Merge remote-tracking branch 'origin' into bookshelves

2025-08-07 23:03:00 +03:00 · 2018-08-04 11:35:01 +01:00
parent 4948b443b6 c83a51f7e2
commit b5a2d3c1c4
70 changed files with 4091 additions and 3319 deletions
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -5,6 +5,7 @@ namespace BookStack\Http\Controllers\Auth;
 use BookStack\Exceptions\AuthException;
 use BookStack\Http\Controllers\Controller;
 use BookStack\Repos\UserRepo;
+use BookStack\Services\LdapService;
 use BookStack\Services\SocialAuthService;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
@@ -36,18 +37,21 @@ class LoginController extends Controller
    protected $redirectAfterLogout = '/login';

    protected $socialAuthService;
+    protected $ldapService;
    protected $userRepo;

    /**
     * Create a new controller instance.
     *
     * @param SocialAuthService $socialAuthService
+     * @param LdapService $ldapService
     * @param UserRepo $userRepo
     */
-    public function __construct(SocialAuthService $socialAuthService, UserRepo $userRepo)
+    public function __construct(SocialAuthService $socialAuthService, LdapService $ldapService, UserRepo $userRepo)
    {
        $this->middleware('guest', ['only' => ['getLogin', 'postLogin']]);
        $this->socialAuthService = $socialAuthService;
+        $this->ldapService = $ldapService;
        $this->userRepo = $userRepo;
        $this->redirectPath = baseUrl('/');
        $this->redirectAfterLogout = baseUrl('/login');
@@ -96,6 +100,11 @@ class LoginController extends Controller
            auth()->login($user);
        }

+        // Sync LDAP groups if required
+        if ($this->ldapService->shouldSyncGroups()) {
+            $this->ldapService->syncGroups($user);
+        }
+
        $path = session()->pull('url.intended', '/');
        $path = baseUrl($path, true);
        return redirect($path);
@@ -125,6 +134,7 @@ class LoginController extends Controller
     * Redirect to the relevant social site.
     * @param $socialDriver
     * @return \Symfony\Component\HttpFoundation\RedirectResponse
+     * @throws \BookStack\Exceptions\SocialDriverNotConfigured
     */
    public function getSocialLogin($socialDriver)
    {
--- a/app/Http/Controllers/PageController.php
+++ b/app/Http/Controllers/PageController.php
@@ -5,7 +5,6 @@ use BookStack\Exceptions\NotFoundException;
 use BookStack\Repos\EntityRepo;
 use BookStack\Repos\UserRepo;
 use BookStack\Services\ExportService;
-use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Views;
@@ -38,11 +37,18 @@ class PageController extends Controller
     * @param string $chapterSlug
     * @return Response
     * @internal param bool $pageSlug
+     * @throws NotFoundException
     */
    public function create($bookSlug, $chapterSlug = null)
    {
-        $book = $this->entityRepo->getBySlug('book', $bookSlug);
-        $chapter = $chapterSlug ? $this->entityRepo->getBySlug('chapter', $chapterSlug, $bookSlug) : null;
+        if ($chapterSlug !== null) {
+            $chapter = $this->entityRepo->getBySlug('chapter', $chapterSlug, $bookSlug);
+            $book = $chapter->book;
+        } else {
+            $chapter = null;
+            $book = $this->entityRepo->getBySlug('book', $bookSlug);
+        }
+
        $parent = $chapter ? $chapter : $book;
        $this->checkOwnablePermission('page-create', $parent);

@@ -52,7 +58,7 @@ class PageController extends Controller
            return redirect($draft->getUrl());
        }

-        // Otherwise show edit view
+        // Otherwise show the edit view if they're a guest
        $this->setPageTitle(trans('entities.pages_new'));
        return view('pages/guest-create', ['parent' => $parent]);
    }
@@ -71,8 +77,14 @@ class PageController extends Controller
            'name' => 'required|string|max:255'
        ]);

