+    }
+
+    /**
+     * @param mixed $argument
+     */
+    public function run($argument){
+        self::updateGroups();
+    }
+
+    static public function updateGroups() {
+        \OCP\Util::writeLog('user_ldap', 'Run background job "updateGroups"', ILogger::DEBUG);
+
+        $knownGroups = array_keys(self::getKnownGroups());
+        $actualGroups = self::getGroupBE()->getGroups();
+
+        if(empty($actualGroups) && empty($knownGroups)) {
+            \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – groups do not seem to be configured properly, aborting.',
+                ILogger::INFO);
+            return;
+        }
+
+        self::handleKnownGroups(array_intersect($actualGroups, $knownGroups));
+        self::handleCreatedGroups(array_diff($actualGroups, $knownGroups));
+        self::handleRemovedGroups(array_diff($knownGroups, $actualGroups));
+
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – Finished.', ILogger::DEBUG);
+    }
+
+    /**
+     * @return int
+     */
+    static private function getRefreshInterval() {
+        //defaults to every hour
+        return \OC::$server->getConfig()->getAppValue('user_ldap', 'bgjRefreshInterval', 3600);
+    }
+
+    /**
+     * @param string[] $groups
+     */
+    static private function handleKnownGroups($groups) {
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – Dealing with known Groups.', ILogger::DEBUG);
+        $query = \OC_DB::prepare('
 			UPDATE `*PREFIX*ldap_group_members`
 			SET `owncloudusers` = ?
 			WHERE `owncloudname` = ?
 		');
-		foreach($groups as $group) {
-			//we assume, that self::$groupsFromDB has been retrieved already
-			$knownUsers = unserialize(self::$groupsFromDB[$group]['owncloudusers']);
-			$actualUsers = self::getGroupBE()->usersInGroup($group);
-			$hasChanged = false;
-			foreach(array_diff($knownUsers, $actualUsers) as $removedUser) {
-				\OCP\Util::emitHook('OC_User', 'post_removeFromGroup', array('uid' => $removedUser, 'gid' => $group));
-				\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – "'.$removedUser.'" removed from "'.$group.'".',
-					ILogger::INFO);
-				$hasChanged = true;
-			}
-			foreach(array_diff($actualUsers, $knownUsers) as $addedUser) {
-				\OCP\Util::emitHook('OC_User', 'post_addToGroup', array('uid' => $addedUser, 'gid' => $group));
-				\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – "'.$addedUser.'" added to "'.$group.'".',
-					ILogger::INFO);
-				$hasChanged = true;
-			}
-			if($hasChanged) {
-				$query->execute(array(serialize($actualUsers), $group));
-			}
-		}
-		\OCP\Util::writeLog('user_ldap',
-			'bgJ "updateGroups" – FINISHED dealing with known Groups.',
-			ILogger::DEBUG);
-	}
-
-	/**
-	 * @param string[] $createdGroups
-	 */
-	static private function handleCreatedGroups($createdGroups) {
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with created Groups.', ILogger::DEBUG);
-		$query = \OC_DB::prepare('
+        foreach($groups as $group) {
+            //we assume, that self::$groupsFromDB has been retrieved already
+            $knownUsers = unserialize(self::$groupsFromDB[$group]['owncloudusers']);
+            $actualUsers = self::getGroupBE()->usersInGroup($group);
+            $hasChanged = false;
+            foreach(array_diff($knownUsers, $actualUsers) as $removedUser) {
+                \OCP\Util::emitHook('OC_User', 'post_removeFromGroup', array('uid' => $removedUser, 'gid' => $group));
+                \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – "'.$removedUser.'" removed from "'.$group.'".',
+                    ILogger::INFO);
+                $hasChanged = true;
+            }
+            foreach(array_diff($actualUsers, $knownUsers) as $addedUser) {
+                \OCP\Util::emitHook('OC_User', 'post_addToGroup', array('uid' => $addedUser, 'gid' => $group));
+                \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – "'.$addedUser.'" added to "'.$group.'".',
+                    ILogger::INFO);
+                $hasChanged = true;
+            }
+            if($hasChanged) {
+                $query->execute(array(serialize($actualUsers), $group));
+            }
+        }
+        \OCP\Util::writeLog('user_ldap',
+            'bgJ "updateGroups" – FINISHED dealing with known Groups.',
+            ILogger::DEBUG);
+    }
+
+    /**
+     * @param string[] $createdGroups
+     */
+    static private function handleCreatedGroups($createdGroups) {
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with created Groups.', ILogger::DEBUG);
+        $query = \OC_DB::prepare('
 			INSERT
 			INTO `*PREFIX*ldap_group_members` (`owncloudname`, `owncloudusers`)
 			VALUES (?, ?)
 		');
-		foreach($createdGroups as $createdGroup) {
-			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – new group "'.$createdGroup.'" found.',
-				ILogger::INFO);
-			$users = serialize(self::getGroupBE()->usersInGroup($createdGroup));
-			$query->execute(array($createdGroup, $users));
-		}
-		\OCP\Util::writeLog('user_ldap',
-			'bgJ "updateGroups" – FINISHED dealing with created Groups.',
-			ILogger::DEBUG);
-	}
-
-	/**
-	 * @param string[] $removedGroups
-	 */
-	static private function handleRemovedGroups($removedGroups) {
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with removed groups.', ILogger::DEBUG);
-		$query = \OC_DB::prepare('
+        foreach($createdGroups as $createdGroup) {
+            \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – new group "'.$createdGroup.'" found.',
+                ILogger::INFO);
+            $users = serialize(self::getGroupBE()->usersInGroup($createdGroup));
+            $query->execute(array($createdGroup, $users));
+        }
+        \OCP\Util::writeLog('user_ldap',
+            'bgJ "updateGroups" – FINISHED dealing with created Groups.',
+            ILogger::DEBUG);
+    }
+
+    /**
+     * @param string[] $removedGroups
+     */
+    static private function handleRemovedGroups($removedGroups) {
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with removed groups.', ILogger::DEBUG);
+        $query = \OC_DB::prepare('
 			DELETE
 			FROM `*PREFIX*ldap_group_members`
 			WHERE `owncloudname` = ?
 		');
-		foreach($removedGroups as $removedGroup) {
-			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – group "'.$removedGroup.'" was removed.',
-				ILogger::INFO);
-			$query->execute(array($removedGroup));
-		}
-		\OCP\Util::writeLog('user_ldap',
-			'bgJ "updateGroups" – FINISHED dealing with removed groups.',
-			ILogger::DEBUG);
-	}
-
-	/**
-	 * @return \OCA\User_LDAP\Group_LDAP|\OCA\User_LDAP\Group_Proxy
-	 */
-	static private function getGroupBE() {
-		if(!is_null(self::$groupBE)) {
-			return self::$groupBE;
-		}
-		$helper = new Helper(\OC::$server->getConfig());
-		$configPrefixes = $helper->getServerConfigurationPrefixes(true);
-		$ldapWrapper = new LDAP();
-		if(count($configPrefixes) === 1) {
-			//avoid the proxy when there is only one LDAP server configured
-			$dbc = \OC::$server->getDatabaseConnection();
-			$userManager = new Manager(
-				\OC::$server->getConfig(),
-				new FilesystemHelper(),
-				new LogWrapper(),
-				\OC::$server->getAvatarManager(),
-				new \OCP\Image(),
-				$dbc,
-				\OC::$server->getUserManager(),
-				\OC::$server->getNotificationManager());
-			$connector = new Connection($ldapWrapper, $configPrefixes[0]);
-			$ldapAccess = new Access($connector, $ldapWrapper, $userManager, $helper, \OC::$server->getConfig(), \OC::$server->getUserManager());
-			$groupMapper = new GroupMapping($dbc);
-			$userMapper  = new UserMapping($dbc);
-			$ldapAccess->setGroupMapper($groupMapper);
-			$ldapAccess->setUserMapper($userMapper);
-			self::$groupBE = new \OCA\User_LDAP\Group_LDAP($ldapAccess, \OC::$server->query('LDAPGroupPluginManager'));
-		} else {
-			self::$groupBE = new \OCA\User_LDAP\Group_Proxy($configPrefixes, $ldapWrapper, \OC::$server->query('LDAPGroupPluginManager'));
-		}
-
-		return self::$groupBE;
-	}
-
-	/**
-	 * @return array
-	 */
-	static private function getKnownGroups() {
-		if(is_array(self::$groupsFromDB)) {
-			return self::$groupsFromDB;
-		}
-		$query = \OC_DB::prepare('
+        foreach($removedGroups as $removedGroup) {
+            \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – group "'.$removedGroup.'" was removed.',
+                ILogger::INFO);
+            $query->execute(array($removedGroup));
+        }
+        \OCP\Util::writeLog('user_ldap',
+            'bgJ "updateGroups" – FINISHED dealing with removed groups.',
+            ILogger::DEBUG);
+    }
+
+    /**
+     * @return \OCA\User_LDAP\Group_LDAP|\OCA\User_LDAP\Group_Proxy
+     */
+    static private function getGroupBE() {
+        if(!is_null(self::$groupBE)) {
+            return self::$groupBE;
+        }
+        $helper = new Helper(\OC::$server->getConfig());
+        $configPrefixes = $helper->getServerConfigurationPrefixes(true);
+        $ldapWrapper = new LDAP();
+        if(count($configPrefixes) === 1) {
+            //avoid the proxy when there is only one LDAP server configured
+            $dbc = \OC::$server->getDatabaseConnection();
+            $userManager = new Manager(
+                \OC::$server->getConfig(),
+                new FilesystemHelper(),
+                new LogWrapper(),
+                \OC::$server->getAvatarManager(),
+                new \OCP\Image(),
+                $dbc,
+                \OC::$server->getUserManager(),
+                \OC::$server->getNotificationManager());
+            $connector = new Connection($ldapWrapper, $configPrefixes[0]);
+            $ldapAccess = new Access($connector, $ldapWrapper, $userManager, $helper, \OC::$server->getConfig(), \OC::$server->getUserManager());
+            $groupMapper = new GroupMapping($dbc);
+            $userMapper  = new UserMapping($dbc);
+            $ldapAccess->setGroupMapper($groupMapper);
+            $ldapAccess->setUserMapper($userMapper);
+            self::$groupBE = new \OCA\User_LDAP\Group_LDAP($ldapAccess, \OC::$server->query('LDAPGroupPluginManager'));
+        } else {
+            self::$groupBE = new \OCA\User_LDAP\Group_Proxy($configPrefixes, $ldapWrapper, \OC::$server->query('LDAPGroupPluginManager'));
+        }
+
+        return self::$groupBE;
+    }
+
+    /**
+     * @return array
+     */
+    static private function getKnownGroups() {
+        if(is_array(self::$groupsFromDB)) {
+            return self::$groupsFromDB;
+        }
+        $query = \OC_DB::prepare('
 			SELECT `owncloudname`, `owncloudusers`
 			FROM `*PREFIX*ldap_group_members`
 		');
-		$result = $query->execute()->fetchAll();
-		self::$groupsFromDB = array();
-		foreach($result as $dataset) {
-			self::$groupsFromDB[$dataset['owncloudname']] = $dataset;
-		}
-
-		return self::$groupsFromDB;
-	}
+        $result = $query->execute()->fetchAll();
+        self::$groupsFromDB = array();
+        foreach($result as $dataset) {
+            self::$groupsFromDB[$dataset['owncloudname']] = $dataset;
+        }
+
+        return self::$groupsFromDB;
+    }
 }

apps/user_ldap/lib/Connection.php

Indentation +615 added lines, -615 removed lines

@@ -59,620 +59,620 @@
  * @property string ldapExpertUUIDGroupAttr
  */
 class Connection extends LDAPUtility {
-	private $ldapConnectionRes = null;
-	private $configPrefix;
-	private $configID;
-	private $configured = false;
-	private $hasPagedResultSupport = true;
-	//whether connection should be kept on __destruct
-	private $dontDestruct = false;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported primary groups are available
-	 */
-	public $hasPrimaryGroups = true;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
-	 */
-	public $hasGidNumber = true;
-
-	//cache handler
-	protected $cache;
-
-	/** @var Configuration settings handler **/
-	protected $configuration;
-
-	protected $doNotValidate = false;
-
-	protected $ignoreValidation = false;
-
-	protected $bindResult = [];
-
-	/**
-	 * Constructor
-	 * @param ILDAPWrapper $ldap
-	 * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
-	 * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
-	 */
-	public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
-		parent::__construct($ldap);
-		$this->configPrefix = $configPrefix;
-		$this->configID = $configID;
-		$this->configuration = new Configuration($configPrefix,
-												 !is_null($configID));
-		$memcache = \OC::$server->getMemCacheFactory();
-		if($memcache->isAvailable()) {
-			$this->cache = $memcache->createDistributed();
-		}
-		$helper = new Helper(\OC::$server->getConfig());
-		$this->doNotValidate = !in_array($this->configPrefix,
-			$helper->getServerConfigurationPrefixes());
-		$this->hasPagedResultSupport =
-			(int)$this->configuration->ldapPagingSize !== 0
-			|| $this->ldap->hasPagedResultSupport();
-	}
-
-	public function __destruct() {
-		if(!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * defines behaviour when the instance is cloned
-	 */
-	public function __clone() {
-		$this->configuration = new Configuration($this->configPrefix,
-												 !is_null($this->configID));
-		$this->ldapConnectionRes = null;
-		$this->dontDestruct = true;
-	}
-
-	/**
-	 * @param string $name
-	 * @return bool|mixed
-	 */
-	public function __get($name) {
-		if(!$this->configured) {
-			$this->readConfiguration();
-		}
-
-		if($name === 'hasPagedResultSupport') {
-			return $this->hasPagedResultSupport;
-		}
-
-		return $this->configuration->$name;
-	}
-
-	/**
-	 * @param string $name
-	 * @param mixed $value
-	 */
-	public function __set($name, $value) {
-		$this->doNotValidate = false;
-		$before = $this->configuration->$name;
-		$this->configuration->$name = $value;
-		$after = $this->configuration->$name;
-		if($before !== $after) {
-			if ($this->configID !== '' && $this->configID !== null) {
-				$this->configuration->saveConfiguration();
-			}
-			$this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * sets whether the result of the configuration validation shall
-	 * be ignored when establishing the connection. Used by the Wizard
-	 * in early configuration state.
