Questions: Build General Structure

.gitignore

@@ -30,7 +30,7 @@
 /ilias.ini.php
 /ilias.log
 /db_template_writer.php
-/components/ILIAS/setup_/sql/dbupdate_custom.php
+/components/ILIAS/Database/sql/dbupdate_custom.php
 /install_client.php
 
 # Directories

README.md

@@ -3,24 +3,24 @@
 
 # ILIAS
 
-ILIAS is a powerful Open Source Learning Management System for developing and realising web-based e-learning. The software was developed to reduce the costs of using new media in education and further training and to ensure the maximum level of customer influence in the implementation of the software. ILIAS is published under the General Public Licence and free of charge.
+ILIAS is a powerful Open Source Learning Management System for developing and realising web-based e-learning. The software was developed to reduce the costs of using new media in education and further training and to ensure the maximum level of customer influence in the implementation of the software. ILIAS is published under the General Public Licence 3.0 and free of charge.
 
 ### Features
-[see all features on our official website](https://www.ilias.de/en/about-ilias/) or [read our booklet](http://www.ilias.de/docu/goto_docu_file_1854_download.html)
+[Read more about ILIAS features on our official website](https://www.ilias.de/en/about-ilias/) or [have a look in our booklet (de)](https://docu.ilias.de/goto_docu_file_4712_download.html)
 
 ### Installation
 
-Installation of ILIAS is well documented on [our official Installation manual](http://www.ilias.de/docu/goto_docu_lm_367.html) and in the documentation contained inside this repo: [/docs/configuration/install.md](/docs/configuration/install.md)
+Installation of ILIAS is well documented on [our official Installation manual](https://docu.ilias.de/go/lm/367) and in the documentation contained inside this repo: [/docs/configuration/install.md](/docs/configuration/install.md)
 
 ### Plugins
 
-ILIAS can be extended with a lot of Plugins. You find the complete list in the [Plugin Repository](http://www.ilias.de/docu/goto.php?target=cat_1442&client_id=docu)
+ILIAS can be extended with a lot of Plugins. You find a list in the [Plugin Data Collection](https://docu.ilias.de/go/dcl/3342)
 
 
 ### Community
 
-We have a big [community](http://www.ilias.de/docu/goto.php?target=cat_1444&client_id=docu) and you can get a member of [ILIAS Society](http://www.ilias.de/docu/goto.php?target=cat_1669&client_id=docu).
-You may even join us at one of our regular [ILIAS Conferences](http://www.ilias.de/docu/goto.php?target=cat_2255&client_id=docu).
+We have a big [community](https://www.ilias.de/en/ilias-society/) and you can get a member of the [ILIAS Society](https://www.ilias.de/en/join-ilias-society/).
+You may even join us at one of our regular [ILIAS Conferences](https://www.ilias-conference.org/en/).
 
 
 ### Development

components/ILIAS/ADT/PRIVACY.md

@@ -0,0 +1,23 @@
+# ADT Privacy
+Disclaimer: This documentation does not guarantee completeness or accuracy. Please report any missing or incorrect information via Pull Request (docs/development/contributing.md#pull-request-to-the-repositories).
+## General Information
+ADT stands for Advanced Definition Type.
+[Please provide a brief description of the component here]
+
+
+## Integrated Services
+The Advanced Definition Type component employs the following components, please consult the respective privacy.mds:
+- [Please list all components here]
+
+
+## Data being stored
+The Advanced Definition Type component itself does not store any personal data.
+
+## Data being presented
+The Advanced Definition Type component itself does not present any personal data.
+
+## Data being deleted
+The Advanced Definition Type component itself does not store or delete any personal data.
+
+## Data being exported
+The Advanced Definition Type component itself does not export any personal data.

components/ILIAS/AccessControl/PRIVACY.md

@@ -1,8 +1,6 @@
-# Access Control Service Privacy
+# AccessControl Privacy
 
-This documentation does not warrant completeness or correctness. Please report any
-missing or wrong information using the [ILIAS issue tracker](https://mantis.ilias.de)
-or contribute a fix via [Pull Request](docs/development/contributing.md#pull-request-to-the-repositories).
+> **Disclaimer: This documentation does not guarantee completeness or accuracy. Please report any missing or incorrect information by submitting a [Pull Request](docs/development/contributing.md#pull-request-to-the-repositories) or, if you prefer, via the [ILIAS bug tracker](https://mantis.ilias.de). When using the bug tracker, please select the corresponding component in the **Category** field.**
 
 
 ## Data being stored

components/ILIAS/Administration/GlobalScreen/classes/AdministrationMainBarProvider.php

