Merge pull request #811 from vktg/squidldapauthfix

pfsense · Mar 30, 2020 · 53b3016 · 53b3016
2 parents e2e5e1a + 0872eaa
commit 53b3016
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 4 deletions.
diff --git a/www/pfSense-pkg-squid/Makefile b/www/pfSense-pkg-squid/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	pfSense-pkg-squid
 PORTVERSION=	0.4.44
-PORTREVISION=	15
+PORTREVISION=	16
 CATEGORIES=	www
 MASTER_SITES=	# empty
 DISTFILES=	# empty

diff --git a/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc b/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc
@@ -1991,12 +1991,13 @@ function squid_resync_auth() {
 				} else if ($settings['ldap_urltype'] == 'starttls') {
 					$usetls = '-Z';
 				} 
-				$password = (isset($settings['ldap_pass']) ? "-w {$settings['ldap_pass']}" : '');
+				$password = (isset($settings['ldap_pass']) ? "-w " . escapeshellarg($settings['ldap_pass']) : '');
+				$noreferrals = (isset($settings['ldap_noreferrals']) ? "-R " : '');
 				$conf .= "auth_param basic program " . SQUID_LOCALBASE
 					. "/libexec/squid/basic_ldap_auth -v {$settings['ldap_version']} -b " . escapeshellarg($settings['ldap_basedomain'])
-					. " -D " . escapeshellarg($settings['ldap_user']) . " " . escapeshellarg($password)
+					. " -D " . escapeshellarg($settings['ldap_user']) . " " . $password
 					. " -f " . escapeshellarg($settings['ldap_filter']) . " -u " . escapeshellarg($settings['ldap_userattribute'])
-					. " -P " . escapeshellarg($settings['auth_server'] . $port) . "\n";
+					. " -P " . escapeshellarg($settings['auth_server'] . $port) . " " . $noreferrals . "\n";
 				break;
 			case 'radius':
 				$port = ((isset($settings['auth_server_port']) && !empty($settings['auth_server_port'])) ? "-p {$settings['auth_server_port']}" : '');

diff --git a/www/pfSense-pkg-squid/files/usr/local/pkg/squid_auth.xml b/www/pfSense-pkg-squid/files/usr/local/pkg/squid_auth.xml
@@ -229,6 +229,12 @@
 			<size>40</size>
 			<default_value>(&amp;(objectClass=person)(uid=%s))</default_value>
 		</field>
+		<field>
+			<fielddescr>LDAP not follow referrals</fielddescr>
+			<fieldname>ldap_noreferrals</fieldname>
+			<description>Do not follow referrals.</description>
+			<type>checkbox</type>
+		</field>
 		<field>
 			<name>Squid Authentication RADIUS Settings</name>
 			<type>listtopic</type>

diff --git a/www/pfSense-pkg-squid/files/usr/local/pkg/squid_js.inc b/www/pfSense-pkg-squid/files/usr/local/pkg/squid_js.inc
@@ -54,10 +54,12 @@ function on_auth_method_changed() {
 	$('#auth_server_port').prop("disabled", true);
 	$('#ldap_user').prop("disabled", true);
 	$('#ldap_version').prop("disabled", true);
+	$('#ldap_urltype').prop("disabled", true);
 	$('#ldap_userattribute').prop("disabled", true);
 	$('#ldap_filter').prop("disabled", true);
 	$('#ldap_pass').prop("disabled", true);
 	$('#ldap_basedomain').prop("disabled", true);
+	$('#ldap_noreferrals').prop("disabled", true);
 	$('#radius_secret').prop("disabled", true);
 	$('#auth_prompt').prop("disabled", true);
 	$('#auth_processes').prop("disabled", true);
@@ -83,10 +85,12 @@ function on_auth_method_changed() {
 		$('#auth_server_port').prop("disabled", true);
 		$('#ldap_user').prop("disabled", true);
 		$('#ldap_version').prop("disabled", true);
+		$('#ldap_urltype').prop("disabled", true);
 		$('#ldap_userattribute').prop("disabled", true);
 		$('#ldap_filter').prop("disabled", true);
 		$('#ldap_pass').prop("disabled", true);
 		$('#ldap_basedomain').prop("disabled", true);
+		$('#ldap_noreferrals').prop("disabled", true);
 		$('#radius_secret').prop("disabled", true);
 		$('#auth_prompt').prop("disabled", true);
 		$('#auth_processes').prop("disabled", true);
@@ -108,9 +112,11 @@ function on_auth_method_changed() {
 		$('#ldap_user').prop("disabled", true);
 		$('#ldap_pass').prop("disabled", true);
 		$('#ldap_version').prop("disabled", true);
+		$('#ldap_urltype').prop("disabled", true);
 		$('#ldap_userattribute').prop("disabled", true);
 		$('#ldap_filter').prop("disabled", true);
 		$('#ldap_basedomain').prop("disabled", true);
+		$('#ldap_noreferrals').prop("disabled", true);
 		$('#radius_secret').prop("disabled", true);
 		break;
 	case 'ldap':
@@ -119,9 +125,11 @@ function on_auth_method_changed() {
 		$('#ldap_user').prop("disabled", false);
 		$('#ldap_pass').prop("disabled", false);
 		$('#ldap_version').prop("disabled", false);
+		$('#ldap_urltype').prop("disabled", false);
 		$('#ldap_userattribute').prop("disabled", false);
 		$('#ldap_filter').prop("disabled", false);
 		$('#ldap_basedomain').prop("disabled", false);
+		$('#ldap_noreferrals').prop("disabled", false);
 		$('#radius_secret').prop("disabled", true);
 		break;
 	case 'radius':
@@ -130,20 +138,24 @@ function on_auth_method_changed() {
 		$('#ldap_user').prop("disabled", true);
 		$('#ldap_pass').prop("disabled", true);
 		$('#ldap_version').prop("disabled", true);
+		$('#ldap_urltype').prop("disabled", true);
 		$('#ldap_userattribute').prop("disabled", true);
 		$('#ldap_filter').prop("disabled", true);
 		$('#ldap_basedomain').prop("disabled", true);
+		$('#ldap_noreferrals').prop("disabled", true);
 		$('#radius_secret').prop("disabled", false);
 		break;
 	case 'cp':
 		$('#auth_server').prop("disabled", true);
 		$('#auth_server_port').prop("disabled", true);
 		$('#ldap_user').prop("disabled", true);
 		$('#ldap_version').prop("disabled", true);
+		$('#ldap_urltype').prop("disabled", true);
 		$('#ldap_userattribute').prop("disabled", true);
 		$('#ldap_filter').prop("disabled", true);
 		$('#ldap_pass').prop("disabled", true);
 		$('#ldap_basedomain').prop("disabled", true);
+		$('#ldap_noreferrals').prop("disabled", true);
 		$('#radius_secret').prop("disabled", true);
 		$('#auth_prompt').prop("disabled", true);
 		$('#auth_processes').prop("disabled", false);