-        $book = $this->entityRepo->getBySlug('book', $bookSlug);
-        $chapter = $chapterSlug ? $this->entityRepo->getBySlug('chapter', $chapterSlug, $bookSlug) : null;
+        if ($chapterSlug !== null) {
+            $chapter = $this->entityRepo->getBySlug('chapter', $chapterSlug, $bookSlug);
+            $book = $chapter->book;
+        } else {
+            $chapter = null;
+            $book = $this->entityRepo->getBySlug('book', $bookSlug);
+        }
+
        $parent = $chapter ? $chapter : $book;
        $this->checkOwnablePermission('page-create', $parent);

@@ -93,7 +105,7 @@ class PageController extends Controller
    public function editDraft($bookSlug, $pageId)
    {
        $draft = $this->entityRepo->getById('page', $pageId, true);
-        $this->checkOwnablePermission('page-create', $draft->book);
+        $this->checkOwnablePermission('page-create', $draft->parent);
        $this->setPageTitle(trans('entities.pages_edit_draft'));

        $draftsEnabled = $this->signedIn;
@@ -119,12 +131,10 @@ class PageController extends Controller
        ]);

        $input = $request->all();
-        $book = $this->entityRepo->getBySlug('book', $bookSlug);
-
        $draftPage = $this->entityRepo->getById('page', $pageId, true);
+        $book = $draftPage->book;

-        $chapterId = intval($draftPage->chapter_id);
-        $parent = $chapterId !== 0 ? $this->entityRepo->getById('chapter', $chapterId) : $book;
+        $parent = $draftPage->parent;
        $this->checkOwnablePermission('page-create', $parent);

        if ($parent->isA('chapter')) {
--- a/app/Http/Controllers/PermissionController.php
+++ b/app/Http/Controllers/PermissionController.php
@@ -78,6 +78,7 @@ class PermissionController extends Controller
     * @param $id
     * @param Request $request
     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
+     * @throws PermissionsException
     */
    public function updateRole($id, Request $request)
    {
--- a/app/Page.php
+++ b/app/Page.php
@@ -28,6 +28,15 @@ class Page extends Entity
        return $this->belongsTo(Book::class);
    }

+    /**
+     * Get the parent item
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function parent()
+    {
+        return $this->chapter_id ? $this->chapter() : $this->book();
+    }
+
    /**
     * Get the chapter that this page is in, If applicable.
     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
--- a/app/Providers/EventServiceProvider.php
+++ b/app/Providers/EventServiceProvider.php
@@ -20,6 +20,7 @@ class EventServiceProvider extends ServiceProvider
            'SocialiteProviders\Okta\OktaExtendSocialite@handle',
            'SocialiteProviders\GitLab\GitLabExtendSocialite@handle',
            'SocialiteProviders\Twitch\TwitchExtendSocialite@handle',
+            'SocialiteProviders\Discord\DiscordExtendSocialite@handle',
        ],
    ];

--- a/app/Role.php
+++ b/app/Role.php
@@ -3,7 +3,7 @@
 class Role extends Model
 {

-    protected $fillable = ['display_name', 'description'];
+    protected $fillable = ['display_name', 'description', 'external_auth_id'];

    /**
     * The roles that belong to the role.
--- a/app/Services/LdapService.php
+++ b/app/Services/LdapService.php
@@ -1,7 +1,11 @@
 <?php namespace BookStack\Services;

 use BookStack\Exceptions\LdapException;
+use BookStack\Repos\UserRepo;
+use BookStack\Role;
+use BookStack\User;
 use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Database\Eloquent\Builder;

 /**
 * Class LdapService
@@ -14,15 +18,55 @@ class LdapService
    protected $ldap;
    protected $ldapConnection;
    protected $config;
+    protected $userRepo;
+    protected $enabled;