@@ -225,7 +225,7 @@ private function getGroups(): array
         // admin menu layout
         $layout = array(
             "maintenance" =>
-                array("adma", "serv", "cron", "bnmk", "lngf", "hlps", "wfe", 'fils', 'logs', 'sysc', "recf", "root"),
+                array("adma", "serv", "cron", "bnmk", "lngf", "hlps", "wfe", 'fils', 'qsts', 'logs', 'sysc', "recf", "root"),
             "layout_and_navigation" =>
                 array("mme", "gsfo", "dshs", "stys", "adve", "stus"),
             "repository_and_objects" =>

components/ILIAS/AdministrativeNotification/classes/class.ilADNNotificationUIFormGUI.php

@@ -380,7 +380,7 @@ protected function getRoles(int $filter): array
     {
         $opt = [];
         foreach ($this->rbac_review->getRolesByFilter($filter) as $role) {
-            $opt[(int) $role['obj_id']] = $role['title'] . ' (' . $role['obj_id'] . ')';
+            $opt[(int) $role['obj_id']] = (string) $role['title'];
         }
 
         return $opt;

components/ILIAS/AdvancedMetaData/PRIVACY.md

@@ -1,4 +1,4 @@
-# AdvancedMetaData
+# AdvancedMetaData Privacy
 Disclaimer: This documentation does not guarantee completeness or correctness. Please report any missing or incorrect information using the ILIAS issue tracker or contribute a fix via Pull Request (docs/development/contributing.md#pull-request-to-the-repositories).
 ## General Information
 Advanced Metadata is labeled Custom Metadata in the user interface. 
@@ -23,4 +23,4 @@ The Advanced Metadata itself does not present any personal data.
 The Advanced Metadata itself does not store or delete any personal data.
 
 ## Data being exported
-The Advanced Metadata module itself does not export any personal data.
+The Advanced Metadata module itself does not export any personal data.

components/ILIAS/AdvancedMetaData/classes/class.ilAdvancedMDSettingsGUI.php

@@ -1363,7 +1363,7 @@ public function saveField(): void
             $translations->read();
             $translations->updateFromForm($field_definition->getFieldId(), $this->active_language, $form);
 
-            $this->tpl->setOnScreenMessage('success', $this->lng->txt('save_settings'), true);
+            $this->tpl->setOnScreenMessage('success', $this->lng->txt('settings_saved'), true);
             $this->ctrl->redirect($this, "editFields");
         }
 

components/ILIAS/AdvancedMetaData/tests/record/ilAdvancedMDRecordObjectOrderingsTest.php

@@ -78,6 +78,6 @@ protected function initRecordSortingDependencies(): void
     {
         $this->dic = new Container();
         $GLOBALS['DIC'] = $this->dic;
-        $this->setGlobalVariable('ilDB', $this->createMock(ilDBInterface::class));
+        $this->setGlobalVariable('ilDB', $this->createStub(ilDBInterface::class));
     }
 }

components/ILIAS/AuthShibboleth/resources/shib_logout.php

@@ -16,162 +16,17 @@
  *
  *********************************************************************/
 
+// A real Shib-Logout ("front" or "back" channel was never implemented resp. removed in ILIAS, because the front-channel
+// also had problems concerning the security. If a logout mechanism is desired, please revisit the feature request
+// https://docu.ilias.de/goto_docu_wiki_wpage_4657_1357.html and bring it as a suggestion to the community:
+// https://docu.ilias.de/goto.php?target=wiki_5307&client_id=docu#ilPageTocA129
+/** @noRector */
 require_once("../vendor/composer/vendor/autoload.php");
 ilContext::init(ilContext::CONTEXT_SHIBBOLETH);
 require_once("../artifacts/bootstrap_default.php");
+entry_point("ILIAS Legacy Initialisation Adapter");
 
 global $DIC;
 
