From e0ae06441e3a53b9224552f4264554dcc15354c9 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Tue, 19 Jan 2016 15:24:23 +0100
Subject: [PATCH 1/4] check for env variabel SEEDDMS_HOME

---
 utils/seeddms-adddoc       | 6 +++++-
 utils/seeddms-createfolder | 6 +++++-
 utils/seeddms-indexer      | 6 +++++-
 utils/seeddms-xmldump      | 6 +++++-
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/utils/seeddms-adddoc b/utils/seeddms-adddoc
index 3f7d16b0b..b091f179e 100755
--- a/utils/seeddms-adddoc
+++ b/utils/seeddms-adddoc
@@ -1,2 +1,6 @@
 #!/bin/sh
-/usr/bin/php -f /usr/share/seeddms/utils/adddoc.php -- $*
+if [ -z ${SEEDDMS_HOME+x} ]; then
+	echo "Please set SEEDDMS_HOME before running this script";
+	exit 1;
+fi
+php -f ${SEEDDMS_HOME}/utils/adddoc.php -- $*
diff --git a/utils/seeddms-createfolder b/utils/seeddms-createfolder
index e1aca29ea..b7f96d9da 100755
--- a/utils/seeddms-createfolder
+++ b/utils/seeddms-createfolder
@@ -1,2 +1,6 @@
 #!/bin/sh
-/usr/bin/php -f /usr/share/seeddms/utils/createfolder.php -- $*
+if [ -z ${SEEDDMS_HOME+x} ]; then
+	echo "Please set SEEDDMS_HOME before running this script";
+	exit 1;
+fi
+php -f ${SEEDDMS_HOME}/utils/createfolder.php -- $*
diff --git a/utils/seeddms-indexer b/utils/seeddms-indexer
index 59190069e..51719c94f 100755
--- a/utils/seeddms-indexer
+++ b/utils/seeddms-indexer
@@ -1,2 +1,6 @@
 #!/bin/sh
-/usr/bin/php -f /usr/share/seeddms/utils/indexer.php -- $*
+if [ -z ${SEEDDMS_HOME+x} ]; then
+	echo "Please set SEEDDMS_HOME before running this script";
+	exit 1;
+fi
+php -f ${SEEDDMS_HOME}/utils/indexer.php -- $*
diff --git a/utils/seeddms-xmldump b/utils/seeddms-xmldump
index 62acd34e1..9ce43235c 100755
--- a/utils/seeddms-xmldump
+++ b/utils/seeddms-xmldump
@@ -1,2 +1,6 @@
 #!/bin/sh
-/usr/bin/php -f /usr/share/seeddms/utils/xmldump -- $*
+if [ -z ${SEEDDMS_HOME+x} ]; then
+	echo "Please set SEEDDMS_HOME before running this script";
+	exit 1;
+fi
+php -f ${SEEDDMS_HOME}/utils/xmldump -- $*

From c43c5e64eb088ad8b6691a1190604354b68f979f Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Tue, 19 Jan 2016 15:30:54 +0100
Subject: [PATCH 2/4] ldap search can be filtered

---
 conf/settings.xml.template            |  2 ++
 inc/inc.ClassSettings.php             |  3 +++
 install/settings.xml.template_install |  2 ++
 op/op.Login.php                       | 26 +++++++++++++++++---------
 4 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/conf/settings.xml.template b/conf/settings.xml.template
index 11e30dcd4..e8c0f56ae 100644
--- a/conf/settings.xml.template
+++ b/conf/settings.xml.template
@@ -111,6 +111,7 @@
            -       URIs are supported, e.g.: ldaps://ldap.host.com
            - port: port of the authentification server
            - baseDN: top level of the LDAP directory tree
+           - filter: Additional filters which are to be checked
         -->  
         <connector
           enable = "false"
@@ -120,6 +121,7 @@
           baseDN = ""
           bindDN="" 
           bindPw=""
+          filter=""
         >
         </connector>
         <!-- ***** CONNECTOR Microsoft Active Directory  *****
diff --git a/inc/inc.ClassSettings.php b/inc/inc.ClassSettings.php
index fe5beb606..e987e076b 100644
--- a/inc/inc.ClassSettings.php
+++ b/inc/inc.ClassSettings.php
@@ -217,6 +217,7 @@ class Settings { /* {{{ */
 	var $_ldapBindPw = "";
 	var $_ldapAccountDomainName = "";
 	var $_ldapType = 1; // 0 = ldap; 1 = AD
+	var $_ldapFilter = "";
 	var $_converters = array(); // list of commands used to convert files to text for Indexer
 