-	 * @param bool $state
-	 */
-	public function setIgnoreValidation($state) {
-		$this->ignoreValidation = (bool)$state;
-	}
-
-	/**
-	 * initializes the LDAP backend
-	 * @param bool $force read the config settings no matter what
-	 */
-	public function init($force = false) {
-		$this->readConfiguration($force);
-		$this->establishConnection();
-	}
-
-	/**
-	 * Returns the LDAP handler
-	 */
-	public function getConnectionResource() {
-		if(!$this->ldapConnectionRes) {
-			$this->init();
-		} else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
-			$this->ldapConnectionRes = null;
-			$this->establishConnection();
-		}
-		if(is_null($this->ldapConnectionRes)) {
-			\OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
-			throw new ServerNotAvailableException('Connection to LDAP server could not be established');
-		}
-		return $this->ldapConnectionRes;
-	}
-
-	/**
-	 * resets the connection resource
-	 */
-	public function resetConnectionResource() {
-		if(!is_null($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->ldapConnectionRes = null;
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * @param string|null $key
-	 * @return string
-	 */
-	private function getCacheKey($key) {
-		$prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
-		if(is_null($key)) {
-			return $prefix;
-		}
-		return $prefix.hash('sha256', $key);
-	}
-
-	/**
-	 * @param string $key
-	 * @return mixed|null
-	 */
-	public function getFromCache($key) {
-		if(!$this->configured) {
-			$this->readConfiguration();
-		}
-		if(is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
-			return null;
-		}
-		$key = $this->getCacheKey($key);
-
-		return json_decode(base64_decode($this->cache->get($key)), true);
-	}
-
-	/**
-	 * @param string $key
-	 * @param mixed $value
-	 *
-	 * @return string
-	 */
-	public function writeToCache($key, $value) {
-		if(!$this->configured) {
-			$this->readConfiguration();
-		}
-		if(is_null($this->cache)
-			|| !$this->configuration->ldapCacheTTL
-			|| !$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		$key   = $this->getCacheKey($key);
-		$value = base64_encode(json_encode($value));
-		$this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
-	}
-
-	public function clearCache() {
-		if(!is_null($this->cache)) {
-			$this->cache->clear($this->getCacheKey(null));
-		}
-	}
-
-	/**
-	 * Caches the general LDAP configuration.
-	 * @param bool $force optional. true, if the re-read should be forced. defaults
-	 * to false.
-	 * @return null
-	 */
-	private function readConfiguration($force = false) {
-		if((!$this->configured || $force) && !is_null($this->configID)) {
-			$this->configuration->readConfiguration();
-			$this->configured = $this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * set LDAP configuration with values delivered by an array, not read from configuration
-	 * @param array $config array that holds the config parameters in an associated array
-	 * @param array &$setParameters optional; array where the set fields will be given to
-	 * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
-	 */
-	public function setConfiguration($config, &$setParameters = null) {
-		if(is_null($setParameters)) {
-			$setParameters = array();
-		}
-		$this->doNotValidate = false;
-		$this->configuration->setConfiguration($config, $setParameters);
-		if(count($setParameters) > 0) {
-			$this->configured = $this->validateConfiguration();
-		}
-
-
-		return $this->configured;
-	}
-
-	/**
-	 * saves the current Configuration in the database and empties the
-	 * cache
-	 * @return null
-	 */
-	public function saveConfiguration() {
-		$this->configuration->saveConfiguration();
-		$this->clearCache();
-	}
-
-	/**
-	 * get the current LDAP configuration
-	 * @return array
-	 */
-	public function getConfiguration() {
-		$this->readConfiguration();
-		$config = $this->configuration->getConfiguration();
-		$cta = $this->configuration->getConfigTranslationArray();
-		$result = array();
-		foreach($cta as $dbkey => $configkey) {
-			switch($configkey) {
-				case 'homeFolderNamingRule':
-					if(strpos($config[$configkey], 'attr:') === 0) {
-						$result[$dbkey] = substr($config[$configkey], 5);
-					} else {
-						$result[$dbkey] = '';
-					}
-					break;
-				case 'ldapBase':
-				case 'ldapBaseUsers':
-				case 'ldapBaseGroups':
-				case 'ldapAttributesForUserSearch':
-				case 'ldapAttributesForGroupSearch':
-					if(is_array($config[$configkey])) {
-						$result[$dbkey] = implode("\n", $config[$configkey]);
-						break;
-					} //else follows default
-				default:
-					$result[$dbkey] = $config[$configkey];
-			}
-		}
-		return $result;
-	}
-
-	private function doSoftValidation() {
-		//if User or Group Base are not set, take over Base DN setting
-		foreach(array('ldapBaseUsers', 'ldapBaseGroups') as $keyBase) {
-			$val = $this->configuration->$keyBase;
-			if(empty($val)) {
-				$this->configuration->$keyBase = $this->configuration->ldapBase;
-			}
-		}
-
-		foreach(array('ldapExpertUUIDUserAttr'  => 'ldapUuidUserAttribute',
-					  'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute')
-				as $expertSetting => $effectiveSetting) {
-			$uuidOverride = $this->configuration->$expertSetting;
-			if(!empty($uuidOverride)) {
-				$this->configuration->$effectiveSetting = $uuidOverride;
-			} else {
-				$uuidAttributes = Access::UUID_ATTRIBUTES;
-				array_unshift($uuidAttributes, 'auto');
-				if(!in_array($this->configuration->$effectiveSetting,
-							$uuidAttributes)
-					&& (!is_null($this->configID))) {
-					$this->configuration->$effectiveSetting = 'auto';
-					$this->configuration->saveConfiguration();
-					\OCP\Util::writeLog('user_ldap',
-										'Illegal value for the '.
-										$effectiveSetting.', '.'reset to '.
-										'autodetect.', ILogger::INFO);
-				}
-
-			}
-		}
-
-		$backupPort = (int)$this->configuration->ldapBackupPort;
-		if ($backupPort <= 0) {
-			$this->configuration->backupPort = $this->configuration->ldapPort;
-		}
-
-		//make sure empty search attributes are saved as simple, empty array
-		$saKeys = array('ldapAttributesForUserSearch',
-						'ldapAttributesForGroupSearch');
-		foreach($saKeys as $key) {
-			$val = $this->configuration->$key;
-			if(is_array($val) && count($val) === 1 && empty($val[0])) {
-				$this->configuration->$key = array();
-			}
-		}
-
-		if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
-			&& $this->configuration->ldapTLS) {
-			$this->configuration->ldapTLS = false;
-			\OCP\Util::writeLog(
-				'user_ldap',
-				'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
-				ILogger::INFO
-			);
-		}
-	}
-
-	/**
-	 * @return bool
-	 */
-	private function doCriticalValidation() {
-		$configurationOK = true;
-		$errorStr = 'Configuration Error (prefix '.
-			(string)$this->configPrefix .'): ';
-
-		//options that shall not be empty
-		$options = array('ldapHost', 'ldapPort', 'ldapUserDisplayName',
-						 'ldapGroupDisplayName', 'ldapLoginFilter');
-		foreach($options as $key) {
-			$val = $this->configuration->$key;
-			if(empty($val)) {
-				switch($key) {
-					case 'ldapHost':
-						$subj = 'LDAP Host';
-						break;
-					case 'ldapPort':
-						$subj = 'LDAP Port';
-						break;
-					case 'ldapUserDisplayName':
-						$subj = 'LDAP User Display Name';
-						break;
-					case 'ldapGroupDisplayName':
-						$subj = 'LDAP Group Display Name';
-						break;
-					case 'ldapLoginFilter':
-						$subj = 'LDAP Login Filter';
-						break;
-					default:
-						$subj = $key;
-						break;
-				}
-				$configurationOK = false;
-				\OCP\Util::writeLog(
-					'user_ldap',
-					$errorStr.'No '.$subj.' given!',
-					ILogger::WARN
-				);
-			}
-		}
-
-		//combinations
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-		if (
-			($agent === ''  && $pwd !== '')
-			|| ($agent !== '' && $pwd === '')
-		) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'either no password is given for the user ' .
-					'agent or a password is given, but not an LDAP agent.',
-				ILogger::WARN);
-			$configurationOK = false;
-		}
-
-		$base = $this->configuration->ldapBase;
-		$baseUsers = $this->configuration->ldapBaseUsers;
-		$baseGroups = $this->configuration->ldapBaseGroups;
-
-		if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'Not a single Base DN given.',
-				ILogger::WARN
-			);
-			$configurationOK = false;
-		}
-
-		if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
-		   === false) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'login filter does not contain %uid place holder.',
-				ILogger::WARN
-			);
-			$configurationOK = false;
-		}
-
-		return $configurationOK;
-	}
-
-	/**
-	 * Validates the user specified configuration
-	 * @return bool true if configuration seems OK, false otherwise
-	 */
-	private function validateConfiguration() {
-
-		if($this->doNotValidate) {
-			//don't do a validation if it is a new configuration with pure
-			//default values. Will be allowed on changes via __set or
-			//setConfiguration
-			return false;
-		}
-
-		// first step: "soft" checks: settings that are not really
-		// necessary, but advisable. If left empty, give an info message
-		$this->doSoftValidation();
-
-		//second step: critical checks. If left empty or filled wrong, mark as
-		//not configured and give a warning.
-		return $this->doCriticalValidation();
-	}
-
-
-	/**
-	 * Connects and Binds to LDAP
-	 */
-	private function establishConnection() {
-		if(!$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		static $phpLDAPinstalled = true;
-		if(!$phpLDAPinstalled) {
-			return false;
-		}
-		if(!$this->ignoreValidation && !$this->configured) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				'Configuration is invalid, cannot connect',
-				ILogger::WARN
-			);
-			return false;
-		}
-		if(!$this->ldapConnectionRes) {
-			if(!$this->ldap->areLDAPFunctionsAvailable()) {
-				$phpLDAPinstalled = false;
-				\OCP\Util::writeLog(
-					'user_ldap',
-					'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
-					ILogger::ERROR
-				);
-
-				return false;
-			}
-			if($this->configuration->turnOffCertCheck) {
-				if(putenv('LDAPTLS_REQCERT=never')) {
-					\OCP\Util::writeLog('user_ldap',
-						'Turned off SSL certificate validation successfully.',
-						ILogger::DEBUG);
-				} else {
-					\OCP\Util::writeLog(
-						'user_ldap',
-						'Could not turn off SSL certificate validation.',
-						ILogger::WARN
-					);
-				}
-			}
-
-			$isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
-				|| $this->getFromCache('overrideMainServer'));
-			$isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
-			$bindStatus = false;
-			$error = -1;
-			try {
-				if (!$isOverrideMainServer) {
-					$this->doConnect($this->configuration->ldapHost,
-						$this->configuration->ldapPort);
-					$bindStatus = $this->bind();
-					$error = $this->ldap->isResource($this->ldapConnectionRes) ?
-						$this->ldap->errno($this->ldapConnectionRes) : -1;
-				}
-				if($bindStatus === true) {
-					return $bindStatus;
-				}
-			} catch (ServerNotAvailableException $e) {
-				if(!$isBackupHost) {
-					throw $e;
-				}
-			}
-
-			//if LDAP server is not reachable, try the Backup (Replica!) Server
-			if($isBackupHost && ($error !== 0 || $isOverrideMainServer)) {
-				$this->doConnect($this->configuration->ldapBackupHost,
-								 $this->configuration->ldapBackupPort);
-				$this->bindResult = [];
-				$bindStatus = $this->bind();
-				$error = $this->ldap->isResource($this->ldapConnectionRes) ?
