mikopbx/ModuleUsersUI

Models/UsersCredentials.php
191 строка5 KB
Nikolay Beketov
fix: prevent LDAP filter double-escaping and clean orphan user records
05 дек 2025, 13:37
05 дек 2025, 13:3702fa6fb
<?php

/*
 * MikoPBX - free phone system for small business
 * Copyright © 2017-2023 Alexey Portnov and Nikolay Beketov
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with this program.
 * If not, see <https://www.gnu.org/licenses/>.
 */

namespace Modules\ModuleUsersUI\Models;

use MikoPBX\Common\Models\Users;
use MikoPBX\Modules\Models\ModulesModelsBase;
use Modules\ModuleUsersUI\Lib\MikoPBXVersion;
use Phalcon\Mvc\Model\Relation;

/**
 * Class ModuleUsers
 * Stores additional information for Users table with login, password, and ACL group
 */
class UsersCredentials extends ModulesModelsBase
{
    /**
     * @Primary
     * @Identity
     * @Column(type="integer", nullable=false)
     */
    public $id;

    /**
     * Link to the users table
     *
     * @Column(type="integer", nullable=false)
     */
    public $user_id;

    /**
     * Link to the AccessGroups table
     *
     * @Column(type="string", nullable=false, default='No access')
     */
    public $user_access_group_id;

    /**
     * User use ldap auth
     *
     *  @Column(type="string", length=1, default='0')
     */
    public $use_ldap_auth;

    /**
     * User login
     *
     * @Column(type="string", nullable=false)
     */
    public $user_login;

    /**
     * User password
     *
     * @Column(type="string", nullable=true)
     */
    public $user_password;

    /**
     * Allows to enter the web interface
     *
     * @Column(type="string", nullable=false, default='0')
     */
    public $enabled;


    public function initialize(): void
    {
        $this->setSource('m_ModuleUsersUI_UsersCredentials');
        parent::initialize();
        $this->belongsTo(
            'user_id',
            Users::class,
            'id',
            [
                'alias' => 'Users',
                'foreignKey' => [
                    'allowNulls' => false,
                    'action' => Relation::NO_ACTION,
                ],
            ]
        );

        $this->belongsTo(
            'user_access_group_id',
            AccessGroups::class,
            'id',
            [
                'alias' => 'AccessGroups',
            ]
        );
    }

    /**
     * Returns dynamic relations between module models and common models
     * MikoPBX check it in ModelsBase after every call to keep data consistent
     *
     * There is example to describe the relation between Providers and ModuleTemplate models
     *
     * It is important to duplicate the relation alias on message field after Models\ word
     *
     * @param $calledModelObject
     *
     * @return void
     */
    public static function getDynamicRelations(&$calledModelObject): void
    {
        if (is_a($calledModelObject, Users::class)) {
            $calledModelObject->hasOne(
                'id',
                UsersCredentials::class,
                'user_id',
                [
                    'alias'      => 'ModuleUsersUIUsersCredentials',
                    'foreignKey' => [
                        'allowNulls' => 0,
                        'message'    => 'Models\ModuleUsersUIUsersCredentials',
                        'action'     => Relation::ACTION_CASCADE
                    ],
                ]
            );
        }
    }


    /**
     * Perform validation on the model.
     *
     * @return bool Whether the validation was successful or not.
     */
    public function validation(): bool
    {
        $validationClass = MikoPBXVersion::getValidationClass();
        $uniquenessClass = MikoPBXVersion::getUniquenessClass();
        $validation = new $validationClass();
        $validation->add(
            'user_login',
            new $uniquenessClass(
                [
                    'message' => $this->t('module_usersui_LoginNameNotUnique'),
                ]
            )
        );

        return $this->validate($validation);
    }

    /**
     * Cleans orphan records from UsersCredentials table.
     * Removes records where user_id references a non-existent user in the main Users table.
     *
     * @return int Number of deleted orphan records.
     */
    public static function cleanOrphanRecords(): int
    {
        $deletedCount = 0;

        // Get all existing user IDs from the main Users table
        $existingUserIds = Users::find(['columns' => 'id'])->toArray();
        $existingUserIds = array_column($existingUserIds, 'id');

        // Find and delete orphan credentials
        $allCredentials = self::find();
        foreach ($allCredentials as $credential) {
            if (!in_array($credential->user_id, $existingUserIds, false)) {
                if ($credential->delete()) {
                    $deletedCount++;
                }
            }
        }

        return $deletedCount;
    }
}