ZP-1391 Allow disabling the GSSAPI authenticator. Released under the Affero...

ZP-1391 Allow disabling the GSSAPI authenticator. Released under the Affero GNU General Public License (AGPL) version 3.

The php-imap module does not support proper fallback from GSSAPI to
other authentication methods (such as PLAIN). This causes the IMAP
backend to be non-functional when connecting to a GSSAPI-enabled IMAP
server (users will be unable to log in).
Since there is no fix available for the php-imap bug, this change
introduces a IMAP_DISABLE_AUTHENTICATOR setting that can be used to
manually disable GSSAPI support in the imap module.

Cf.: https://github.com/barbushin/php-imap/issues/19

src/backend/imap/config.php

@@ -207,4 +207,8 @@ define('SYSTEM_MIME_TYPES_MAPPING', '/etc/mime.types');
 
 
 // Use BackendCalDAV for Meetings. You cannot hope to get that functionality working without a caldav backend.
-define('IMAP_MEETING_USE_CALDAV', false);
\ No newline at end of file
+define('IMAP_MEETING_USE_CALDAV', false);
+
+// If your IMAP server allows authenticating via GSSAPI, php-imap will not fall back properly to other authentication
+// methods and you will be unable to log in. Uncomment the following line to enable use in such an environment.
+// define('IMAP_DISABLE_AUTHENTICATOR', 'GSSAPI');

src/backend/imap/imap.php

@@ -52,6 +52,7 @@ class BackendIMAP extends BackendDiff implements ISearchProvider {
     private $folderhierarchy;
     private $excludedFolders;
     private static $mimeTypes = false;
+    private $imapParams = array();
 
 
     public function __construct() {
@@ -68,6 +69,9 @@ class BackendIMAP extends BackendDiff implements ISearchProvider {
         if (!function_exists("mb_detect_order")) {
             ZLog::Write(LOGLEVEL_WARN, sprintf("BackendIMAP(): php-mbstring module is not installed, you should install it for better encoding conversions"));
         }
+        if (defined("IMAP_DISABLE_AUTHENTICATOR")) {
+	    $this->imapParams = array("DISABLE_AUTHENTICATOR" => IMAP_DISABLE_AUTHENTICATOR);
+        }
     }
 
     /**----------------------------------------------------------------------------------------------------------
@@ -105,7 +109,7 @@ class BackendIMAP extends BackendDiff implements ISearchProvider {
         /* END fmbiete's contribution r1527, ZP-319 */
 
         // open the IMAP-mailbox
-        $this->mbox = @imap_open($this->server , $username, $password, OP_HALFOPEN);
+        $this->mbox = @imap_open($this->server , $username, $password, OP_HALFOPEN, 0, $this->imapParams);
         $this->mboxFolder = "";
 
         if ($this->mbox) {
@@ -2224,7 +2228,7 @@ class BackendIMAP extends BackendDiff implements ISearchProvider {
             imap_ping($this->mbox);
         }
         else {
-            $this->mbox = @imap_open($this->server, $this->username, $this->password, OP_HALFOPEN);
+            $this->mbox = @imap_open($this->server, $this->username, $this->password, OP_HALFOPEN, 0, $this->imapParams);
             $this->mboxFolder = "";
         }
     }