Add LSformRule :: differentPassword

doc/conf/LSattribute/check-data.docbook

@@ -47,6 +47,7 @@ règles.</para>
 &conf-LSattribute-check-data-alphanumeric;
 &conf-LSattribute-check-data-callable;
 &conf-LSattribute-check-data-date;
+&conf-LSattribute-check-data-differentPassword;
 &conf-LSattribute-check-data-email;
 &conf-LSattribute-check-data-filesize;
 &conf-LSattribute-check-data-imagefile;

doc/conf/LSattribute/check_data/LSattribute-check_data.entities.xml

@@ -2,6 +2,7 @@
 <!ENTITY conf-LSattribute-check-data-alphanumeric SYSTEM "alphanumeric.docbook">
 <!ENTITY conf-LSattribute-check-data-callable SYSTEM "callable.docbook">
 <!ENTITY conf-LSattribute-check-data-date SYSTEM "date.docbook">
+<!ENTITY conf-LSattribute-check-data-differentPassword SYSTEM "differentPassword.docbook">
 <!ENTITY conf-LSattribute-check-data-email SYSTEM "email.docbook">
 <!ENTITY conf-LSattribute-check-data-filesize SYSTEM "filesize.docbook">
 <!ENTITY conf-LSattribute-check-data-imagefile SYSTEM "imagefile.docbook">

doc/conf/LSattribute/check_data/differentPassword.docbook

@@ -0,0 +1,24 @@
+<sect4 id="config-LSattribute-check-data-differentPassword">
+  <title>differentPassword</title>
+  <para>Cette règle vérifie que la valeur saisie ne correspond pas à
+  un des mots de passe stockés dans d'autres attributs du même objet.
+  </para>
+ 
+  <important><simpara>Les autres attributs doivent utiliser le type
+  d'attribut <emphasis>LDAP</emphasis>
+  <link linkend='config-LSattr_ldap_password'>LSattr_ldap_password
+  </link>.</simpara></important>
+ 
+<variablelist>
+<title>Paramètres de configuration</title>
+
+<varlistentry>
+  <term>otherPasswordAttributes</term>
+  <listitem>
+    <simpara>La liste des autres attributs dont les mots de passe doivent être différent.</simpara>
+  </listitem>
+</varlistentry>
+
+</variablelist>
+
+</sect4>

public_html/includes/class/class.LSformRule_differentPassword.php

@@ -0,0 +1,106 @@
+<?php
+/*******************************************************************************
+ * Copyright (C) 2019 Easter-eggs
+ * http://ldapsaisie.easter-eggs.org
+ *
+ * Author: See AUTHORS file in top-level directory.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+******************************************************************************/
+
+/**
+ * Check that password is different of another attribute of this user
+ *
+ * @author Benjamin Renard <brenard@easter-eggs.com>
+ */
+class LSformRule_differentPassword extends LSformRule {
+
+  /**
+   * Check the value
+   *
+   * @param string $values Value to check
+   * @param array $options Validation options : 
+   *                              - Other attribute : $options['params']['otherAttributes']
+   * @param object $formElement The linked LSformElement object
+   *
+   * @return boolean true si la valeur est valide, false sinon
+   */
+  public static function validate($value, $options, $formElement) {
+    if (is_array($options) && isset($options['params']['otherPasswordAttributes'])) {
+      // Make sure otherPasswordAttributes is an array
+      if (!is_array($options['params']['otherPasswordAttributes']))
+        $options['params']['otherPasswordAttributes'] = array($options['params']['otherPasswordAttributes']);
+
+      // Load LSattr_ldap_password
+      if (!LSsession :: loadLSclass("LSattr_ldap_password")) {
+        LSerror :: addErrorCode('LSformRule_differentPassword_02');
+        return false;
+      }
+
+      // Iter on otherPasswordAttributes to check password does not match
+      foreach($options['params']['otherPasswordAttributes'] as $attr) {
+        // Check attribute exist
+        if (!isset($formElement -> attr_html -> attribute -> ldapObject -> attrs[$attr])) {
+          LSerror :: addErrorCode('LSformRule_differentPassword_03', $attr);
+          return false;
+        }
+
+        // Check is not the same attribute of the current one
+        if ($formElement -> attr_html -> attribute -> name == $attr) {
+          LSerror :: addErrorCode('LSformRule_differentPassword_04');
+          return false;
+        }
+
+	// Check attribute use LSldap_attr :: password type
+        if (!$formElement -> attr_html -> attribute -> ldapObject -> attrs[$attr] -> ldap instanceof LSattr_ldap_password) {
+          LSerror :: addErrorCode('LSformRule_differentPassword_05', $attr);
+          return false;
+	}
+
+        if ($formElement -> attr_html -> attribute -> ldapObject -> attrs[$attr] -> ldap -> verify($value, $formElement -> form -> getValue($attr))) {
+          LSdebug($formElement -> name . " : Password matched with attribute $attr");
+          return false;
+        }
+        else
+          LSdebug($formElement -> name . " : Password does not match with $attr");
+      }
+    }
+    else {
+      LSerror :: addErrorCode('LSformRule_differentPassword_01');
+      return false;
+    }
+    return true;
+  }
+
+}
+
+/*
+ * Error Codes
+ */
+LSerror :: defineError('LSformRule_differentPassword_01',
+_("LSformRule_differentPassword : Other password attribute is not configured.")
+);
+LSerror :: defineError('LSformRule_differentPassword_02',
+_("LSformRule_differentPassword : Fail to load LSattr_ldap :: password class.")
+);
+LSerror :: defineError('LSformRule_differentPassword_03',
+_("LSformRule_differentPassword : The other password attribute %{attr} does not exist.")
+);
+LSerror :: defineError('LSformRule_differentPassword_04',
+_("LSformRule_differentPassword : The other password attribute could not be the same of the current one.")
+);
+LSerror :: defineError('LSformRule_differentPassword_05',
+_("LSformRule_differentPassword : The other password attributes does not used LSattr_ldap :: password. It's not the case of the attribure %{attr}.")
+);