- get_project_config.php: if project supports LDAP,
advertise this to the client.
- Manager: if project supports LDAP, say "Email address or LDAP ID"
in Attach Project wizard,
and don't do email address validation.
- lookup_account GUI RPC (client side): if passing an LDAP ID,
don't lowercase it, and don't hash passwd
- lookup_account GUI RPC (server side): if passing an LDAP ID,
pass appropriate URL args to Web RPC
- lookup_account Web RPC: in LDAP case, pass "ldap_auth" arg,
and pass "ldap_uid" and "passwd".
Handle these appropriately.
- add a PHP interface for lookup_account()
- PHP interfaces return error number as well as message
(messages change; numbers don't)
- using symbolic error codes instead of hardwired numbers in PHP code
There are two aspects:
1) undoing magic quotes (if it's being used).
This must be done for all GET and POST string inputs.
It is now done automatically by get_str() and post_str().
The places that refer to $_GET and $_POST directly
must do it themselves using undo_magic_quotes().
2) Escaping user-supplied strings before using them in DB queries.
This is done by process_user_text()
(which should be renamed db_escape_string()).
The new principle:
call process_user_text() in the function that does the DB query
(not at any higher level).
svn path=/trunk/boinc/; revision=15389
David Anderson