    /**
     * LdapService constructor.
     * @param Ldap $ldap
+     * @param UserRepo $userRepo
     */
-    public function __construct(Ldap $ldap)
+    public function __construct(Ldap $ldap, UserRepo $userRepo)
    {
        $this->ldap = $ldap;
        $this->config = config('services.ldap');
+        $this->userRepo = $userRepo;
+        $this->enabled = config('auth.method') === 'ldap';
+    }
+
+    /**
+     * Check if groups should be synced.
+     * @return bool
+     */
+    public function shouldSyncGroups()
+    {
+        return $this->enabled && $this->config['user_to_groups'] !== false;
+    }
+
+    /**
+     * Search for attributes for a specific user on the ldap
+     * @param string $userName
+     * @param array $attributes
+     * @return null|array
+     * @throws LdapException
+     */
+    private function getUserWithAttributes($userName, $attributes)
+    {
+        $ldapConnection = $this->getConnection();
+        $this->bindSystemUser($ldapConnection);
+
+        // Find user
+        $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]);
+        $baseDn = $this->config['base_dn'];
+
+        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
+        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
+        $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, $attributes);
+        if ($users['count'] === 0) {
+            return null;
+        }
+
+        return $users[0];
    }

    /**
@@ -34,21 +78,13 @@ class LdapService
     */
    public function getUserDetails($userName)
    {
-        $ldapConnection = $this->getConnection();
-        $this->bindSystemUser($ldapConnection);
-
-        // Find user
-        $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]);
-        $baseDn = $this->config['base_dn'];
        $emailAttr = $this->config['email_attribute'];
-        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
-        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
-        $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, ['cn', 'uid', 'dn', $emailAttr]);
-        if ($users['count'] === 0) {
+        $user = $this->getUserWithAttributes($userName, ['cn', 'uid', 'dn', $emailAttr]);
+
+        if ($user === null) {
            return null;
        }