-					$this->ldap->errno($this->ldapConnectionRes) : -1;
-				if($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
-					//when bind to backup server succeeded and failed to main server,
-					//skip contacting him until next cache refresh
-					$this->writeToCache('overrideMainServer', true);
-				}
-			}
-
-			return $bindStatus;
-		}
-		return null;
-	}
-
-	/**
-	 * @param string $host
-	 * @param string $port
-	 * @return bool
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	private function doConnect($host, $port) {
-		if ($host === '') {
-			return false;
-		}
-
-		$this->ldapConnectionRes = $this->ldap->connect($host, $port);
-
-		if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
-			throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
-		}
-
-		if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
-			throw new ServerNotAvailableException('Could not disable LDAP referrals.');
-		}
-
-		if($this->configuration->ldapTLS) {
-			if(!$this->ldap->startTls($this->ldapConnectionRes)) {
-				throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
-			}
-		}
-
-		return true;
-	}
-
-	/**
-	 * Binds to LDAP
-	 */
-	public function bind() {
-		if(!$this->configuration->ldapConfigurationActive) {
-			return false;
-		}
-		$cr = $this->ldapConnectionRes;
-		if(!$this->ldap->isResource($cr)) {
-			$cr = $this->getConnectionResource();
-		}
-
-		if(
-			count($this->bindResult) !== 0
-			&& $this->bindResult['dn'] === $this->configuration->ldapAgentName
-			&& \OC::$server->getHasher()->verify(
-				$this->configPrefix . $this->configuration->ldapAgentPassword,
-				$this->bindResult['hash']
-			)
-		) {
-			// don't attempt to bind again with the same data as before
-			// bind might have been invoked via getConnectionResource(),
-			// but we need results specifically for e.g. user login
-			return $this->bindResult['result'];
-		}
-
-		$ldapLogin = @$this->ldap->bind($cr,
-										$this->configuration->ldapAgentName,
-										$this->configuration->ldapAgentPassword);
-
-		$this->bindResult = [
-			'dn' => $this->configuration->ldapAgentName,
-			'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
-			'result' => $ldapLogin,
-		];
-
-		if(!$ldapLogin) {
-			$errno = $this->ldap->errno($cr);
-
-			\OCP\Util::writeLog('user_ldap',
-				'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
-				ILogger::WARN);
-
-			// Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
-			if($errno !== 0x00 && $errno !== 0x31) {
-				$this->ldapConnectionRes = null;
-			}
-
-			return false;
-		}
-		return true;
-	}
+    private $ldapConnectionRes = null;
+    private $configPrefix;
+    private $configID;
+    private $configured = false;
+    private $hasPagedResultSupport = true;
+    //whether connection should be kept on __destruct
+    private $dontDestruct = false;
+
+    /**
+     * @var bool runtime flag that indicates whether supported primary groups are available
+     */
+    public $hasPrimaryGroups = true;
+
+    /**
+     * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
+     */
+    public $hasGidNumber = true;
+
+    //cache handler
+    protected $cache;
+
+    /** @var Configuration settings handler **/
+    protected $configuration;
+
+    protected $doNotValidate = false;
+
+    protected $ignoreValidation = false;
+
+    protected $bindResult = [];
+
+    /**
+     * Constructor
+     * @param ILDAPWrapper $ldap
+     * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
+     * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
+     */
+    public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
+        parent::__construct($ldap);
+        $this->configPrefix = $configPrefix;
+        $this->configID = $configID;
+        $this->configuration = new Configuration($configPrefix,
+                                                    !is_null($configID));
+        $memcache = \OC::$server->getMemCacheFactory();
+        if($memcache->isAvailable()) {
+            $this->cache = $memcache->createDistributed();
+        }
+        $helper = new Helper(\OC::$server->getConfig());
+        $this->doNotValidate = !in_array($this->configPrefix,
+            $helper->getServerConfigurationPrefixes());
+        $this->hasPagedResultSupport =
+            (int)$this->configuration->ldapPagingSize !== 0
+            || $this->ldap->hasPagedResultSupport();
+    }
+
+    public function __destruct() {
+        if(!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * defines behaviour when the instance is cloned
+     */
+    public function __clone() {
+        $this->configuration = new Configuration($this->configPrefix,
+                                                    !is_null($this->configID));
+        $this->ldapConnectionRes = null;
+        $this->dontDestruct = true;
+    }
+
+    /**
+     * @param string $name
+     * @return bool|mixed
+     */
+    public function __get($name) {
+        if(!$this->configured) {
+            $this->readConfiguration();
+        }
+
+        if($name === 'hasPagedResultSupport') {
+            return $this->hasPagedResultSupport;
+        }
+
+        return $this->configuration->$name;
+    }
+
+    /**
+     * @param string $name
+     * @param mixed $value
+     */
+    public function __set($name, $value) {
+        $this->doNotValidate = false;
+        $before = $this->configuration->$name;
+        $this->configuration->$name = $value;
+        $after = $this->configuration->$name;
+        if($before !== $after) {
+            if ($this->configID !== '' && $this->configID !== null) {
+                $this->configuration->saveConfiguration();
+            }
+            $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * sets whether the result of the configuration validation shall
+     * be ignored when establishing the connection. Used by the Wizard
+     * in early configuration state.
+     * @param bool $state
+     */
+    public function setIgnoreValidation($state) {
+        $this->ignoreValidation = (bool)$state;
+    }
+
+    /**
+     * initializes the LDAP backend
+     * @param bool $force read the config settings no matter what
+     */
+    public function init($force = false) {
+        $this->readConfiguration($force);
+        $this->establishConnection();
+    }
+
+    /**
+     * Returns the LDAP handler
+     */
+    public function getConnectionResource() {
+        if(!$this->ldapConnectionRes) {
+            $this->init();
+        } else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
+            $this->ldapConnectionRes = null;
+            $this->establishConnection();
+        }
+        if(is_null($this->ldapConnectionRes)) {
+            \OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
+            throw new ServerNotAvailableException('Connection to LDAP server could not be established');
+        }
+        return $this->ldapConnectionRes;
+    }
+
+    /**
+     * resets the connection resource
+     */
+    public function resetConnectionResource() {
+        if(!is_null($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->ldapConnectionRes = null;
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * @param string|null $key
+     * @return string
+     */
+    private function getCacheKey($key) {
+        $prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
+        if(is_null($key)) {
+            return $prefix;
+        }
+        return $prefix.hash('sha256', $key);
+    }
+
+    /**
+     * @param string $key
+     * @return mixed|null
+     */
+    public function getFromCache($key) {
+        if(!$this->configured) {
+            $this->readConfiguration();
+        }
+        if(is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
+            return null;
+        }
+        $key = $this->getCacheKey($key);
+
+        return json_decode(base64_decode($this->cache->get($key)), true);
+    }
+
+    /**
+     * @param string $key
+     * @param mixed $value
+     *
+     * @return string
+     */
+    public function writeToCache($key, $value) {
+        if(!$this->configured) {
+            $this->readConfiguration();
+        }
+        if(is_null($this->cache)
+            || !$this->configuration->ldapCacheTTL
+            || !$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        $key   = $this->getCacheKey($key);
+        $value = base64_encode(json_encode($value));
+        $this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
+    }
+
+    public function clearCache() {
+        if(!is_null($this->cache)) {
+            $this->cache->clear($this->getCacheKey(null));
+        }
+    }
+
+    /**
+     * Caches the general LDAP configuration.
+     * @param bool $force optional. true, if the re-read should be forced. defaults
+     * to false.
+     * @return null
+     */
+    private function readConfiguration($force = false) {
+        if((!$this->configured || $force) && !is_null($this->configID)) {
+            $this->configuration->readConfiguration();
+            $this->configured = $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * set LDAP configuration with values delivered by an array, not read from configuration
+     * @param array $config array that holds the config parameters in an associated array
+     * @param array &$setParameters optional; array where the set fields will be given to
+     * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
+     */
+    public function setConfiguration($config, &$setParameters = null) {
+        if(is_null($setParameters)) {
+            $setParameters = array();
+        }
+        $this->doNotValidate = false;
+        $this->configuration->setConfiguration($config, $setParameters);
+        if(count($setParameters) > 0) {
+            $this->configured = $this->validateConfiguration();
+        }
+
+
+        return $this->configured;
+    }
+
+    /**
+     * saves the current Configuration in the database and empties the
+     * cache
+     * @return null
+     */
+    public function saveConfiguration() {
+        $this->configuration->saveConfiguration();
+        $this->clearCache();
+    }
+
+    /**
+     * get the current LDAP configuration
+     * @return array
+     */
+    public function getConfiguration() {
+        $this->readConfiguration();
+        $config = $this->configuration->getConfiguration();
+        $cta = $this->configuration->getConfigTranslationArray();
+        $result = array();
+        foreach($cta as $dbkey => $configkey) {
+            switch($configkey) {
+                case 'homeFolderNamingRule':
+                    if(strpos($config[$configkey], 'attr:') === 0) {
+                        $result[$dbkey] = substr($config[$configkey], 5);
+                    } else {
+                        $result[$dbkey] = '';
+                    }
+                    break;
+                case 'ldapBase':
+                case 'ldapBaseUsers':
+                case 'ldapBaseGroups':
+                case 'ldapAttributesForUserSearch':
+                case 'ldapAttributesForGroupSearch':
+                    if(is_array($config[$configkey])) {
+                        $result[$dbkey] = implode("\n", $config[$configkey]);
+                        break;
+                    } //else follows default
+                default:
+                    $result[$dbkey] = $config[$configkey];
+            }
+        }
+        return $result;
+    }
+
+    private function doSoftValidation() {
+        //if User or Group Base are not set, take over Base DN setting
+        foreach(array('ldapBaseUsers', 'ldapBaseGroups') as $keyBase) {
+            $val = $this->configuration->$keyBase;
+            if(empty($val)) {
+                $this->configuration->$keyBase = $this->configuration->ldapBase;
+            }
+        }
+
+        foreach(array('ldapExpertUUIDUserAttr'  => 'ldapUuidUserAttribute',
+                        'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute')
+                as $expertSetting => $effectiveSetting) {
+            $uuidOverride = $this->configuration->$expertSetting;
+            if(!empty($uuidOverride)) {
+                $this->configuration->$effectiveSetting = $uuidOverride;
+            } else {
+                $uuidAttributes = Access::UUID_ATTRIBUTES;
+                array_unshift($uuidAttributes, 'auto');
+                if(!in_array($this->configuration->$effectiveSetting,
+                            $uuidAttributes)
+                    && (!is_null($this->configID))) {
+                    $this->configuration->$effectiveSetting = 'auto';
+                    $this->configuration->saveConfiguration();
+                    \OCP\Util::writeLog('user_ldap',
+                                        'Illegal value for the '.
+                                        $effectiveSetting.', '.'reset to '.
+                                        'autodetect.', ILogger::INFO);
+                }
+
+            }
+        }
+
+        $backupPort = (int)$this->configuration->ldapBackupPort;
+        if ($backupPort <= 0) {
+            $this->configuration->backupPort = $this->configuration->ldapPort;
+        }
+
+        //make sure empty search attributes are saved as simple, empty array
+        $saKeys = array('ldapAttributesForUserSearch',
+                        'ldapAttributesForGroupSearch');
+        foreach($saKeys as $key) {
+            $val = $this->configuration->$key;
+            if(is_array($val) && count($val) === 1 && empty($val[0])) {
+                $this->configuration->$key = array();
+            }
+        }
+
+        if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
+            && $this->configuration->ldapTLS) {
+            $this->configuration->ldapTLS = false;
+            \OCP\Util::writeLog(
+                'user_ldap',
+                'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
+                ILogger::INFO
+            );
+        }
+    }
+
+    /**
+     * @return bool
+     */
+    private function doCriticalValidation() {
+        $configurationOK = true;
+        $errorStr = 'Configuration Error (prefix '.
+            (string)$this->configPrefix .'): ';
+
+        //options that shall not be empty
+        $options = array('ldapHost', 'ldapPort', 'ldapUserDisplayName',
+                            'ldapGroupDisplayName', 'ldapLoginFilter');
+        foreach($options as $key) {
+            $val = $this->configuration->$key;
+            if(empty($val)) {
+                switch($key) {
+                    case 'ldapHost':
+                        $subj = 'LDAP Host';
+                        break;
+                    case 'ldapPort':
+                        $subj = 'LDAP Port';
+                        break;
+                    case 'ldapUserDisplayName':
+                        $subj = 'LDAP User Display Name';
+                        break;
+                    case 'ldapGroupDisplayName':
+                        $subj = 'LDAP Group Display Name';
+                        break;
+                    case 'ldapLoginFilter':
+                        $subj = 'LDAP Login Filter';
+                        break;
+                    default:
+                        $subj = $key;
+                        break;
+                }
+                $configurationOK = false;
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    $errorStr.'No '.$subj.' given!',
+                    ILogger::WARN
+                );
+            }
+        }
+
+        //combinations
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+        if (
+            ($agent === ''  && $pwd !== '')
+            || ($agent !== '' && $pwd === '')
+        ) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'either no password is given for the user ' .
+                    'agent or a password is given, but not an LDAP agent.',
+                ILogger::WARN);
+            $configurationOK = false;
+        }
+
+        $base = $this->configuration->ldapBase;
+        $baseUsers = $this->configuration->ldapBaseUsers;
+        $baseGroups = $this->configuration->ldapBaseGroups;
+
+        if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'Not a single Base DN given.',
+                ILogger::WARN
+            );
+            $configurationOK = false;
+        }
+
+        if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'login filter does not contain %uid place holder.',
+                ILogger::WARN
+            );
+            $configurationOK = false;
+        }
+
+        return $configurationOK;
+    }
+
+    /**
+     * Validates the user specified configuration
+     * @return bool true if configuration seems OK, false otherwise
+     */
+    private function validateConfiguration() {
+
+        if($this->doNotValidate) {
+            //don't do a validation if it is a new configuration with pure
+            //default values. Will be allowed on changes via __set or
+            //setConfiguration
+            return false;
+        }
+
+        // first step: "soft" checks: settings that are not really
+        // necessary, but advisable. If left empty, give an info message
+        $this->doSoftValidation();
+
+        //second step: critical checks. If left empty or filled wrong, mark as
+        //not configured and give a warning.
