FS#2852 better userClean in bundled auth backends

ACL & Authentication

• 

  2013-09-21 Klap-in

  Why does DokuWiki_Auth_Plugin default not clean the user in the cleanUser? but forward the userid without applying cleanID()?
  
  Applying default cleanID in cleanUser improves the change auth backend that are DokuWiki-only will have usernames that fit the pagename convention. When a backend has other conventions it has to implement the cleanUser at all.
  
  Proposal: use the cleanUser of auth_plugin_authplain already in DokuWiki_Auth_Plugin
  
  Consequences of such change for current bundled auth plugins are:
  - the authmysql and authpgsql will got more strict cleaning.
  
  
  DokuWiki_Auth_Plugin has as cleanUser():
  
     public function cleanUser($user) {
         return $user;
     }
  
  
  authmysql/auth.php inherits from  DokuWiki_Auth_Plugin
  authpgsql/auth.php inherits from auth_plugin_authmysql
  
  authplain/auth.php:
  
     public function cleanUser($user) {
         global $conf;
         return cleanID(str_replace(':', $conf['sepchar'], $user));
     }
  
  
  authad/auth.php:
  
     public function cleanUser($user) {
         $domain = '';
  
         // get NTLM or Kerberos domain part
         list($dom, $user) = explode('\\', $user, 2);
         if(!$user) $user = $dom;
         if($dom) $domain = $dom;
         list($user, $dom) = explode('@', $user, 2);
         if($dom) $domain = $dom;
  
         // clean up both
         $domain = utf8_strtolower(trim($domain));
         $user   = utf8_strtolower(trim($user));
  
         // is this a known, valid domain? if not discard
         if(!is_array($this->conf[$domain])) {
             $domain = '';
         }
  
         // reattach domain
         if($domain) $user = "$user@$domain";
         return $user;
     }
  
  
  
• 

  2013-09-27 ChrisS

  Is this likely to introduce compatibility issues for existing auth_mysql & auth_pgsql wiki's with user names which would be altered by cleanID() ?
• 

  2013-10-04 Klap-in

  The usermanager used up to and including the current Weatherwax release the cleanID for selecting users that should be modified or deleted. (Not for creating users)
  See https://github.com/splitbrain/dokuwiki/pull/348
  
  So there were already troubles in the user manager when people uses usernames which differ from Dokuwiki's pageid convention.
  
  But yes, i think it can gives similar compatibility issues in the usermanager. I guess in other areas it's fine...
  
  
• 

  2013-10-13 andi

  I think this is not the way to go. Instead the user manager and whatever else interacts with users should be fixed to call $auth->cleanUser() when working with user names.
• 

  2013-10-13 Klap-in

  Yes, i did commit already a fix for the usermanager so it uses now $auth->cleanUser() in stead of hardcode cleanID().
  
  The default DokuWiki_Auth_Plugin is only a relay of the user name, without cleaning.
  I think it better when default the cleanID is used there to have default usernames that follow dokuwiki naming convention.
  
  - When plugin like another policy they can extend the desired auth backend and override the cleanUser function.
  - But then the default user name policy is much more clear then in the current case.
  - It is useful to have this DokuWiki page name convention as naming convention because it makes it easy to let user names be used as page names for profile pages.
  
  (Context: i hope to implement in the future the hook&plugins for user pages)
  
• 

  2013-10-14 Klap-in

  Why implementing this now:
  - a part of the wikiadmins is used to that using usernames that are not allowed wiki pages give troubles in the usermanager.
  - by the fix of usermanager they will become lesser strictly...
  
  Yes i know, it's not the most reasonable argument..
• 

  2013-10-20 andi

  In http://irc.dokuwiki.org/index.php?d=2013-10-20#msg482602 everyone voted for closing the PR.