 	/**
@@ -422,6 +423,7 @@ class Settings { /* {{{ */
 				$this->_ldapBindDN = strVal($connectorNode["bindDN"]);
 				$this->_ldapBindPw = strVal($connectorNode["bindPw"]);
 				$this->_ldapType = 0;
+				$this->_ldapFilter = strVal($connectorNode["filter"]);
 			}
 			else if ($params['enable'] && ($typeConn == "AD"))
 			{
@@ -431,6 +433,7 @@ class Settings { /* {{{ */
 				$this->_ldapBindDN = strVal($connectorNode["bindDN"]);
 				$this->_ldapBindPw = strVal($connectorNode["bindPw"]);
 				$this->_ldapType = 1;
+				$this->_ldapFilter = strVal($connectorNode["filter"]);
 				$this->_ldapAccountDomainName = strVal($connectorNode["accountDomainName"]);
 			}
 		}
diff --git a/install/settings.xml.template_install b/install/settings.xml.template_install
index 024d7c5f2..d4c789800 100644
--- a/install/settings.xml.template_install
+++ b/install/settings.xml.template_install
@@ -118,6 +118,7 @@
            -       URIs are supported, e.g.: ldaps://ldap.host.com
            - port: port of the authentification server
            - baseDN: top level of the LDAP directory tree
+           - filter: Additional filters which are to be checked
         -->  
         <connector
           enable = "false"
@@ -127,6 +128,7 @@
           baseDN = ""
           bindDN="" 
           bindPw=""
+          filter=""
         >
         </connector>
         <!-- ***** CONNECTOR Microsoft Active Directory  *****
diff --git a/op/op.Login.php b/op/op.Login.php
index ec29efb7a..1c64d3e5b 100644
--- a/op/op.Login.php
+++ b/op/op.Login.php
@@ -99,7 +99,7 @@ if (!$user && isset($settings->_ldapHost) && strlen($settings->_ldapHost)>0) {
 				// and http://stackoverflow.com/questions/6222641/how-to-php-ldap-search-to-get-user-ou-if-i-dont-know-the-ou-for-base-dn
 				ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
 			}
-		} 
+		}
 
 		// Ensure that the LDAP connection is set to use version 3 protocol.
 		// Required for most authentication methods, including SASL.
@@ -116,15 +116,19 @@ if (!$user && isset($settings->_ldapHost) && strlen($settings->_ldapHost)>0) {
 		}
 		$dn = false;
 		/* If bind succeed, then get the dn of for the user */
-		if ($bind) {        
-			$search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut.$login);
+		if ($bind) {
+            if (isset($settings->_ldapFilter) && strlen($settings->_ldapFilter) > 0) {
+			    $search = ldap_search($ds, $settings->_ldapBaseDN, "(&(".$ldapSearchAttribut.$login.")".$settings->_ldapFilter.")");
+            } else {
+			    $search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut.$login);
+            }
 			if (!is_bool($search)) {
 				$info = ldap_get_entries($ds, $search);
 				if (!is_bool($info) && $info["count"]>0) {
 					$dn = $info[0]['dn'];
 				}
 			}
-		} 
+		}
 
 		/* If the previous bind failed, try it with the users creditionals
 		 * by simply setting $dn to a default string
@@ -142,8 +146,12 @@ if (!$user && isset($settings->_ldapHost) && strlen($settings->_ldapHost)>0) {
 			$user = $dms->getUserByLogin($login);
 			if (is_bool($user) && !$settings->_restricted) {
 				// Retrieve the user's LDAP information.
-				$search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut . $login); 
-				
+                if (isset($settings->_ldapFilter) && strlen($settings->_ldapFilter) > 0) {
+			        $search = ldap_search($ds, $settings->_ldapBaseDN, "(&(".$ldapSearchAttribut.$login.")".$settings->_ldapFilter.")");
+                } else {
+			        $search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut.$login);
+                }
+
 				if (!is_bool($search)) {
 					$info = ldap_get_entries($ds, $search);
 					if (!is_bool($info) && $info["count"]==1 && $info[0]["count"]>0) {
@@ -198,14 +206,14 @@ if (is_bool($user)) {
 		_printMessage(getMLText("login_disabled_title"), getMLText("login_disabled_text"));
 		exit;
 	}
-	
+
 	// control admin IP address if required
 	// TODO: extend control to LDAP autentication
 	if ($user->isAdmin() && ($_SERVER['REMOTE_ADDR'] != $settings->_adminIP ) && ( $settings->_adminIP != "") ){
 		_printMessage(getMLText("login_error_title"),	getMLText("invalid_user_id"));
 		exit;
 	}
-	
+
 	/* Clear login failures if login was successful */
 	$user->clearLoginFailures();
 
@@ -282,7 +290,7 @@ if (isset($_COOKIE["mydms_session"])) {
 	setcookie("mydms_session", $id, $lifetime, $settings->_httpRoot, null, null, !$settings->_enableLargeFileUpload);
 }
 
-// TODO: by the PHP manual: The superglobals $_GET and $_REQUEST  are already decoded. 
+// TODO: by the PHP manual: The superglobals $_GET and $_REQUEST  are already decoded.
 // Using urldecode() on an element in $_GET or $_REQUEST could have unexpected and dangerous results.
 
 if (isset($_POST["referuri"]) && strlen($_POST["referuri"])>0) {

From a3fad51e63c5c004d89d048e5f4ccd2eb6354e4f Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Tue, 19 Jan 2016 15:37:19 +0100
Subject: [PATCH 3/4] more changes in 4.3.23