+        return $this->doCriticalValidation();
+    }
+
+
+    /**
+     * Connects and Binds to LDAP
+     */
+    private function establishConnection() {
+        if(!$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        static $phpLDAPinstalled = true;
+        if(!$phpLDAPinstalled) {
+            return false;
+        }
+        if(!$this->ignoreValidation && !$this->configured) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                'Configuration is invalid, cannot connect',
+                ILogger::WARN
+            );
+            return false;
+        }
+        if(!$this->ldapConnectionRes) {
+            if(!$this->ldap->areLDAPFunctionsAvailable()) {
+                $phpLDAPinstalled = false;
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
+                    ILogger::ERROR
+                );
+
+                return false;
+            }
+            if($this->configuration->turnOffCertCheck) {
+                if(putenv('LDAPTLS_REQCERT=never')) {
+                    \OCP\Util::writeLog('user_ldap',
+                        'Turned off SSL certificate validation successfully.',
+                        ILogger::DEBUG);
+                } else {
+                    \OCP\Util::writeLog(
+                        'user_ldap',
+                        'Could not turn off SSL certificate validation.',
+                        ILogger::WARN
+                    );
+                }
+            }
+
+            $isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
+                || $this->getFromCache('overrideMainServer'));
+            $isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
+            $bindStatus = false;
+            $error = -1;
+            try {
+                if (!$isOverrideMainServer) {
+                    $this->doConnect($this->configuration->ldapHost,
+                        $this->configuration->ldapPort);
+                    $bindStatus = $this->bind();
+                    $error = $this->ldap->isResource($this->ldapConnectionRes) ?
+                        $this->ldap->errno($this->ldapConnectionRes) : -1;
+                }
+                if($bindStatus === true) {
+                    return $bindStatus;
+                }
+            } catch (ServerNotAvailableException $e) {
+                if(!$isBackupHost) {
+                    throw $e;
+                }
+            }
+
+            //if LDAP server is not reachable, try the Backup (Replica!) Server
+            if($isBackupHost && ($error !== 0 || $isOverrideMainServer)) {
+                $this->doConnect($this->configuration->ldapBackupHost,
+                                    $this->configuration->ldapBackupPort);
+                $this->bindResult = [];
+                $bindStatus = $this->bind();
+                $error = $this->ldap->isResource($this->ldapConnectionRes) ?
+                    $this->ldap->errno($this->ldapConnectionRes) : -1;
+                if($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
+                    //when bind to backup server succeeded and failed to main server,
+                    //skip contacting him until next cache refresh
+                    $this->writeToCache('overrideMainServer', true);
+                }
+            }
+
+            return $bindStatus;
+        }
+        return null;
+    }
+
+    /**
+     * @param string $host
+     * @param string $port
+     * @return bool
+     * @throws \OC\ServerNotAvailableException
+     */
+    private function doConnect($host, $port) {
+        if ($host === '') {
+            return false;
+        }
+
+        $this->ldapConnectionRes = $this->ldap->connect($host, $port);
+
+        if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
+            throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
+        }
+
+        if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
+            throw new ServerNotAvailableException('Could not disable LDAP referrals.');
+        }
+
+        if($this->configuration->ldapTLS) {
+            if(!$this->ldap->startTls($this->ldapConnectionRes)) {
+                throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Binds to LDAP
+     */
+    public function bind() {
+        if(!$this->configuration->ldapConfigurationActive) {
+            return false;
+        }
+        $cr = $this->ldapConnectionRes;
+        if(!$this->ldap->isResource($cr)) {
+            $cr = $this->getConnectionResource();
+        }
+
+        if(
+            count($this->bindResult) !== 0
+            && $this->bindResult['dn'] === $this->configuration->ldapAgentName
+            && \OC::$server->getHasher()->verify(
+                $this->configPrefix . $this->configuration->ldapAgentPassword,
+                $this->bindResult['hash']
+            )
+        ) {
+            // don't attempt to bind again with the same data as before
+            // bind might have been invoked via getConnectionResource(),
+            // but we need results specifically for e.g. user login
+            return $this->bindResult['result'];
+        }
+
+        $ldapLogin = @$this->ldap->bind($cr,
+                                        $this->configuration->ldapAgentName,
+                                        $this->configuration->ldapAgentPassword);
+
+        $this->bindResult = [
+            'dn' => $this->configuration->ldapAgentName,
+            'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
+            'result' => $ldapLogin,
+        ];
+
+        if(!$ldapLogin) {
+            $errno = $this->ldap->errno($cr);
+
+            \OCP\Util::writeLog('user_ldap',
+                'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
+                ILogger::WARN);
+
+            // Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
+            if($errno !== 0x00 && $errno !== 0x31) {
+                $this->ldapConnectionRes = null;
+            }
+
+            return false;
+        }
+        return true;
+    }
 
 }

apps/user_ldap/lib/Wizard.php

Indentation +1314 added lines, -1314 removed lines

@@ -42,1320 +42,1320 @@
 use OCP\ILogger;
 
 class Wizard extends LDAPUtility {
-	/** @var \OCP\IL10N */
-	static protected $l;
-	protected $access;
-	protected $cr;
-	protected $configuration;
-	protected $result;
-	protected $resultCache = array();
-
-	const LRESULT_PROCESSED_OK = 2;
-	const LRESULT_PROCESSED_INVALID = 3;
-	const LRESULT_PROCESSED_SKIP = 4;
-
-	const LFILTER_LOGIN      = 2;
-	const LFILTER_USER_LIST  = 3;
-	const LFILTER_GROUP_LIST = 4;
-
-	const LFILTER_MODE_ASSISTED = 2;
-	const LFILTER_MODE_RAW = 1;
-
-	const LDAP_NW_TIMEOUT = 4;
-
-	/**
-	 * Constructor
-	 * @param Configuration $configuration an instance of Configuration
-	 * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
-	 * @param Access $access
-	 */
-	public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
-		parent::__construct($ldap);
-		$this->configuration = $configuration;
-		if(is_null(Wizard::$l)) {
-			Wizard::$l = \OC::$server->getL10N('user_ldap');
-		}
-		$this->access = $access;
-		$this->result = new WizardResult();
-	}
-
-	public function  __destruct() {
-		if($this->result->hasChanges()) {
-			$this->configuration->saveConfiguration();
-		}
-	}
-
-	/**
-	 * counts entries in the LDAP directory
-	 *
-	 * @param string $filter the LDAP search filter
-	 * @param string $type a string being either 'users' or 'groups';
-	 * @return int
-	 * @throws \Exception
-	 */
-	public function countEntries(string $filter, string $type): int {
-		$reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
-		if($type === 'users') {
-			$reqs[] = 'ldapUserFilter';
-		}
-		if(!$this->checkRequirements($reqs)) {
-			throw new \Exception('Requirements not met', 400);
-		}
-
-		$attr = ['dn']; // default
-		$limit = 1001;
-		if($type === 'groups') {
-			$result =  $this->access->countGroups($filter, $attr, $limit);
-		} else if($type === 'users') {
-			$result = $this->access->countUsers($filter, $attr, $limit);
-		} else if ($type === 'objects') {
-			$result = $this->access->countObjects($limit);
-		} else {
-			throw new \Exception('Internal error: Invalid object type', 500);
-		}
-
-		return (int)$result;
-	}
-
-	/**
-	 * formats the return value of a count operation to the string to be
-	 * inserted.
-	 *
-	 * @param int $count
-	 * @return string
-	 */
-	private function formatCountResult(int $count): string {
-		if($count > 1000) {
-			return '> 1000';
-		}
-		return (string)$count;
-	}
-
-	public function countGroups() {
-		$filter = $this->configuration->ldapGroupFilter;
-
-		if(empty($filter)) {
-			$output = self::$l->n('%s group found', '%s groups found', 0, array(0));
-			$this->result->addChange('ldap_group_count', $output);
-			return $this->result;
-		}
-
-		try {
-			$groupsTotal = $this->countEntries($filter, 'groups');
-		} catch (\Exception $e) {
-			//400 can be ignored, 500 is forwarded
-			if($e->getCode() === 500) {
-				throw $e;
-			}
-			return false;
-		}
-		$output = self::$l->n(
-			'%s group found',
-			'%s groups found',
-			$groupsTotal,
-			[$this->formatCountResult($groupsTotal)]
-		);
-		$this->result->addChange('ldap_group_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countUsers() {
-		$filter = $this->access->getFilterForUserCount();
-
-		$usersTotal = $this->countEntries($filter, 'users');
-		$output = self::$l->n(
-			'%s user found',
-			'%s users found',
-			$usersTotal,
-			[$this->formatCountResult($usersTotal)]
-		);
-		$this->result->addChange('ldap_user_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * counts any objects in the currently set base dn
-	 *
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countInBaseDN() {
-		// we don't need to provide a filter in this case
-		$total = $this->countEntries('', 'objects');
-		if($total === false) {
-			throw new \Exception('invalid results received');
-		}
-		$this->result->addChange('ldap_test_base', $total);
-		return $this->result;
-	}
-
-	/**
-	 * counts users with a specified attribute
-	 * @param string $attr
-	 * @param bool $existsCheck
-	 * @return int|bool
-	 */
-	public function countUsersWithAttribute($attr, $existsCheck = false) {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ))) {
-			return  false;
-		}
-
-		$filter = $this->access->combineFilterWithAnd(array(
-			$this->configuration->ldapUserFilter,
-			$attr . '=*'
-		));
-
-		$limit = ($existsCheck === false) ? null : 1;
-
-		return $this->access->countUsers($filter, array('dn'), $limit);
-	}
-
-	/**
-	 * detects the display name attribute. If a setting is already present that
-	 * returns at least one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 * @throws \Exception
-	 */
-	public function detectUserDisplayNameAttribute() {
-		if(!$this->checkRequirements(array('ldapHost',
-										'ldapPort',
-										'ldapBase',
-										'ldapUserFilter',
-										))) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapUserDisplayName;
-		if ($attr !== '' && $attr !== 'displayName') {
-			// most likely not the default value with upper case N,
-			// verify it still produces a result
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if($count > 0) {
-				//no change, but we sent it back to make sure the user interface
-				//is still correct, even if the ajax call was cancelled meanwhile
-				$this->result->addChange('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		// first attribute that has at least one result wins
-		$displayNameAttrs = array('displayname', 'cn');
-		foreach ($displayNameAttrs as $attr) {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-
-			if($count > 0) {
-				$this->applyFind('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
-	}
-
-	/**
-	 * detects the most often used email attribute for users applying to the
-	 * user list filter. If a setting is already present that returns at least
-	 * one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 */
-	public function detectEmailAttribute() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ))) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapEmailAttribute;
-		if ($attr !== '') {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if($count > 0) {
-				return false;
-			}
-			$writeLog = true;
-		} else {
-			$writeLog = false;
-		}
-
-		$emailAttributes = array('mail', 'mailPrimaryAddress');
-		$winner = '';
-		$maxUsers = 0;
-		foreach($emailAttributes as $attr) {
-			$count = $this->countUsersWithAttribute($attr);
-			if($count > $maxUsers) {
-				$maxUsers = $count;
-				$winner = $attr;
-			}
-		}
-
-		if($winner !== '') {
-			$this->applyFind('ldap_email_attr', $winner);
-			if($writeLog) {
-				\OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
-					'automatically been reset, because the original value ' .
-					'did not return any results.', ILogger::INFO);
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineAttributes() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ))) {
-			return  false;
-		}
-
-		$attributes = $this->getUserAttributes();
-
-		natcasesort($attributes);
-		$attributes = array_values($attributes);
-
-		$this->result->addOptions('ldap_loginfilter_attributes', $attributes);
-
-		$selected = $this->configuration->ldapLoginFilterAttributes;
-		if(is_array($selected) && !empty($selected)) {
-			$this->result->addChange('ldap_loginfilter_attributes', $selected);
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available LDAP attributes
-	 * @return array|false The instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function getUserAttributes() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ))) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$base = $this->configuration->ldapBase[0];
-		$filter = $this->configuration->ldapUserFilter;
-		$rr = $this->ldap->search($cr, $base, $filter, array(), 1, 1);
-		if(!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		$attributes = $this->ldap->getAttributes($cr, $er);
-		$pureAttributes = array();
-		for($i = 0; $i < $attributes['count']; $i++) {
-			$pureAttributes[] = $attributes[$i];
-		}
-
-		return $pureAttributes;
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForGroups() {
-		return $this->determineGroups('ldap_groupfilter_groups',
-									  'ldapGroupFilterGroups',
-									  false);
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForUsers() {
-		return $this->determineGroups('ldap_userfilter_groups',
-									  'ldapUserFilterGroups');
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @param bool $testMemberOf
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ))) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$this->fetchGroups($dbKey, $confKey);
-
-		if($testMemberOf) {
-			$this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
-			$this->result->markChange();
-			if(!$this->configuration->hasMemberOfFilterSupport) {
-				throw new \Exception('memberOf is not supported by the server');
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * fetches all groups from LDAP and adds them to the result object
-	 *
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @return array $groupEntries
-	 * @throws \Exception
-	 */
-	public function fetchGroups($dbKey, $confKey) {
-		$obclasses = array('posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames');
-
-		$filterParts = array();
-		foreach($obclasses as $obclass) {
-			$filterParts[] = 'objectclass='.$obclass;
-		}
-		//we filter for everything
-		//- that looks like a group and
-		//- has the group display name set
-		$filter = $this->access->combineFilterWithOr($filterParts);
-		$filter = $this->access->combineFilterWithAnd(array($filter, 'cn=*'));
-
-		$groupNames = array();
-		$groupEntries = array();
-		$limit = 400;
-		$offset = 0;
-		do {
-			// we need to request dn additionally here, otherwise memberOf
-			// detection will fail later
-			$result = $this->access->searchGroups($filter, array('cn', 'dn'), $limit, $offset);
-			foreach($result as $item) {
-				if(!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
-					// just in case - no issue known
-					continue;
-				}
-				$groupNames[] = $item['cn'][0];
-				$groupEntries[] = $item;
-			}
-			$offset += $limit;
-		} while ($this->access->hasMoreResults());
-
-		if(count($groupNames) > 0) {
-			natsort($groupNames);
-			$this->result->addOptions($dbKey, array_values($groupNames));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confKey;
-		if(is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbKey, $setFeatures);
-		}
-		return $groupEntries;
-	}
-
-	public function determineGroupMemberAssoc() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapGroupFilter',
-										   ))) {
-			return  false;
-		}
-		$attribute = $this->detectGroupMemberAssoc();
-		if($attribute === false) {
-			return false;
-		}
-		$this->configuration->setConfiguration(array('ldapGroupMemberAssocAttr' => $attribute));
-		$this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
-
-		return $this->result;
-	}
-
-	/**
-	 * Detects the available object classes
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	public function determineGroupObjectClasses() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ))) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = array('groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*');
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_groupfilter_objectclass',
-								'ldapGroupFilterObjectclass',
-								false);
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available object classes
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineUserObjectClasses() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ))) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = array('inetOrgPerson', 'person', 'organizationalPerson',
-						   'user', 'posixAccount', '*');
-		$filter = $this->configuration->ldapUserFilter;
-		//if filter is empty, it is probably the first time the wizard is called
-		//then, apply suggestions.