-        $user = $users[0];
        return [
            'uid'   => (isset($user['uid'])) ? $user['uid'][0] : $user['dn'],
            'name'  => $user['cn'][0],
@@ -162,4 +198,172 @@ class LdapService
        }
        return strtr($filterString, $newAttrs);
    }
+
+    /**
+     * Get the groups a user is a part of on ldap
+     * @param string $userName
+     * @return array|null
+     * @throws LdapException
+     */
+    public function getUserGroups($userName)
+    {
+        $groupsAttr = $this->config['group_attribute'];
+        $user = $this->getUserWithAttributes($userName, [$groupsAttr]);
+
+        if ($user === null) {
+            return null;
+        }
+
+        $userGroups = $this->groupFilter($user);
+        $userGroups = $this->getGroupsRecursive($userGroups, []);
+        return $userGroups;
+    }
+
+    /**
+     * Get the parent groups of an array of groups
+     * @param array $groupsArray
+     * @param array $checked
+     * @return array
+     * @throws LdapException
+     */
+    private function getGroupsRecursive($groupsArray, $checked)
+    {
+        $groups_to_add = [];
+        foreach ($groupsArray as $groupName) {
+            if (in_array($groupName, $checked)) {
+                continue;
+            }
+
+            $groupsToAdd = $this->getGroupGroups($groupName);
+            $groups_to_add = array_merge($groups_to_add, $groupsToAdd);
+            $checked[] = $groupName;
+        }
+        $groupsArray = array_unique(array_merge($groupsArray, $groups_to_add), SORT_REGULAR);
+
+        if (!empty($groups_to_add)) {
+            return $this->getGroupsRecursive($groupsArray, $checked);
+        } else {
+            return $groupsArray;
+        }
+    }
+
+    /**
+     * Get the parent groups of a single group
+     * @param string $groupName
+     * @return array
+     * @throws LdapException
+     */
+    private function getGroupGroups($groupName)
+    {
+        $ldapConnection = $this->getConnection();
+        $this->bindSystemUser($ldapConnection);
+
+        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
+        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
+
+        $baseDn = $this->config['base_dn'];
+        $groupsAttr = strtolower($this->config['group_attribute']);
+
+        $groups = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, 'CN='.$groupName, [$groupsAttr]);
+        if ($groups['count'] === 0) {
+            return [];
+        }
+
+        $groupGroups = $this->groupFilter($groups[0]);
+        return $groupGroups;
+    }
+
+    /**
+     * Filter out LDAP CN and DN language in a ldap search return
+     * Gets the base CN (common name) of the string
+     * @param string $ldapSearchReturn
+     * @return array
+     */
+    protected function groupFilter($ldapSearchReturn)
+    {
+        $groupsAttr = strtolower($this->config['group_attribute']);
+        $ldapGroups = [];
+        $count = 0;
+        if (isset($ldapSearchReturn[$groupsAttr]['count'])) {
+            $count = (int) $ldapSearchReturn[$groupsAttr]['count'];
+        }
+        for ($i=0; $i<$count; $i++) {
+            $dnComponents = ldap_explode_dn($ldapSearchReturn[$groupsAttr][$i], 1);
+            if (!in_array($dnComponents[0], $ldapGroups)) {
+                $ldapGroups[] = $dnComponents[0];
+            }
+        }
+        return $ldapGroups;
+    }
+
+    /**
+     * Sync the LDAP groups to the user roles for the current user
+     * @param \BookStack\User $user
+     * @throws LdapException
+     */
+    public function syncGroups(User $user)
+    {
+        $userLdapGroups = $this->getUserGroups($user->external_auth_id);
+
+        // Get the ids for the roles from the names
+        $ldapGroupsAsRoles = $this->matchLdapGroupsToSystemsRoles($userLdapGroups);
+
+        // Sync groups
+        if ($this->config['remove_from_groups']) {
+            $user->roles()->sync($ldapGroupsAsRoles);
+            $this->userRepo->attachDefaultRole($user);
+        } else {
+            $user->roles()->syncWithoutDetaching($ldapGroupsAsRoles);
+        }
+    }
+
+    /**
+     * Match an array of group names from LDAP to BookStack system roles.
+     * Formats LDAP group names to be lower-case and hyphenated.
+     * @param array $groupNames
+     * @return \Illuminate\Support\Collection
+     */
+    protected function matchLdapGroupsToSystemsRoles(array $groupNames)
+    {
+        foreach ($groupNames as $i => $groupName) {
+            $groupNames[$i] = str_replace(' ', '-', trim(strtolower($groupName)));
+        }
+
+        $roles = Role::query()->where(function(Builder $query) use ($groupNames) {
+            $query->whereIn('name', $groupNames);
+            foreach ($groupNames as $groupName) {
+                $query->orWhere('external_auth_id', 'LIKE', '%' . $groupName . '%');
+            }
+        })->get();
+
+        $matchedRoles = $roles->filter(function(Role $role) use ($groupNames) {
+            return $this->roleMatchesGroupNames($role, $groupNames);
+        });
+
+        return $matchedRoles->pluck('id');
+    }
+
+    /**
+     * Check a role against an array of group names to see if it matches.
+     * Checked against role 'external_auth_id' if set otherwise the name of the role.
+     * @param Role $role
+     * @param array $groupNames
+     * @return bool
+     */
+    protected function roleMatchesGroupNames(Role $role, array $groupNames)
+    {
+        if ($role->external_auth_id) {
+            $externalAuthIds = explode(',', strtolower($role->external_auth_id));
+            foreach ($externalAuthIds as $externalAuthId) {
+                if (in_array(trim($externalAuthId), $groupNames)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        $roleName = str_replace(' ', '-', trim(strtolower($role->display_name)));
+        return in_array($roleName, $groupNames);
+    }
+
 }
--- a/app/Services/SocialAuthService.php
+++ b/app/Services/SocialAuthService.php
@@ -16,7 +16,7 @@ class SocialAuthService
    protected $socialite;
    protected $socialAccount;

-    protected $validSocialDrivers = ['google', 'github', 'facebook', 'slack', 'twitter', 'azure', 'okta', 'gitlab', 'twitch'];
+    protected $validSocialDrivers = ['google', 'github', 'facebook', 'slack', 'twitter', 'azure', 'okta', 'gitlab', 'twitch', 'discord'];

    /**
     * SocialAuthService constructor.