Added access control options to prevent use of the same UID or GID

diff --git a/ldap-useradmin/CHANGELOG b/ldap-useradmin/CHANGELOG
index 48879fd..f610968 100644 (file)
--- a/ldap-useradmin/CHANGELOG
+++ b/ldap-useradmin/CHANGELOG
@@ -51,3 +51,5 @@ Limit the result size to the configured display maximum when requesting users an
 UID and GID allocation is now done by querying the LDAP server for specific IDs, rather than fetching a list of all users to find which ones are used. This should be faster on large LDAP servers.
 ---- Changes since 1.370 ----
 All Samba attributes are removed when Samba access is disabled for a user.
+---- Changes since 1.380 ----
+Added access control options to prevent use of the same UID or GID.

diff --git a/ldap-useradmin/acl_security.pl b/ldap-useradmin/acl_security.pl
index 791028f..0df059d 100644 (file)
--- a/ldap-useradmin/acl_security.pl
+++ b/ldap-useradmin/acl_security.pl
@@ -64,6 +64,14 @@ printf "<input type=checkbox name=autohome value=1 %s> %s</td> </tr>\n",
        $o->{'autohome'} ? "checked" : "",
        $text{'acl_autohome'};
 
+print "<tr> <td valign=top><b>$text{'acl_uid'}</b></td>\n";
+print "<td colspan=3>";
+printf "<input type=checkbox name=umultiple value=1 %s> %s<br>\n",
+        $o->{'umultiple'} ? "checked" : "", $text{'acl_umultiple'};
+printf "<input type=checkbox name=gmultiple value=1 %s> %s<br>\n",
+        $o->{'gmultiple'} ? "checked" : "", $text{'acl_gmultiple'};
+print "</td> </tr>\n";
+
 print "<tr> <td colspan=4><hr></td> </tr>\n";
 
 print "<tr> <td valign=top><b>$text{'acl_gedit'}</b></td> <td colspan=3>\n";

diff --git a/ldap-useradmin/save_group.cgi b/ldap-useradmin/save_group.cgi
index 214a803..bc5f9e8 100755 (executable)
--- a/ldap-useradmin/save_group.cgi
+++ b/ldap-useradmin/save_group.cgi
@@ -131,6 +131,12 @@ if ($in{'new'} || $oldgroup ne $group) {
                &error(&text('gsave_einuse', $group));
        }
 
+# Check for GID clash
+if ($in{'new'} && !$access{'gmultiple'}) {
+       &check_gid_used($ldap, $gid) &&
+               &error($text{'gsave_egidused2'});
+       }
+
 $pfx = $config{'md5'} == 1 || $config{'md5'} == 3 ? "{md5}" :
        $config{'md5'} == 0 ? "{crypt}" : "";
 if ($in{'passmode'} == 0) {

diff --git a/ldap-useradmin/save_user.cgi b/ldap-useradmin/save_user.cgi
index 3d85d01..8f660ea 100755 (executable)
--- a/ldap-useradmin/save_user.cgi
+++ b/ldap-useradmin/save_user.cgi
@@ -200,6 +200,12 @@ else {
                        &error(&text('usave_einuse', $user));
                }
 
+       # Check for UID clash
+       if ($in{'new'} && !$access{'umultiple'}) {
+               &check_uid_used($ldap, $uid) &&
+                       &error($text{'usave_euidused2'});
+               }
+
        # Validate IMAP quota
        $quota = undef;
        if ($config{'quota_support'} && !$in{'quota_def'}) {