Fixed error handling where client-generated parameters
displayed in various error messages could be exploited
for cross-site scripting (XSS) attacks. All web2ldap
versions prior to this version are considered vulnerable.
Bug fixes
Fixed backward-compability issue with Python 2.0
by avoiding use of function inspect.isclass().
The host:port form in the cascaded configuration
was abandoned. All string-keys MUST be valid LDAP URLs
except the single underscore for the default section.
Additionally one can group configuration parameters
around a common base DN (AKA as search root AKA naming context)
by specifying a LDAP URL with empty hostport part.
(see section Cascaded configuration).
Note: This release requires upgrading to
python-ldap 2.0.1
which contains an important bug fix.
Performance optimization module
psyco
is imported if available.
New features/enhancements
Sort of a rudimental plugin interface for
syntax and attribute-type classes. Added plugin example module
for attribute types c and gender.
Added plugin classes for vendor-specific syntaxes and/or attribute types:
MS Active Directory (see draft-armijo-ldap-syntax)
Novell eDirectory (see draft-sermersheim-nds-ldap-schema)
New host-specific parameter
link_css
allows to set different style sheets (CSS URL) for
different servers / naming contexts.
A multi-select field is also displayed for abstract object classes
when adding or modifying entries. E.g. this preserves
object class top in an existing entry.
If attribute schemaNamingContext is present in
RootDSE (e.g. with MS AD) a link is displayed in the schema viewer
to the relating schema element entry found under the schema naming
context.
Attribute values of syntax OctetString can now be edited
in hex-dump format.
Support for SASL mechanism NTLM.
LDAP URLs as string keys for configuration dictionary
are now normalized before building w2lapp.cnf.ldap_def.
This should lead to a more robust configuration behaviour.
Bug Fixes
Fixed displaying anonymous login in case
a username or bind-DN was given without password.
Equals sign added as allowed character to regex pattern for
PrintableString.
urllib.quote() is used instead of
urllib_plus.quote() which fixes some
strange errors with DNs passed around in URLs.
Added additional check whether to explicitly add object class attribute
to set of required attributes in input form.
This is a work-around for LDAP servers which mark the
objectClass attribute as not user-modifiable
(e.g. MS Active Directory)
Properly fall-back to binary download if there is no special
handler for viewing a single binary attribute.
Imports of sndhdr and StringIO were missing for
w2lapp.schema.syntaxes.Audio.
Code cleaning
Got rid of calling eval() in pisces.asn1
to be more friendly to psyco.
Removed some of the special attribute value detections in
w2lapp.schema.syntaxes.LDAPSyntax.displayValue().