FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reach the rest of what lldap exposes — photos, real names, group rename

Browse Source 
lldap lets you edit five things about a user and one about a group; the page reached two of
them, so correcting a surname or a group's name still meant opening the container's own WebUI.
This commit is contained in:
Gmer4Lfe
2026-08-15 11:45:23 -04:00
parent 693ac693a4
commit 81aeb0619b
3 changed files with 338 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/unraid/api/auth.php
+29 -2
View File
@@ -95,6 +95,25 @@ require_once dirname(__DIR__) . '/include/auth.php';
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
$action = $_GET['action'] ?? '';
// The one route here that does not answer in JSON — it streams the stored JPEG so the page can
// point an <img> at it, rather than carrying 470 KB of base64 through the user list on every
// load. Handled before the match so the Content-Type set above is replaced rather than sent
// alongside image bytes.
if ($action === 'lldap_avatar') {
$raw = vv_lldap_avatar((string) ($_GET['uid'] ?? ''));
if ($raw === '') { header('Content-Type: application/json'); http_response_code(404);
echo json_encode(['ok' => false, 'error' => 'No avatar']); exit; }
header('Content-Type: image/jpeg');
header('Content-Length: ' . strlen($raw));
// Private, because this is a photograph of a person behind an authenticated admin page,
// and must not be held by anything between here and the browser. Short, because the
// operator changing an avatar expects to see it change.
header('Cache-Control: private, max-age=60');
echo $raw;
exit;
}
$result = match ($action) {
'npm_proxies' => vv_npm_list_proxies(),
'npm_certs' => ['ok' => true, 'certs' => vv_npm_list_certs()],
@@ -122,8 +141,16 @@ $result = match ($action) {
'npm_delete' => vv_npm_delete_proxy((int)($_POST['id'] ?? 0)),
'npm_toggle' => vv_npm_toggle_proxy((int)($_POST['id'] ?? 0), ($_POST['enabled'] ?? '0') === '1'),
// lldap
'lldap_create_user' => vv_lldap_create_user($_POST['uid'] ?? '', $_POST['email'] ?? '', $_POST['display_name'] ?? '', $_POST['password'] ?? ''),
'lldap_update_user' => vv_lldap_update_user($_POST['uid'] ?? '', $_POST['email'] ?? '', $_POST['display_name'] ?? ''),
'lldap_create_user' => vv_lldap_create_user($_POST['uid'] ?? '', $_POST['email'] ?? '', $_POST['display_name'] ?? '', $_POST['password'] ?? '',
$_POST['first_name'] ?? '', $_POST['last_name'] ?? ''),
// isset, not ??'' — the update helper reads null as "not offered" and '' as "cleared", and
// collapsing the two here would erase a first name every time a form omitted the field.
'lldap_update_user' => vv_lldap_update_user($_POST['uid'] ?? '', $_POST['email'] ?? '', $_POST['display_name'] ?? '',
isset($_POST['first_name']) ? (string) $_POST['first_name'] : null,
isset($_POST['last_name']) ? (string) $_POST['last_name'] : null),
'lldap_set_avatar' => vv_lldap_set_avatar($_POST['uid'] ?? '', $_POST['avatar'] ?? ''),
'lldap_remove_avatar' => vv_lldap_remove_avatar($_POST['uid'] ?? ''),
'lldap_rename_group' => vv_lldap_rename_group((int)($_POST['id'] ?? 0), $_POST['name'] ?? ''),
'lldap_delete_user' => vv_lldap_delete_user($_POST['uid'] ?? ''),
'lldap_set_password' => vv_lldap_set_password($_POST['uid'] ?? '', $_POST['password'] ?? ''),
'lldap_create_group' => vv_lldap_create_group($_POST['name'] ?? ''),