-$q = $DIC->http()->wrapper()->query();
-if (
-    $q->has('return')
-    && $q->has('action')
-    && $q->retrieve('action', $DIC->refinery()->to()->string()) === 'logout'
-) {
-    entry_point("ILIAS Legacy Initialisation Adapter");
-    // Logout out user from application
-    // Destroy application session/cookie etc
-    $GLOBALS['DIC']['ilAuthSession']->logout();
-
-    // Finally, send user to the return URL
-    ilUtil::redirect($q->retrieve('action', $DIC->refinery()->kindlyTo()->string()));
-}
-
-// Back channel logout //
-
-// Note: This is the preferred logout channel because it also allows
-//       administrative logout. However, it requires your application to be
-//       adapated in the sense that the user's Shibboleth session ID must be
-//       stored in the application's session data.
-//       See function LogoutNotification below
-
-elseif (!empty(file_get_contents('php://input'))) {
-    ilContext::init(ilContext::CONTEXT_SOAP);
-
-    // Load ILIAS libraries and initialise ILIAS in non-web context
-    entry_point("ILIAS Legacy Initialisation Adapter");
-
-    // Set SOAP header
-    $server = new SoapServer('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['SCRIPT_NAME'] . '/LogoutNotification.wsdl');
-    $server->addFunction("LogoutNotification");
-    $server->handle();
-}
-
-// Return WSDL
-
-// Note: This is needed for the PHP SoapServer class.
-//       Since I'm not a web service guru it might be that the code below is not
-//       absolutely correct but at least it seems to to its job properly when it
-//       comes to Shibboleth logout
-
-else {
-    header('Content-Type: text/xml');
-
-    $url = filter_var("https://{$_SERVER['HTTP_HOST']}/shib_logout.php", FILTER_SANITIZE_URL);
-
-    echo <<<WSDL
-<?xml version ="1.0" encoding ="UTF-8" ?>
-<definitions name="LogoutNotification" targetNamespace="urn:mace:shibboleth:2.0:sp:notify"
-	xmlns:notify="urn:mace:shibboleth:2.0:sp:notify"
-	xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
-	xmlns="http://schemas.xmlsoap.org/wsdl/">
-
-	<types>
-		<schema targetNamespace="urn:mace:shibboleth:2.0:sp:notify"
-			xmlns="http://www.w3.org/2000/10/XMLSchema"
-			xmlns:notify="urn:mace:shibboleth:2.0:sp:notify">
-
-			<simpleType name="string">
-				<restriction base="string">
-					<minLength value="1"/>
-				</restriction>
-			</simpleType>
-
-			<element name="OK" type="notify:OKType"/>
-			<complexType name="OKType">
-				<sequence/>
-			</complexType>
-
-		</schema>
-	</types>
-
-	<message name="getLogoutNotificationRequest">
-		<part name="SessionID" type="notify:string" />
-	</message>
-
-	<message name="getLogoutNotificationResponse">
-		<part name="OK"/>
-	</message>
-
-	<portType name="LogoutNotificationPortType">
-		<operation name="LogoutNotification">
-			<input message="getLogoutNotificationRequest"/>
-			<output message="getLogoutNotificationResponse"/>
-		</operation>
-	</portType>
-
-	<binding name="LogoutNotificationBinding" type="notify:LogoutNotificationPortType">
-		<soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
-		<operation name="LogoutNotification">
-			<soap:operation soapAction="urn:xmethods-logout-notification#LogoutNotification"/>
-		</operation>
-	</binding>
-
-	<service name="LogoutNotificationService">
-		<port name="LogoutNotificationPort" binding="notify:LogoutNotificationBinding">
-			<soap:address location="{$url}"/>
-		</port>
-	</service>
-</definitions>
-WSDL;
-    exit;
-}
-
-/******************************************************************************/
-/// This function does the actual logout
-function LogoutNotification($SessionID): ?\SoapFault
-{
-    // Delete session of user using $SessionID to locate the user's session file
-    // on the file system or in the database
-    // Then delete this entry or record to clear the session
-    // However, for that to work it is essential that the user's Shibboleth
-    // SessionID is stored in the user session data!
-
-    global $ilDB;
-
-    $q = "SELECT session_id, data FROM usr_session WHERE expires > 'NOW()'";
-    $r = $ilDB->query($q);
-
-    while ($session = $r->fetchRow(ilDBConstants::FETCHMODE_ASSOC)) {
-        $session_data = unserializesession($session['data']);
-        // Delete this session entry
-        if (
-            is_array($session_data)
-            && array_key_exists('shibboleth_session_id', $session_data)
-            && $session_data['shibboleth_session_id'] === $SessionID
-            && !ilSession::_destroy($session['session_id']
-            )
-        ) {
-            return new SoapFault('LogoutError', 'Could not delete session entry in database.');
-        }
-    }
-    // If no SoapFault is returned, all is fine
-    return null;
-}
-
-/******************************************************************************/
-// Deserializes session data and returns it in a hash array of arrays
-/**
- * @return mixed[]
- */
-function unserializesession($serialized_string): array
-{
-    $variables = [];
-    $a = preg_split("/(\w+)\|/", (string) $serialized_string, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE);
-    $counter = count($a);
-    for ($i = 0; $i < $counter; $i += 2) {
-        $variables[$a[$i]] = unserialize($a[$i + 1]);
-    }
-
-    return ($variables);
-}
+$GLOBALS['DIC']['ilAuthSession']->logout();
+ilUtil::redirect('login.php');

