Tag: Patch

bookmark_borderHorde 4.0.6 brings user-specific admin privileges

Posted on by Ralf
Horde 4 admin permissions screenshot

Traditionally, Horde only knows two kinds of users: Users with administration flag and users without. The list of admins is a static entry in the horde config file. It’s all or nothing – either a user gets access to all admin functions or to none. At least until recently.

Last October I wrote about a patch for Horde 3 which allows permission-based access to individual admin privileges. This patch has now been ported to Horde 4 and is incorporated in Horde 4.0.6. You can now assign a user the task of managing groups without allowing him to use the permissions admin and grant himself additional privileges. Or you can delegate emergency password resets to a group of trusted people without confusing them with icons like the PHP Shell. Only those admin functions are shown which the user has access to. Another side effect: Even if a user has all admin permissions, he is still not recognised as an admin and won’t be shown things that admins always have to see regardless of their permissions and settings.

In theory, you can now give yourself all admin permissions and safely delete yourself out of the admin list – as long as you have the “configuration” permission, you can always go back and restore without manually editing the conf.php file.

The Administration permissions are handled in the permissions screen just like any other user permissions. They live under the “horde” component. Currently only the “show” flag is actually recognized but this will be expanded later.

bookmark_borderHorde 3.3.10 customizing – Patch for more flexible administration of users and groups

Posted on by Ralf

Horde Groupware is a great couple of end-user applications with a lot of flexibility. It supports many different sources or backends for retrieving authorized users and putting them into groups which have access to some resources like calendars, address books or inventory lists. Horde includes a GUI for editing users and groups if the backend supports it. The GUI is accessible only to those users which have the global administrator privilege set in the conf.php configuration file. Users with this flag can access all administrative options like the SQL shell, the configuration editor and the permission tree. This is usually not what you want. Administrators want to delegate tedious user and group management to moderators or managers, but they do not want to enable these people to make harmful changes to the general application setup. Even worse, administrator users always see all applications, even those not properly setup for usage. There’s no way to disable that.

To fix this, I have provided a patch against horde 3.3.10 which allows more flexible administration permissions. You can now allow certain users to access only some administration screens like the users screen or the groups screen while not allowing them access to the permissions editor at the same time. These users will be presented only the administrative links which they have access to. Technically, they don’t get the isAdmin flag, so they don’t need to view everything a full administrator can see. I used the horde permissions system to implement access management, after Jan Schneider suggested this move instead of writing a full “account management module”. There is no feedback yet if this patch will make it into mainstream horde3 but I will use it on some horde installations.

bookmark_borderHorde DIMP Portal: Let Dimp use classic Horde Portal settings

Posted on by Ralf

When you use DIMP, the AJAX frontend to Horde Groupware‘s widely used IMP webmailer, you usually want to hide the classic horde sidebar and the horde portal itself. Though DIMP provides its own portal page to display Horde Blocks, it does not provide any configuration tool for them but provides one static set for all users. One way around this is to make use of the user’s existing classic Horde Portal settings. This is how it works: Edit dimp/config/portal.php and add the following lines:

$horde_portal_layout = @unserialize($prefs->getValue(‘portal_layout’));
/* Format is
[row]
[column] empty or array app
[column]
[app] (string registry app identifier)
[height] (integer rows)
[width] (integer columns)
[params] (array)
[type] string block type identifier
[params] array, specific to block type*/

foreach ($horde_portal_layout as $horde_portal_row) {
foreach ($horde_portal_row as $item) {
if (is_array($item)) {
$dimp_block_list[$collection->getName($item[‘app’], $item[‘params’][‘type’] )] = array( ‘ob’ => $collection->getBlock( $item[‘app’], $item[‘params’][‘type’], $item[‘params’][‘params’] ) );
}
}

This is only a first approach to a complete solution. Dimp allows to add a specific DOM ID to every single block and to load specific JavaScript or template markup. In the default configuration, some blocks like the Ingo Filter’s overview block look odd in dimp portal, which was not in mind when they were originally designed.

Do you need site-specific horde hacks, setups, modules or improvements? Ask B1 Systems GmbH for consulting and development.