---
 CHANGELOG | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 58aad5000..89410c416 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,12 +3,13 @@
 --------------------------------------------------------------------------------
 - send notification if document is delete to those users watching the folder
 - fix editing of customer attributes of type checkbox
-- disallow read access for group didn't prevent the users from being selected
+- disallowed read access for a group didn't prevent the users from being selected
   as a reviewer/approver
 - move the last bits of plain sql code from op/*.php into the core
 - group manager uses ajax like user manager
 - start to enforce content security policy
 - fixed possible XSS attack in user manager
+- ldap search can be filtered (Thanks to Tobias for the patch)
 
 --------------------------------------------------------------------------------
                      Changes in version 4.3.22

From f81eab28b4dd3cf6afbbf0e42339a7be00ea6004 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Thu, 21 Jan 2016 07:41:09 +0100
Subject: [PATCH 4/4] new version 4.3.23

---
 Makefile                           |  2 +-
 SeedDMS_Core/Core/inc.ClassDMS.php |  2 +-
 SeedDMS_Core/package.xml           | 29 +++++++++++++++++++++++------
 inc/inc.Version.php                |  2 +-
 install/install.php                |  2 +-
 5 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/Makefile b/Makefile
index 15b632e01..8893fe0d7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-VERSION=4.3.22
+VERSION=4.3.23
 SRC=CHANGELOG inc conf utils index.php languages views op out README.md README.Notification README.Ubuntu drop-tables-innodb.sql styles js TODO LICENSE Makefile webdav install restapi
 # webapp
 
diff --git a/SeedDMS_Core/Core/inc.ClassDMS.php b/SeedDMS_Core/Core/inc.ClassDMS.php
index 90d09888f..c0964b753 100644
--- a/SeedDMS_Core/Core/inc.ClassDMS.php
+++ b/SeedDMS_Core/Core/inc.ClassDMS.php
@@ -273,7 +273,7 @@ class SeedDMS_Core_DMS {
 		$this->convertFileTypes = array();
 		$this->version = '@package_version@';
 		if($this->version[0] == '@')
-			$this->version = '4.3.21';
+			$this->version = '4.3.23';
 	} /* }}} */
 
 	/**
diff --git a/SeedDMS_Core/package.xml b/SeedDMS_Core/package.xml
index 42792819f..9f7a467a2 100644
--- a/SeedDMS_Core/package.xml
+++ b/SeedDMS_Core/package.xml
@@ -12,11 +12,11 @@
   <email>uwe@steinmann.cx</email>
   <active>yes</active>
  </lead>
- <date>2015-11-09</date>
- <time>19:49:20</time>
+ <date>2016-01-21</date>
+ <time>07:12:53</time>
  <version>
-  <release>4.3.22</release>
-  <api>4.3.22</api>
+  <release>4.3.23</release>
+  <api>4.3.23</api>
  </version>
  <stability>
   <release>stable</release>
@@ -24,8 +24,8 @@
  </stability>
  <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
  <notes>
-- fix sql statement to reset password
-- pass some more information for timeline
+- new method SeedDMS_Core_DMS::createDump()
+- minor improvements int SeedDMS_Core_Document::getReadAccessList()
  </notes>
  <contents>
   <dir baseinstalldir="SeedDMS" name="/">
@@ -909,5 +909,22 @@ by a group or user right
 - user getCurrentTimestamp() and getCurrentDatetime() whenever possible
    </notes>
   </release>
+  <release>
+   <date>2015-11-09</date>
+   <time>19:49:20</time>
+   <version>
+    <release>4.3.22</release>
+    <api>4.3.22</api>
+   </version>
+   <stability>
+    <release>stable</release>
+    <api>stable</api>
+   </stability>
+   <license uri="http://opensource.org/licenses/gpl-license">GPL License</license>
+   <notes>
+- fix sql statement to reset password
+- pass some more information for timeline
+   </notes>
+  </release>
  </changelog>
 </package>
diff --git a/inc/inc.Version.php b/inc/inc.Version.php
index b187bcce0..88401cc22 100644
--- a/inc/inc.Version.php
+++ b/inc/inc.Version.php
@@ -20,7 +20,7 @@
 
 class SeedDMS_Version {
 
-	public $_number = "4.3.22";
+	public $_number = "4.3.23";
 	private $_string = "SeedDMS";
 
 	function SeedDMS_Version() {
diff --git a/install/install.php b/install/install.php
index 23d24e9c0..e9762cd03 100644
--- a/install/install.php
+++ b/install/install.php
@@ -119,7 +119,7 @@ function fileExistsInIncludePath($file) { /* {{{ */
  * Load default settings + set
  */
 define("SEEDDMS_INSTALL", "on");
-define("SEEDDMS_VERSION", "4.3.22");
+define("SEEDDMS_VERSION", "4.3.23");
 
 require_once('../inc/inc.ClassSettings.php');