components/ILIAS/Authentication/classes/Frontend/class.ilAuthFrontend.php

@@ -404,7 +404,19 @@ protected function handleLoginAttempts(): void
         $usr_id_candidates = [];
         foreach (array_filter($auth_modes) as $auth_mode) {
             if ((int) $auth_mode === ilAuthUtils::AUTH_LOCAL) {
-                $usr_id_candidates[] = ilObjUser::_lookupId($this->getCredentials()->getUsername());
+                $local_usr_id = ilObjUser::_lookupId($this->getCredentials()->getUsername());
+                // Mantis #47987: A failed local login must only count against an
+                // account that can actually be authenticated locally. Without this
+                // check, external accounts (e.g., Shibboleth/SAML) whose login name
+                // is entered in the local login form get their login attempts
+                // incremented and are eventually deactivated - even though a local
+                // login is impossible for them because "Allow Local Authentication"
+                // is disabled. This mirrors the gate in ilAuthProviderDatabase.
+                if (is_int($local_usr_id) && $local_usr_id > 0 && ilAuthUtils::isLocalPasswordEnabledForAuthMode(
+                    (int) ilAuthUtils::_getAuthMode(ilObjUser::_lookupAuthMode($local_usr_id))
+                )) {
+                    $usr_id_candidates[] = $local_usr_id;
+                }
                 continue;
             }
 

components/ILIAS/BackgroundTasks_/classes/Jobs/class.ilCollectFilesJob.php

@@ -97,21 +97,37 @@ public function run(array $input, Observer $observer): Value
 
         foreach ($object_ref_ids as $object_ref_id) {
             $object = ilObjectFactory::getInstanceByRefId($object_ref_id);
+            if (!$object instanceof ilObject) {
+                continue;
+            }
+
             $object_type = $object->getType();
             $object_name = $object->getTitle();
-            $object_temp_dir = ""; // empty as content will be added in recurseFolder and getFileDirs
+            $object_temp_dir = ''; // empty as content will be added in recurseFolder and getFileDirs
 
-            if ($object_type === "fold" || $object_type === "crs") {
+            if (in_array($object_type, ['fold', 'crs', 'grp'], true)) {
                 $num_recursions = 0;
-                $files_from_folder = $this->recurseFolder($object_ref_id, $object_name, $object_temp_dir, $num_recursions, $initiated_by_folder_action);
+                $files_from_folder = $this->recurseFolder(
+                    $object_ref_id,
+                    $object_name,
+                    $object_temp_dir,
+                    $num_recursions,
+                    $initiated_by_folder_action
+                );
                 $files = array_merge($files, $files_from_folder);
-            } elseif (($object_type === "file") && (($file_dirs = $this->getFileDirs(
-                $object_ref_id,
-                $object_name,
-                $object_temp_dir
-            )) !== false)) {
-                $files[] = $file_dirs;
+                continue;
             }
+
+            if ($object_type !== 'file') {
+                continue;
+            }
+
+            $file_dirs = $this->getFileDirs($object_ref_id, $object_name, $object_temp_dir);
+            if (!is_array($file_dirs)) {
+                continue;
+            }
+
+            $files[] = $file_dirs;
         }
         $this->logger->debug('Collected files:');
         $this->logger->dump($files);
@@ -154,7 +170,14 @@ private function getFileDirs($a_ref_id, string $a_file_name, string $a_temp_dir)
                 return false;
             }
 
-            $filname_with_suffix = $this->ensureSuffix($a_file_name, $file->getFileExtension());
+            // The object title may contain characters which are not allowed in file names:
+            // "/" would create a directory inside the archive, while "*", "?" and ":" are
+            // invalid on Windows and prevent the archive from being extracted. They are
+            // sanitized the same way as the folder names in recurseFolder().
+            $filname_with_suffix = $this->ensureSuffix(
+                ilFileUtils::getASCIIFilename($a_file_name),
+                $file->getFileExtension()
+            );
 
             $target_dir = $a_temp_dir . '/' . $filname_with_suffix;
 
@@ -165,7 +188,10 @@ private function getFileDirs($a_ref_id, string $a_file_name, string $a_temp_dir)
                 $target_info = pathinfo($target_dir);
                 $filename = $target_info["filename"];
                 $extension = isset($target_info["extension"]) ? "." . $target_info["extension"] : "";
-                $target_dir = $a_temp_dir . $filename . " (" . ++self::$targets[$target_dir] . ")" . $extension;
+                // pathinfo() returns the name without its directory, therefore the separator
+                // has to be added again, just like above
+                $target_dir = $a_temp_dir . '/' . $filename
+                    . " (" . ++self::$targets[$target_dir] . ")" . $extension;
             } else {
                 self::$targets[$target_dir] = 0;
             }