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_userfilter_objectclass',
-								'ldapUserFilterObjectclass',
-								empty($filter));
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getGroupFilter() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ))) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapGroupDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_group_display_name',
-							 $d['ldap_group_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
-
-		$this->applyFind('ldap_group_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getUserListFilter() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ))) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapUserDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_display_name', $d['ldap_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
-		if(!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_userlist_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @throws \Exception
-	 */
-	public function getUserLoginFilter() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ))) {
-			return false;
-		}
-
-		$filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
-		if(!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_login_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @param string $loginName
-	 * @throws \Exception
-	 */
-	public function testLoginName($loginName) {
-		if(!$this->checkRequirements(array('ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapLoginFilter',
-		))) {
-			return false;
-		}
-
-		$cr = $this->access->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			throw new \Exception('connection error');
-		}
-
-		if(mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
-			=== false) {
-			throw new \Exception('missing placeholder');
-		}
-
-		$users = $this->access->countUsersByLoginName($loginName);
-		if($this->ldap->errno($cr) !== 0) {
-			throw new \Exception($this->ldap->error($cr));
-		}
-		$filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
-		$this->result->addChange('ldap_test_loginname', $users);
-		$this->result->addChange('ldap_test_effective_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * Tries to determine the port, requires given Host, User DN and Password
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 * @throws \Exception
-	 */
-	public function guessPortAndTLS() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   ))) {
-			return false;
-		}
-		$this->checkHost();
-		$portSettings = $this->getPortSettingsToTry();
-
-		if(!is_array($portSettings)) {
-			throw new \Exception(print_r($portSettings, true));
-		}
-
-		//proceed from the best configuration and return on first success
-		foreach($portSettings as $setting) {
-			$p = $setting['port'];
-			$t = $setting['tls'];
-			\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
-			//connectAndBind may throw Exception, it needs to be catched by the
-			//callee of this method
-
-			try {
-				$settingsFound = $this->connectAndBind($p, $t);
-			} catch (\Exception $e) {
-				// any reply other than -1 (= cannot connect) is already okay,
-				// because then we found the server
-				// unavailable startTLS returns -11
-				if($e->getCode() > 0) {
-					$settingsFound = true;
-				} else {
-					throw $e;
-				}
-			}
-
-			if ($settingsFound === true) {
-				$config = array(
-					'ldapPort' => $p,
-					'ldapTLS' => (int)$t
-				);
-				$this->configuration->setConfiguration($config);
-				\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
-				$this->result->addChange('ldap_port', $p);
-				return $this->result;
-			}
-		}
-
-		//custom port, undetected (we do not brute force)
-		return false;
-	}
-
-	/**
-	 * tries to determine a base dn from User DN or LDAP Host
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 */
-	public function guessBaseDN() {
-		if(!$this->checkRequirements(array('ldapHost',
-										   'ldapPort',
-										   ))) {
-			return false;
-		}
-
-		//check whether a DN is given in the agent name (99.9% of all cases)
-		$base = null;
-		$i = stripos($this->configuration->ldapAgentName, 'dc=');
-		if($i !== false) {
-			$base = substr($this->configuration->ldapAgentName, $i);
-			if($this->testBaseDN($base)) {
-				$this->applyFind('ldap_base', $base);
-				return $this->result;
-			}
-		}
-
-		//this did not help :(
-		//Let's see whether we can parse the Host URL and convert the domain to
-		//a base DN
-		$helper = new Helper(\OC::$server->getConfig());
-		$domain = $helper->getDomainFromURL($this->configuration->ldapHost);
-		if(!$domain) {
-			return false;
-		}
-
-		$dparts = explode('.', $domain);
-		while(count($dparts) > 0) {
-			$base2 = 'dc=' . implode(',dc=', $dparts);
-			if ($base !== $base2 && $this->testBaseDN($base2)) {
-				$this->applyFind('ldap_base', $base2);
-				return $this->result;
-			}
-			array_shift($dparts);
-		}
-
-		return false;
-	}
-
-	/**
-	 * sets the found value for the configuration key in the WizardResult
-	 * as well as in the Configuration instance
-	 * @param string $key the configuration key
-	 * @param string $value the (detected) value
-	 *
-	 */
-	private function applyFind($key, $value) {
-		$this->result->addChange($key, $value);
-		$this->configuration->setConfiguration(array($key => $value));
-	}
-
-	/**
-	 * Checks, whether a port was entered in the Host configuration
-	 * field. In this case the port will be stripped off, but also stored as
-	 * setting.
-	 */
-	private function checkHost() {
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-
-		//removes Port from Host
-		if(is_array($hostInfo) && isset($hostInfo['port'])) {
-			$port = $hostInfo['port'];
-			$host = str_replace(':'.$port, '', $host);
-			$this->applyFind('ldap_host', $host);
-			$this->applyFind('ldap_port', $port);
-		}
-	}
-
-	/**
-	 * tries to detect the group member association attribute which is
-	 * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
-	 * @return string|false, string with the attribute name, false on error
-	 * @throws \Exception
-	 */
-	private function detectGroupMemberAssoc() {
-		$possibleAttrs = array('uniqueMember', 'memberUid', 'member', 'gidNumber');
-		$filter = $this->configuration->ldapGroupFilter;
-		if(empty($filter)) {
-			return false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$base = $this->configuration->ldapBase[0];
-		$rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
-		if(!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		while(is_resource($er)) {
-			$this->ldap->getDN($cr, $er);
-			$attrs = $this->ldap->getAttributes($cr, $er);
-			$result = array();
-			$possibleAttrsCount = count($possibleAttrs);
-			for($i = 0; $i < $possibleAttrsCount; $i++) {
-				if(isset($attrs[$possibleAttrs[$i]])) {
-					$result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
-				}
-			}
-			if(!empty($result)) {
-				natsort($result);
-				return key($result);
-			}
-
-			$er = $this->ldap->nextEntry($cr, $er);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Checks whether for a given BaseDN results will be returned
-	 * @param string $base the BaseDN to test
-	 * @return bool true on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function testBaseDN($base) {
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		//base is there, let's validate it. If we search for anything, we should
-		//get a result set > 0 on a proper base
-		$rr = $this->ldap->search($cr, $base, 'objectClass=*', array('dn'), 0, 1);
-		if(!$this->ldap->isResource($rr)) {
-			$errorNo  = $this->ldap->errno($cr);
-			$errorMsg = $this->ldap->error($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
-							' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
-			return false;
-		}
-		$entries = $this->ldap->countEntries($cr, $rr);
-		return ($entries !== false) && ($entries > 0);
-	}
-
-	/**
-	 * Checks whether the server supports memberOf in LDAP Filter.
-	 * Note: at least in OpenLDAP, availability of memberOf is dependent on
-	 * a configured objectClass. I.e. not necessarily for all available groups
-	 * memberOf does work.
-	 *
-	 * @return bool true if it does, false otherwise
-	 * @throws \Exception
-	 */
-	private function testMemberOf() {
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$result = $this->access->countUsers('memberOf=*', array('memberOf'), 1);
-		if(is_int($result) &&  $result > 0) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * creates an LDAP Filter from given configuration
-	 * @param integer $filterType int, for which use case the filter shall be created
-	 * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
-	 * self::LFILTER_GROUP_LIST
-	 * @return string|false string with the filter on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function composeLdapFilter($filterType) {
-		$filter = '';
-		$parts = 0;
-		switch ($filterType) {
-			case self::LFILTER_USER_LIST:
-				$objcs = $this->configuration->ldapUserFilterObjectclass;
-				//glue objectclasses
-				if(is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				if($this->configuration->hasMemberOfFilterSupport) {
-					$cns = $this->configuration->ldapUserFilterGroups;
-					if(is_array($cns) && count($cns) > 0) {
-						$filter .= '(|';
-						$cr = $this->getConnection();
-						if(!$cr) {
-							throw new \Exception('Could not connect to LDAP');
-						}
-						$base = $this->configuration->ldapBase[0];
-						foreach($cns as $cn) {
-							$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, array('dn', 'primaryGroupToken'));
-							if(!$this->ldap->isResource($rr)) {
-								continue;
-							}
-							$er = $this->ldap->firstEntry($cr, $rr);
-							$attrs = $this->ldap->getAttributes($cr, $er);
-							$dn = $this->ldap->getDN($cr, $er);
-							if ($dn === false || $dn === '') {
-								continue;
-							}
-							$filterPart = '(memberof=' . $dn . ')';
-							if(isset($attrs['primaryGroupToken'])) {
-								$pgt = $attrs['primaryGroupToken'][0];
-								$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
-								$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
-							}
-							$filter .= $filterPart;
-						}
-						$filter .= ')';
-					}
-					$parts++;
-				}
-				//wrap parts in AND condition
-				if($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				if ($filter === '') {
-					$filter = '(objectclass=*)';
-				}
-				break;
-
-			case self::LFILTER_GROUP_LIST:
-				$objcs = $this->configuration->ldapGroupFilterObjectclass;
-				//glue objectclasses
-				if(is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				$cns = $this->configuration->ldapGroupFilterGroups;
-				if(is_array($cns) && count($cns) > 0) {
-					$filter .= '(|';
-					foreach($cns as $cn) {
-						$filter .= '(cn=' . $cn . ')';
-					}
-					$filter .= ')';
-				}
-				$parts++;
-				//wrap parts in AND condition
-				if($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				break;
-
-			case self::LFILTER_LOGIN:
-				$ulf = $this->configuration->ldapUserFilter;
-				$loginpart = '=%uid';
-				$filterUsername = '';
-				$userAttributes = $this->getUserAttributes();
-				$userAttributes = array_change_key_case(array_flip($userAttributes));
-				$parts = 0;
-
-				if($this->configuration->ldapLoginFilterUsername === '1') {
-					$attr = '';
-					if(isset($userAttributes['uid'])) {
-						$attr = 'uid';
-					} else if(isset($userAttributes['samaccountname'])) {
-						$attr = 'samaccountname';
-					} else if(isset($userAttributes['cn'])) {
-						//fallback
-						$attr = 'cn';
-					}
-					if ($attr !== '') {
-						$filterUsername = '(' . $attr . $loginpart . ')';
-						$parts++;
-					}
-				}
-
-				$filterEmail = '';
-				if($this->configuration->ldapLoginFilterEmail === '1') {
-					$filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
-					$parts++;
-				}
-
-				$filterAttributes = '';
-				$attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
-				if(is_array($attrsToFilter) && count($attrsToFilter) > 0) {
-					$filterAttributes = '(|';
-					foreach($attrsToFilter as $attribute) {
-						$filterAttributes .= '(' . $attribute . $loginpart . ')';
-					}
-					$filterAttributes .= ')';
-					$parts++;
-				}
-
-				$filterLogin = '';
-				if($parts > 1) {
-					$filterLogin = '(|';
-				}
-				$filterLogin .= $filterUsername;
-				$filterLogin .= $filterEmail;
-				$filterLogin .= $filterAttributes;
-				if($parts > 1) {
-					$filterLogin .= ')';
-				}
-
-				$filter = '(&'.$ulf.$filterLogin.')';
-				break;
-		}
-
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
-
-		return $filter;
-	}
-
-	/**
-	 * Connects and Binds to an LDAP Server
-	 *
-	 * @param int $port the port to connect with
-	 * @param bool $tls whether startTLS is to be used
-	 * @return bool
-	 * @throws \Exception
-	 */
-	private function connectAndBind($port, $tls) {
-		//connect, does not really trigger any server communication
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-		if(!$hostInfo) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
-		$cr = $this->ldap->connect($host, $port);
-		if(!is_resource($cr)) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-
-		//set LDAP options
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-
-		try {
-			if($tls) {
-				$isTlsWorking = @$this->ldap->startTls($cr);
-				if(!$isTlsWorking) {
-					return false;
-				}
-			}
-
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
-			//interesting part: do the bind!
