diff --git a/application/helpers/html_helper.php b/application/helpers/html_helper.php
index c3edcf3a..785518ec 100644
--- a/application/helpers/html_helper.php
+++ b/application/helpers/html_helper.php
@@ -178,3 +178,21 @@ if (!function_exists('slot')) {
}
}
}
+
+if (!function_exists('pure_html')) {
+ /**
+ * Use this function in order to render HTML that comes from a text editor or similar, but strip the JS from it.
+ *
+ * @param string $markup
+ *
+ * @return string
+ */
+ function pure_html(string $markup): string
+ {
+ $config = HTMLPurifier_Config::createDefault();
+
+ $purifier = new HTMLPurifier($config);
+
+ return $purifier->purify($markup);
+ }
+}
diff --git a/application/libraries/Ldap_client.php b/application/libraries/Ldap_client.php
index 9c55e642..1095fc96 100644
--- a/application/libraries/Ldap_client.php
+++ b/application/libraries/Ldap_client.php
@@ -38,34 +38,6 @@ class Ldap_client
$this->CI->load->library('accounts');
}
- /**
- * Validate the provided password with an LDAP hashed password.
- *
- * @param string $password
- * @param string $hashed_password
- *
- * @return bool
- */
- public function validate_password(string $password, string $hashed_password): bool
- {
- if (empty($hashed_password) || ($hashed_password[0] !== '{' && $password === $hashed_password)) {
- return false;
- }
-
- if (str_starts_with($hashed_password, '{MD5}')) {
- $encrypted_password = '{MD5}' . base64_encode(md5($password, true));
- } elseif (str_starts_with($hashed_password, '{SHA1}')) {
- $encrypted_password = '{SHA}' . base64_encode(sha1($password, true));
- } elseif (str_starts_with($hashed_password, '{SSHA}')) {
- $salt = substr(base64_decode(substr($hashed_password, 6)), 20);
- $encrypted_password = '{SSHA}' . base64_encode(sha1($password . $salt, true) . $salt);
- } else {
- throw new RuntimeException('Unsupported password hash format');
- }
-
- return $hashed_password === $encrypted_password;
- }
-
/**
* Try authenticating the user with LDAP
*
@@ -97,52 +69,19 @@ class Ldap_client
$user = $this->CI->accounts->get_user_by_username($username);
if (empty($user['ldap_dn'])) {
- return null;
+ return null; // User does not exist in Easy!Appointments
}
// Connect to LDAP server
- $host = setting('ldap_host');
- $port = (int) setting('ldap_port');
- $user_dn = setting('ldap_user_dn');
- $ldap_password = setting('ldap_password');
-
- $connection = @ldap_connect($host, $port);
-
- if (!$connection) {
- throw new Exception('Could not connect to LDAP server: ' . @ldap_error($connection));
- }
+ $ldap_host = setting('ldap_host');
+ $ldap_port = (int) setting('ldap_port');
+ $connection = @ldap_connect($ldap_host, $ldap_port);
@ldap_set_option($connection, LDAP_OPT_PROTOCOL_VERSION, 3);
- @ldap_set_option($connection, LDAP_OPT_REFERRALS, 0); // We need this for doing an LDAP search.
-
- $bind = @ldap_bind($connection, $user_dn, $ldap_password);
-
- if (!$bind) {
- throw new Exception('LDAP bind failed: ' . @ldap_error($connection));
- }
-
- // Check the provided password against the LDAP service
-
- $filter = '(objectclass=*)';
-
- $result = @ldap_search($connection, $user['ldap_dn'], $filter);
-
- if (!$result) {
- return null;
- }
-
- $ldap_entries = @ldap_get_entries($connection, $result);
-
- foreach ($ldap_entries as $ldap_entry) {
- if (!is_array($ldap_entry) || empty($ldap_entry['dn']) || $ldap_entry['dn'] !== $user['ldap_dn']) {
- continue;
- }
-
- if (!$this->validate_password($password, $ldap_entry['userpassword'][0])) {
- continue;
- }
+ $user_bind = @ldap_bind($connection, $user['ldap_dn'], $password);
+ if ($user_bind) {
$role = $this->CI->roles_model->find($user['id_roles']);
$default_timezone = $this->CI->timezones->get_default_timezone();
diff --git a/application/views/components/cookie_notice_modal.php b/application/views/components/cookie_notice_modal.php
index 9d3312aa..40c51d51 100644
--- a/application/views/components/cookie_notice_modal.php
+++ b/application/views/components/cookie_notice_modal.php
@@ -13,7 +13,7 @@