-			$login = $this->ldap->bind($cr,
-				$this->configuration->ldapAgentName,
-				$this->configuration->ldapAgentPassword
-			);
-			$errNo = $this->ldap->errno($cr);
-			$error = ldap_error($cr);
-			$this->ldap->unbind($cr);
-		} catch(ServerNotAvailableException $e) {
-			return false;
-		}
-
-		if($login === true) {
-			$this->ldap->unbind($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
-			return true;
-		}
-
-		if($errNo === -1) {
-			//host, port or TLS wrong
-			return false;
-		}
-		throw new \Exception($error, $errNo);
-	}
-
-	/**
-	 * checks whether a valid combination of agent and password has been
-	 * provided (either two values or nothing for anonymous connect)
-	 * @return bool, true if everything is fine, false otherwise
-	 */
-	private function checkAgentRequirements() {
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-
-		return
-			($agent !== '' && $pwd !== '')
-			||  ($agent === '' && $pwd === '')
-		;
-	}
-
-	/**
-	 * @param array $reqs
-	 * @return bool
-	 */
-	private function checkRequirements($reqs) {
-		$this->checkAgentRequirements();
-		foreach($reqs as $option) {
-			$value = $this->configuration->$option;
-			if(empty($value)) {
-				return false;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * does a cumulativeSearch on LDAP to get different values of a
-	 * specified attribute
-	 * @param string[] $filters array, the filters that shall be used in the search
-	 * @param string $attr the attribute of which a list of values shall be returned
-	 * @param int $dnReadLimit the amount of how many DNs should be analyzed.
-	 * The lower, the faster
-	 * @param string $maxF string. if not null, this variable will have the filter that
-	 * yields most result entries
-	 * @return array|false an array with the values on success, false otherwise
-	 */
-	public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
-		$dnRead = array();
-		$foundItems = array();
-		$maxEntries = 0;
-		if(!is_array($this->configuration->ldapBase)
-		   || !isset($this->configuration->ldapBase[0])) {
-			return false;
-		}
-		$base = $this->configuration->ldapBase[0];
-		$cr = $this->getConnection();
-		if(!$this->ldap->isResource($cr)) {
-			return false;
-		}
-		$lastFilter = null;
-		if(isset($filters[count($filters)-1])) {
-			$lastFilter = $filters[count($filters)-1];
-		}
-		foreach($filters as $filter) {
-			if($lastFilter === $filter && count($foundItems) > 0) {
-				//skip when the filter is a wildcard and results were found
-				continue;
-			}
-			// 20k limit for performance and reason
-			$rr = $this->ldap->search($cr, $base, $filter, array($attr), 0, 20000);
-			if(!$this->ldap->isResource($rr)) {
-				continue;
-			}
-			$entries = $this->ldap->countEntries($cr, $rr);
-			$getEntryFunc = 'firstEntry';
-			if(($entries !== false) && ($entries > 0)) {
-				if(!is_null($maxF) && $entries > $maxEntries) {
-					$maxEntries = $entries;
-					$maxF = $filter;
-				}
-				$dnReadCount = 0;
-				do {
-					$entry = $this->ldap->$getEntryFunc($cr, $rr);
-					$getEntryFunc = 'nextEntry';
-					if(!$this->ldap->isResource($entry)) {
-						continue 2;
-					}
-					$rr = $entry; //will be expected by nextEntry next round
-					$attributes = $this->ldap->getAttributes($cr, $entry);
-					$dn = $this->ldap->getDN($cr, $entry);
-					if($dn === false || in_array($dn, $dnRead)) {
-						continue;
-					}
-					$newItems = array();
-					$state = $this->getAttributeValuesFromEntry($attributes,
-																$attr,
-																$newItems);
-					$dnReadCount++;
-					$foundItems = array_merge($foundItems, $newItems);
-					$this->resultCache[$dn][$attr] = $newItems;
-					$dnRead[] = $dn;
-				} while(($state === self::LRESULT_PROCESSED_SKIP
-						|| $this->ldap->isResource($entry))
-						&& ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
-			}
-		}
-
-		return array_unique($foundItems);
-	}
-
-	/**
-	 * determines if and which $attr are available on the LDAP server
-	 * @param string[] $objectclasses the objectclasses to use as search filter
-	 * @param string $attr the attribute to look for
-	 * @param string $dbkey the dbkey of the setting the feature is connected to
-	 * @param string $confkey the confkey counterpart for the $dbkey as used in the
-	 * Configuration class
-	 * @param bool $po whether the objectClass with most result entries
-	 * shall be pre-selected via the result
-	 * @return array|false list of found items.
-	 * @throws \Exception
-	 */
-	private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$p = 'objectclass=';
-		foreach($objectclasses as $key => $value) {
-			$objectclasses[$key] = $p.$value;
-		}
-		$maxEntryObjC = '';
-
-		//how deep to dig?
-		//When looking for objectclasses, testing few entries is sufficient,
-		$dig = 3;
-
-		$availableFeatures =
-			$this->cumulativeSearchOnAttribute($objectclasses, $attr,
-											   $dig, $maxEntryObjC);
-		if(is_array($availableFeatures)
-		   && count($availableFeatures) > 0) {
-			natcasesort($availableFeatures);
-			//natcasesort keeps indices, but we must get rid of them for proper
-			//sorting in the web UI. Therefore: array_values
-			$this->result->addOptions($dbkey, array_values($availableFeatures));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confkey;
-		if(is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbkey, $setFeatures);
-		} else if ($po && $maxEntryObjC !== '') {
-			//pre-select objectclass with most result entries
-			$maxEntryObjC = str_replace($p, '', $maxEntryObjC);
-			$this->applyFind($dbkey, $maxEntryObjC);
-			$this->result->addChange($dbkey, $maxEntryObjC);
-		}
-
-		return $availableFeatures;
-	}
-
-	/**
-	 * appends a list of values fr
-	 * @param resource $result the return value from ldap_get_attributes
-	 * @param string $attribute the attribute values to look for
-	 * @param array &$known new values will be appended here
-	 * @return int, state on of the class constants LRESULT_PROCESSED_OK,
-	 * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
-	 */
-	private function getAttributeValuesFromEntry($result, $attribute, &$known) {
-		if(!is_array($result)
-		   || !isset($result['count'])
-		   || !$result['count'] > 0) {
-			return self::LRESULT_PROCESSED_INVALID;
-		}
-
-		// strtolower on all keys for proper comparison
-		$result = \OCP\Util::mb_array_change_key_case($result);
-		$attribute = strtolower($attribute);
-		if(isset($result[$attribute])) {
-			foreach($result[$attribute] as $key => $val) {
-				if($key === 'count') {
-					continue;
-				}
-				if(!in_array($val, $known)) {
-					$known[] = $val;
-				}
-			}
-			return self::LRESULT_PROCESSED_OK;
-		} else {
-			return self::LRESULT_PROCESSED_SKIP;
-		}
-	}
-
-	/**
-	 * @return bool|mixed
-	 */
-	private function getConnection() {
-		if(!is_null($this->cr)) {
-			return $this->cr;
-		}
-
-		$cr = $this->ldap->connect(
-			$this->configuration->ldapHost,
-			$this->configuration->ldapPort
-		);
-
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-		if($this->configuration->ldapTLS === 1) {
-			$this->ldap->startTls($cr);
-		}
-
-		$lo = @$this->ldap->bind($cr,
-								 $this->configuration->ldapAgentName,
-								 $this->configuration->ldapAgentPassword);
-		if($lo === true) {
-			$this->$cr = $cr;
-			return $cr;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getDefaultLdapPortSettings() {
-		static $settings = array(
-								array('port' => 7636, 'tls' => false),
-								array('port' =>  636, 'tls' => false),
-								array('port' => 7389, 'tls' => true),
-								array('port' =>  389, 'tls' => true),
-								array('port' => 7389, 'tls' => false),
-								array('port' =>  389, 'tls' => false),
-						  );
-		return $settings;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getPortSettingsToTry() {
-		//389 ← LDAP / Unencrypted or StartTLS
-		//636 ← LDAPS / SSL
-		//7xxx ← UCS. need to be checked first, because both ports may be open
-		$host = $this->configuration->ldapHost;
-		$port = (int)$this->configuration->ldapPort;
-		$portSettings = array();
-
-		//In case the port is already provided, we will check this first
-		if($port > 0) {
-			$hostInfo = parse_url($host);
-			if(!(is_array($hostInfo)
-				&& isset($hostInfo['scheme'])
-				&& stripos($hostInfo['scheme'], 'ldaps') !== false)) {
-				$portSettings[] = array('port' => $port, 'tls' => true);
-			}
-			$portSettings[] =array('port' => $port, 'tls' => false);
-		}
-
-		//default ports
-		$portSettings = array_merge($portSettings,
-		                            $this->getDefaultLdapPortSettings());
-
-		return $portSettings;
-	}
+    /** @var \OCP\IL10N */
+    static protected $l;
+    protected $access;
+    protected $cr;
+    protected $configuration;
+    protected $result;
+    protected $resultCache = array();
+
+    const LRESULT_PROCESSED_OK = 2;
+    const LRESULT_PROCESSED_INVALID = 3;
+    const LRESULT_PROCESSED_SKIP = 4;
+
+    const LFILTER_LOGIN      = 2;
+    const LFILTER_USER_LIST  = 3;
+    const LFILTER_GROUP_LIST = 4;
+
+    const LFILTER_MODE_ASSISTED = 2;
+    const LFILTER_MODE_RAW = 1;
+
+    const LDAP_NW_TIMEOUT = 4;
+
+    /**
+     * Constructor
+     * @param Configuration $configuration an instance of Configuration
+     * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
+     * @param Access $access
+     */
+    public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
+        parent::__construct($ldap);
+        $this->configuration = $configuration;
+        if(is_null(Wizard::$l)) {
+            Wizard::$l = \OC::$server->getL10N('user_ldap');
+        }
+        $this->access = $access;
+        $this->result = new WizardResult();
+    }
+
+    public function  __destruct() {
+        if($this->result->hasChanges()) {
+            $this->configuration->saveConfiguration();
+        }
+    }
+
+    /**
+     * counts entries in the LDAP directory
+     *
+     * @param string $filter the LDAP search filter
+     * @param string $type a string being either 'users' or 'groups';
+     * @return int
+     * @throws \Exception
+     */
+    public function countEntries(string $filter, string $type): int {
+        $reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
+        if($type === 'users') {
+            $reqs[] = 'ldapUserFilter';
+        }
+        if(!$this->checkRequirements($reqs)) {
+            throw new \Exception('Requirements not met', 400);
+        }
+
+        $attr = ['dn']; // default
+        $limit = 1001;
+        if($type === 'groups') {
+            $result =  $this->access->countGroups($filter, $attr, $limit);
+        } else if($type === 'users') {
+            $result = $this->access->countUsers($filter, $attr, $limit);
+        } else if ($type === 'objects') {
+            $result = $this->access->countObjects($limit);
+        } else {
+            throw new \Exception('Internal error: Invalid object type', 500);
+        }
+
+        return (int)$result;
+    }
+
+    /**
+     * formats the return value of a count operation to the string to be
+     * inserted.
+     *
+     * @param int $count
+     * @return string
+     */
+    private function formatCountResult(int $count): string {
+        if($count > 1000) {
+            return '> 1000';
+        }
+        return (string)$count;
+    }
+
+    public function countGroups() {
+        $filter = $this->configuration->ldapGroupFilter;
+
+        if(empty($filter)) {
+            $output = self::$l->n('%s group found', '%s groups found', 0, array(0));
+            $this->result->addChange('ldap_group_count', $output);
+            return $this->result;
+        }
+
+        try {
+            $groupsTotal = $this->countEntries($filter, 'groups');
+        } catch (\Exception $e) {
+            //400 can be ignored, 500 is forwarded
+            if($e->getCode() === 500) {
+                throw $e;
+            }
+            return false;
+        }
+        $output = self::$l->n(
+            '%s group found',
+            '%s groups found',
+            $groupsTotal,
+            [$this->formatCountResult($groupsTotal)]
+        );
+        $this->result->addChange('ldap_group_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countUsers() {
+        $filter = $this->access->getFilterForUserCount();
+
+        $usersTotal = $this->countEntries($filter, 'users');
+        $output = self::$l->n(
+            '%s user found',
+            '%s users found',
+            $usersTotal,
+            [$this->formatCountResult($usersTotal)]
+        );
+        $this->result->addChange('ldap_user_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * counts any objects in the currently set base dn
+     *
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countInBaseDN() {
+        // we don't need to provide a filter in this case
+        $total = $this->countEntries('', 'objects');
+        if($total === false) {
+            throw new \Exception('invalid results received');
+        }
+        $this->result->addChange('ldap_test_base', $total);
+        return $this->result;
+    }
+
+    /**
+     * counts users with a specified attribute
+     * @param string $attr
+     * @param bool $existsCheck
+     * @return int|bool
+     */
+    public function countUsersWithAttribute($attr, $existsCheck = false) {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ))) {
+            return  false;
+        }
+
+        $filter = $this->access->combineFilterWithAnd(array(
+            $this->configuration->ldapUserFilter,
+            $attr . '=*'
+        ));
+
+        $limit = ($existsCheck === false) ? null : 1;
+
+        return $this->access->countUsers($filter, array('dn'), $limit);
+    }
+
+    /**
+     * detects the display name attribute. If a setting is already present that
+     * returns at least one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     * @throws \Exception
+     */
+    public function detectUserDisplayNameAttribute() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                        'ldapPort',
+                                        'ldapBase',
+                                        'ldapUserFilter',
+                                        ))) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapUserDisplayName;
+        if ($attr !== '' && $attr !== 'displayName') {
+            // most likely not the default value with upper case N,
+            // verify it still produces a result
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if($count > 0) {
+                //no change, but we sent it back to make sure the user interface
+                //is still correct, even if the ajax call was cancelled meanwhile
+                $this->result->addChange('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        // first attribute that has at least one result wins
+        $displayNameAttrs = array('displayname', 'cn');
+        foreach ($displayNameAttrs as $attr) {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+
+            if($count > 0) {
+                $this->applyFind('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
+    }
+
+    /**
+     * detects the most often used email attribute for users applying to the
+     * user list filter. If a setting is already present that returns at least
+     * one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     */
+    public function detectEmailAttribute() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ))) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapEmailAttribute;
+        if ($attr !== '') {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if($count > 0) {
+                return false;
+            }
+            $writeLog = true;
+        } else {
+            $writeLog = false;
+        }
+
+        $emailAttributes = array('mail', 'mailPrimaryAddress');
+        $winner = '';
+        $maxUsers = 0;
+        foreach($emailAttributes as $attr) {
+            $count = $this->countUsersWithAttribute($attr);
+            if($count > $maxUsers) {
+                $maxUsers = $count;
+                $winner = $attr;
+            }
+        }
+
+        if($winner !== '') {
+            $this->applyFind('ldap_email_attr', $winner);
+            if($writeLog) {
+                \OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
+                    'automatically been reset, because the original value ' .
+                    'did not return any results.', ILogger::INFO);
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineAttributes() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ))) {
+            return  false;
+        }
+
+        $attributes = $this->getUserAttributes();
+
+        natcasesort($attributes);
+        $attributes = array_values($attributes);
+
+        $this->result->addOptions('ldap_loginfilter_attributes', $attributes);
+
+        $selected = $this->configuration->ldapLoginFilterAttributes;
+        if(is_array($selected) && !empty($selected)) {
+            $this->result->addChange('ldap_loginfilter_attributes', $selected);
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available LDAP attributes
+     * @return array|false The instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function getUserAttributes() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ))) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $base = $this->configuration->ldapBase[0];
+        $filter = $this->configuration->ldapUserFilter;
+        $rr = $this->ldap->search($cr, $base, $filter, array(), 1, 1);
+        if(!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        $attributes = $this->ldap->getAttributes($cr, $er);
+        $pureAttributes = array();
+        for($i = 0; $i < $attributes['count']; $i++) {
+            $pureAttributes[] = $attributes[$i];
+        }
+
+        return $pureAttributes;
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForGroups() {
+        return $this->determineGroups('ldap_groupfilter_groups',
+                                        'ldapGroupFilterGroups',
+                                        false);
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForUsers() {
+        return $this->determineGroups('ldap_userfilter_groups',
+                                        'ldapUserFilterGroups');
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @param string $dbKey
+     * @param string $confKey
+     * @param bool $testMemberOf
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ))) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $this->fetchGroups($dbKey, $confKey);
+
+        if($testMemberOf) {
+            $this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
+            $this->result->markChange();
+            if(!$this->configuration->hasMemberOfFilterSupport) {
+                throw new \Exception('memberOf is not supported by the server');
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * fetches all groups from LDAP and adds them to the result object
+     *
+     * @param string $dbKey
+     * @param string $confKey
+     * @return array $groupEntries
+     * @throws \Exception
+     */
+    public function fetchGroups($dbKey, $confKey) {
+        $obclasses = array('posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames');
+
+        $filterParts = array();
+        foreach($obclasses as $obclass) {
+            $filterParts[] = 'objectclass='.$obclass;
+        }
+        //we filter for everything
+        //- that looks like a group and
+        //- has the group display name set
+        $filter = $this->access->combineFilterWithOr($filterParts);
+        $filter = $this->access->combineFilterWithAnd(array($filter, 'cn=*'));
+
+        $groupNames = array();
+        $groupEntries = array();
+        $limit = 400;
+        $offset = 0;
+        do {
+            // we need to request dn additionally here, otherwise memberOf
+            // detection will fail later
+            $result = $this->access->searchGroups($filter, array('cn', 'dn'), $limit, $offset);
+            foreach($result as $item) {
+                if(!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
+                    // just in case - no issue known
+                    continue;
+                }
+                $groupNames[] = $item['cn'][0];
+                $groupEntries[] = $item;
+            }
+            $offset += $limit;
+        } while ($this->access->hasMoreResults());
+
+        if(count($groupNames) > 0) {
+            natsort($groupNames);
+            $this->result->addOptions($dbKey, array_values($groupNames));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confKey;
+        if(is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbKey, $setFeatures);
+        }
+        return $groupEntries;
+    }
+
+    public function determineGroupMemberAssoc() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapGroupFilter',
+                                            ))) {
+            return  false;
+        }
+        $attribute = $this->detectGroupMemberAssoc();
+        if($attribute === false) {
+            return false;
+        }
+        $this->configuration->setConfiguration(array('ldapGroupMemberAssocAttr' => $attribute));
+        $this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
+
+        return $this->result;
+    }
+
+    /**
+     * Detects the available object classes
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    public function determineGroupObjectClasses() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ))) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = array('groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*');
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_groupfilter_objectclass',
+                                'ldapGroupFilterObjectclass',
+                                false);
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available object classes
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineUserObjectClasses() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ))) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = array('inetOrgPerson', 'person', 'organizationalPerson',
+                            'user', 'posixAccount', '*');
+        $filter = $this->configuration->ldapUserFilter;
+        //if filter is empty, it is probably the first time the wizard is called
+        //then, apply suggestions.
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_userfilter_objectclass',
+                                'ldapUserFilterObjectclass',
+                                empty($filter));
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getGroupFilter() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ))) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapGroupDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_group_display_name',
+                                $d['ldap_group_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
+
+        $this->applyFind('ldap_group_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getUserListFilter() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ))) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapUserDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_display_name', $d['ldap_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
+        if(!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_userlist_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @throws \Exception
+     */
+    public function getUserLoginFilter() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ))) {
+            return false;
+        }
+
+        $filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
+        if(!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_login_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @param string $loginName
+     * @throws \Exception
+     */
+    public function testLoginName($loginName) {
+        if(!$this->checkRequirements(array('ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapLoginFilter',
+        ))) {
+            return false;
+        }
+
+        $cr = $this->access->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            throw new \Exception('connection error');
+        }
+
+        if(mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            throw new \Exception('missing placeholder');
+        }
+
+        $users = $this->access->countUsersByLoginName($loginName);
+        if($this->ldap->errno($cr) !== 0) {
+            throw new \Exception($this->ldap->error($cr));
+        }
+        $filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
+        $this->result->addChange('ldap_test_loginname', $users);
+        $this->result->addChange('ldap_test_effective_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * Tries to determine the port, requires given Host, User DN and Password
+     * @return WizardResult|false WizardResult on success, false otherwise
+     * @throws \Exception
+     */
+    public function guessPortAndTLS() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            ))) {
+            return false;
+        }
+        $this->checkHost();
+        $portSettings = $this->getPortSettingsToTry();
+
+        if(!is_array($portSettings)) {
+            throw new \Exception(print_r($portSettings, true));
+        }
+
+        //proceed from the best configuration and return on first success
+        foreach($portSettings as $setting) {
+            $p = $setting['port'];
+            $t = $setting['tls'];
+            \OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
+            //connectAndBind may throw Exception, it needs to be catched by the
+            //callee of this method
+
+            try {
+                $settingsFound = $this->connectAndBind($p, $t);
+            } catch (\Exception $e) {
+                // any reply other than -1 (= cannot connect) is already okay,
+                // because then we found the server
+                // unavailable startTLS returns -11
+                if($e->getCode() > 0) {
+                    $settingsFound = true;
+                } else {
+                    throw $e;
+                }
+            }
+
+            if ($settingsFound === true) {
+                $config = array(
+                    'ldapPort' => $p,
+                    'ldapTLS' => (int)$t
+                );
+                $this->configuration->setConfiguration($config);
+                \OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
+                $this->result->addChange('ldap_port', $p);
+                return $this->result;
+            }
+        }
+
+        //custom port, undetected (we do not brute force)
+        return false;
+    }
+
+    /**
+     * tries to determine a base dn from User DN or LDAP Host
+     * @return WizardResult|false WizardResult on success, false otherwise
+     */
+    public function guessBaseDN() {
+        if(!$this->checkRequirements(array('ldapHost',
+                                            'ldapPort',
+                                            ))) {
+            return false;
+        }
+
+        //check whether a DN is given in the agent name (99.9% of all cases)
+        $base = null;
+        $i = stripos($this->configuration->ldapAgentName, 'dc=');
+        if($i !== false) {
+            $base = substr($this->configuration->ldapAgentName, $i);
+            if($this->testBaseDN($base)) {
+                $this->applyFind('ldap_base', $base);
+                return $this->result;
+            }
+        }
+
+        //this did not help :(
+        //Let's see whether we can parse the Host URL and convert the domain to
+        //a base DN
+        $helper = new Helper(\OC::$server->getConfig());
+        $domain = $helper->getDomainFromURL($this->configuration->ldapHost);
+        if(!$domain) {
+            return false;
+        }
+
+        $dparts = explode('.', $domain);
+        while(count($dparts) > 0) {
+            $base2 = 'dc=' . implode(',dc=', $dparts);
+            if ($base !== $base2 && $this->testBaseDN($base2)) {
+                $this->applyFind('ldap_base', $base2);
+                return $this->result;
+            }
+            array_shift($dparts);
+        }
+
+        return false;
+    }
+
+    /**
+     * sets the found value for the configuration key in the WizardResult
+     * as well as in the Configuration instance
+     * @param string $key the configuration key
+     * @param string $value the (detected) value
+     *
+     */
+    private function applyFind($key, $value) {
+        $this->result->addChange($key, $value);
+        $this->configuration->setConfiguration(array($key => $value));
+    }
+
+    /**
+     * Checks, whether a port was entered in the Host configuration
+     * field. In this case the port will be stripped off, but also stored as
+     * setting.
+     */
+    private function checkHost() {
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+
+        //removes Port from Host
+        if(is_array($hostInfo) && isset($hostInfo['port'])) {
+            $port = $hostInfo['port'];
+            $host = str_replace(':'.$port, '', $host);
+            $this->applyFind('ldap_host', $host);
+            $this->applyFind('ldap_port', $port);
+        }
+    }
+
+    /**
+     * tries to detect the group member association attribute which is
+     * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
+     * @return string|false, string with the attribute name, false on error
+     * @throws \Exception
+     */
+    private function detectGroupMemberAssoc() {
+        $possibleAttrs = array('uniqueMember', 'memberUid', 'member', 'gidNumber');
+        $filter = $this->configuration->ldapGroupFilter;
+        if(empty($filter)) {
+            return false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $base = $this->configuration->ldapBase[0];
+        $rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
+        if(!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        while(is_resource($er)) {
+            $this->ldap->getDN($cr, $er);
+            $attrs = $this->ldap->getAttributes($cr, $er);
+            $result = array();
+            $possibleAttrsCount = count($possibleAttrs);
+            for($i = 0; $i < $possibleAttrsCount; $i++) {
+                if(isset($attrs[$possibleAttrs[$i]])) {
+                    $result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
+                }
+            }
+            if(!empty($result)) {
+                natsort($result);
+                return key($result);
+            }
+
+            $er = $this->ldap->nextEntry($cr, $er);
+        }
+
+        return false;
+    }
+
+    /**
+     * Checks whether for a given BaseDN results will be returned
+     * @param string $base the BaseDN to test
+     * @return bool true on success, false otherwise
+     * @throws \Exception
+     */
+    private function testBaseDN($base) {
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        //base is there, let's validate it. If we search for anything, we should
+        //get a result set > 0 on a proper base
+        $rr = $this->ldap->search($cr, $base, 'objectClass=*', array('dn'), 0, 1);
+        if(!$this->ldap->isResource($rr)) {
+            $errorNo  = $this->ldap->errno($cr);
+            $errorMsg = $this->ldap->error($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
+                            ' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
+            return false;
+        }
+        $entries = $this->ldap->countEntries($cr, $rr);
+        return ($entries !== false) && ($entries > 0);
+    }
+
+    /**
+     * Checks whether the server supports memberOf in LDAP Filter.
+     * Note: at least in OpenLDAP, availability of memberOf is dependent on
+     * a configured objectClass. I.e. not necessarily for all available groups
+     * memberOf does work.
+     *
+     * @return bool true if it does, false otherwise
+     * @throws \Exception
+     */
+    private function testMemberOf() {
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $result = $this->access->countUsers('memberOf=*', array('memberOf'), 1);
+        if(is_int($result) &&  $result > 0) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * creates an LDAP Filter from given configuration
+     * @param integer $filterType int, for which use case the filter shall be created
+     * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
+     * self::LFILTER_GROUP_LIST
+     * @return string|false string with the filter on success, false otherwise
+     * @throws \Exception
+     */
+    private function composeLdapFilter($filterType) {
+        $filter = '';
+        $parts = 0;
+        switch ($filterType) {
+            case self::LFILTER_USER_LIST:
+                $objcs = $this->configuration->ldapUserFilterObjectclass;
+                //glue objectclasses
+                if(is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                if($this->configuration->hasMemberOfFilterSupport) {
+                    $cns = $this->configuration->ldapUserFilterGroups;
+                    if(is_array($cns) && count($cns) > 0) {
+                        $filter .= '(|';
+                        $cr = $this->getConnection();
+                        if(!$cr) {
+                            throw new \Exception('Could not connect to LDAP');
+                        }
+                        $base = $this->configuration->ldapBase[0];
+                        foreach($cns as $cn) {
+                            $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, array('dn', 'primaryGroupToken'));
+                            if(!$this->ldap->isResource($rr)) {
+                                continue;
+                            }
+                            $er = $this->ldap->firstEntry($cr, $rr);
+                            $attrs = $this->ldap->getAttributes($cr, $er);
+                            $dn = $this->ldap->getDN($cr, $er);
+                            if ($dn === false || $dn === '') {
+                                continue;
+                            }
+                            $filterPart = '(memberof=' . $dn . ')';
+                            if(isset($attrs['primaryGroupToken'])) {
+                                $pgt = $attrs['primaryGroupToken'][0];
+                                $primaryFilterPart = '(primaryGroupID=' . $pgt .')';
+                                $filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
+                            }
+                            $filter .= $filterPart;
+                        }
+                        $filter .= ')';
+                    }
+                    $parts++;
+                }
+                //wrap parts in AND condition
+                if($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                if ($filter === '') {
+                    $filter = '(objectclass=*)';
+                }
+                break;
+
+            case self::LFILTER_GROUP_LIST:
+                $objcs = $this->configuration->ldapGroupFilterObjectclass;
+                //glue objectclasses
+                if(is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                $cns = $this->configuration->ldapGroupFilterGroups;
+                if(is_array($cns) && count($cns) > 0) {
+                    $filter .= '(|';
+                    foreach($cns as $cn) {
+                        $filter .= '(cn=' . $cn . ')';
+                    }
+                    $filter .= ')';
+                }
+                $parts++;
+                //wrap parts in AND condition
+                if($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                break;
+
+            case self::LFILTER_LOGIN:
+                $ulf = $this->configuration->ldapUserFilter;
+                $loginpart = '=%uid';
+                $filterUsername = '';
+                $userAttributes = $this->getUserAttributes();
+                $userAttributes = array_change_key_case(array_flip($userAttributes));
+                $parts = 0;
+
+                if($this->configuration->ldapLoginFilterUsername === '1') {
+                    $attr = '';
+                    if(isset($userAttributes['uid'])) {
+                        $attr = 'uid';
+                    } else if(isset($userAttributes['samaccountname'])) {
+                        $attr = 'samaccountname';
+                    } else if(isset($userAttributes['cn'])) {
+                        //fallback
+                        $attr = 'cn';
+                    }
+                    if ($attr !== '') {
+                        $filterUsername = '(' . $attr . $loginpart . ')';
+                        $parts++;
+                    }
+                }
+
+                $filterEmail = '';
+                if($this->configuration->ldapLoginFilterEmail === '1') {
+                    $filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
+                    $parts++;
+                }
+
+                $filterAttributes = '';
+                $attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
+                if(is_array($attrsToFilter) && count($attrsToFilter) > 0) {
+                    $filterAttributes = '(|';
+                    foreach($attrsToFilter as $attribute) {
+                        $filterAttributes .= '(' . $attribute . $loginpart . ')';
+                    }
+                    $filterAttributes .= ')';
+                    $parts++;
+                }
+
+                $filterLogin = '';
+                if($parts > 1) {
+                    $filterLogin = '(|';
+                }
+                $filterLogin .= $filterUsername;
+                $filterLogin .= $filterEmail;
+                $filterLogin .= $filterAttributes;
+                if($parts > 1) {
+                    $filterLogin .= ')';
+                }
+
+                $filter = '(&'.$ulf.$filterLogin.')';
+                break;
+        }
+
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
+
+        return $filter;
+    }
+
+    /**
+     * Connects and Binds to an LDAP Server
+     *
+     * @param int $port the port to connect with
+     * @param bool $tls whether startTLS is to be used
+     * @return bool
+     * @throws \Exception
+     */
+    private function connectAndBind($port, $tls) {
+        //connect, does not really trigger any server communication
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+        if(!$hostInfo) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
+        $cr = $this->ldap->connect($host, $port);
+        if(!is_resource($cr)) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+
+        //set LDAP options
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+
+        try {
+            if($tls) {
+                $isTlsWorking = @$this->ldap->startTls($cr);
+                if(!$isTlsWorking) {
+                    return false;
+                }
+            }
+
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
+            //interesting part: do the bind!
+            $login = $this->ldap->bind($cr,
+                $this->configuration->ldapAgentName,
+                $this->configuration->ldapAgentPassword
+            );
+            $errNo = $this->ldap->errno($cr);
+            $error = ldap_error($cr);
+            $this->ldap->unbind($cr);
+        } catch(ServerNotAvailableException $e) {
+            return false;
+        }
+
+        if($login === true) {
+            $this->ldap->unbind($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
+            return true;
+        }
+
+        if($errNo === -1) {
+            //host, port or TLS wrong
+            return false;
+        }
+        throw new \Exception($error, $errNo);
+    }
+
+    /**
+     * checks whether a valid combination of agent and password has been
+     * provided (either two values or nothing for anonymous connect)
+     * @return bool, true if everything is fine, false otherwise
+     */
+    private function checkAgentRequirements() {
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+
+        return
+            ($agent !== '' && $pwd !== '')
+            ||  ($agent === '' && $pwd === '')
+        ;
+    }
+
+    /**
+     * @param array $reqs
+     * @return bool
+     */
+    private function checkRequirements($reqs) {
+        $this->checkAgentRequirements();
+        foreach($reqs as $option) {
+            $value = $this->configuration->$option;
+            if(empty($value)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * does a cumulativeSearch on LDAP to get different values of a
+     * specified attribute
+     * @param string[] $filters array, the filters that shall be used in the search
+     * @param string $attr the attribute of which a list of values shall be returned
+     * @param int $dnReadLimit the amount of how many DNs should be analyzed.
+     * The lower, the faster
+     * @param string $maxF string. if not null, this variable will have the filter that
+     * yields most result entries
+     * @return array|false an array with the values on success, false otherwise
+     */
+    public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
+        $dnRead = array();
+        $foundItems = array();
+        $maxEntries = 0;
+        if(!is_array($this->configuration->ldapBase)
+           || !isset($this->configuration->ldapBase[0])) {
+            return false;
+        }
+        $base = $this->configuration->ldapBase[0];
+        $cr = $this->getConnection();
+        if(!$this->ldap->isResource($cr)) {
+            return false;
+        }
+        $lastFilter = null;
+        if(isset($filters[count($filters)-1])) {
+            $lastFilter = $filters[count($filters)-1];
+        }
+        foreach($filters as $filter) {
+            if($lastFilter === $filter && count($foundItems) > 0) {
+                //skip when the filter is a wildcard and results were found
+                continue;
+            }
+            // 20k limit for performance and reason
+            $rr = $this->ldap->search($cr, $base, $filter, array($attr), 0, 20000);
+            if(!$this->ldap->isResource($rr)) {
+                continue;
+            }
+            $entries = $this->ldap->countEntries($cr, $rr);
+            $getEntryFunc = 'firstEntry';
+            if(($entries !== false) && ($entries > 0)) {
+                if(!is_null($maxF) && $entries > $maxEntries) {
+                    $maxEntries = $entries;
+                    $maxF = $filter;
+                }
+                $dnReadCount = 0;
+                do {
+                    $entry = $this->ldap->$getEntryFunc($cr, $rr);
+                    $getEntryFunc = 'nextEntry';
+                    if(!$this->ldap->isResource($entry)) {
+                        continue 2;
+                    }
+                    $rr = $entry; //will be expected by nextEntry next round
+                    $attributes = $this->ldap->getAttributes($cr, $entry);
+                    $dn = $this->ldap->getDN($cr, $entry);
+                    if($dn === false || in_array($dn, $dnRead)) {
+                        continue;
+                    }
+                    $newItems = array();
+                    $state = $this->getAttributeValuesFromEntry($attributes,
+                                                                $attr,
+                                                                $newItems);
+                    $dnReadCount++;
+                    $foundItems = array_merge($foundItems, $newItems);
+                    $this->resultCache[$dn][$attr] = $newItems;
+                    $dnRead[] = $dn;
+                } while(($state === self::LRESULT_PROCESSED_SKIP
+                        || $this->ldap->isResource($entry))
+                        && ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
+            }
+        }
+
+        return array_unique($foundItems);
+    }
+
+    /**
+     * determines if and which $attr are available on the LDAP server
+     * @param string[] $objectclasses the objectclasses to use as search filter
+     * @param string $attr the attribute to look for
+     * @param string $dbkey the dbkey of the setting the feature is connected to
+     * @param string $confkey the confkey counterpart for the $dbkey as used in the
+     * Configuration class
+     * @param bool $po whether the objectClass with most result entries
+     * shall be pre-selected via the result
+     * @return array|false list of found items.
+     * @throws \Exception
+     */
+    private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $p = 'objectclass=';
+        foreach($objectclasses as $key => $value) {
+            $objectclasses[$key] = $p.$value;
+        }
+        $maxEntryObjC = '';
+
+        //how deep to dig?
+        //When looking for objectclasses, testing few entries is sufficient,
+        $dig = 3;
+
+        $availableFeatures =
+            $this->cumulativeSearchOnAttribute($objectclasses, $attr,
+                                                $dig, $maxEntryObjC);
+        if(is_array($availableFeatures)
+           && count($availableFeatures) > 0) {
+            natcasesort($availableFeatures);
+            //natcasesort keeps indices, but we must get rid of them for proper
+            //sorting in the web UI. Therefore: array_values
+            $this->result->addOptions($dbkey, array_values($availableFeatures));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confkey;
+        if(is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbkey, $setFeatures);
+        } else if ($po && $maxEntryObjC !== '') {
+            //pre-select objectclass with most result entries
+            $maxEntryObjC = str_replace($p, '', $maxEntryObjC);
+            $this->applyFind($dbkey, $maxEntryObjC);
+            $this->result->addChange($dbkey, $maxEntryObjC);
+        }
+
+        return $availableFeatures;
+    }
+
+    /**
+     * appends a list of values fr
+     * @param resource $result the return value from ldap_get_attributes
+     * @param string $attribute the attribute values to look for
+     * @param array &$known new values will be appended here
+     * @return int, state on of the class constants LRESULT_PROCESSED_OK,
+     * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
+     */
+    private function getAttributeValuesFromEntry($result, $attribute, &$known) {
+        if(!is_array($result)
+           || !isset($result['count'])
+           || !$result['count'] > 0) {
+            return self::LRESULT_PROCESSED_INVALID;
+        }
+
+        // strtolower on all keys for proper comparison
+        $result = \OCP\Util::mb_array_change_key_case($result);
+        $attribute = strtolower($attribute);
+        if(isset($result[$attribute])) {
+            foreach($result[$attribute] as $key => $val) {
+                if($key === 'count') {
+                    continue;
+                }
+                if(!in_array($val, $known)) {
+                    $known[] = $val;
+                }
+            }
+            return self::LRESULT_PROCESSED_OK;
+        } else {
+            return self::LRESULT_PROCESSED_SKIP;
+        }
+    }
+
+    /**
+     * @return bool|mixed
+     */
+    private function getConnection() {
+        if(!is_null($this->cr)) {
+            return $this->cr;
+        }
+
+        $cr = $this->ldap->connect(
+            $this->configuration->ldapHost,
+            $this->configuration->ldapPort
+        );
+
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+        if($this->configuration->ldapTLS === 1) {
+            $this->ldap->startTls($cr);
+        }
+
+        $lo = @$this->ldap->bind($cr,
+                                    $this->configuration->ldapAgentName,
+                                    $this->configuration->ldapAgentPassword);
+        if($lo === true) {
+            $this->$cr = $cr;
+            return $cr;
+        }
+
+        return false;
+    }
+
+    /**
+     * @return array
+     */
+    private function getDefaultLdapPortSettings() {
+        static $settings = array(
+                                array('port' => 7636, 'tls' => false),
+                                array('port' =>  636, 'tls' => false),
+                                array('port' => 7389, 'tls' => true),
+                                array('port' =>  389, 'tls' => true),
+                                array('port' => 7389, 'tls' => false),
+                                array('port' =>  389, 'tls' => false),
+                            );
+        return $settings;
+    }
+
+    /**
+     * @return array
+     */
+    private function getPortSettingsToTry() {
+        //389 ← LDAP / Unencrypted or StartTLS
+        //636 ← LDAPS / SSL
+        //7xxx ← UCS. need to be checked first, because both ports may be open
+        $host = $this->configuration->ldapHost;
+        $port = (int)$this->configuration->ldapPort;
+        $portSettings = array();
+
+        //In case the port is already provided, we will check this first
+        if($port > 0) {
+            $hostInfo = parse_url($host);
+            if(!(is_array($hostInfo)
+                && isset($hostInfo['scheme'])
+                && stripos($hostInfo['scheme'], 'ldaps') !== false)) {
+                $portSettings[] = array('port' => $port, 'tls' => true);
+            }
+            $portSettings[] =array('port' => $port, 'tls' => false);
+        }
+
+        //default ports
+        $portSettings = array_merge($portSettings,
+                                    $this->getDefaultLdapPortSettings());
+
+        return $portSettings;
+    }
 
 
 }