Welcoming script

[lisasali]

Can zimbra generate an automatic welcoming screen to all its firts time users when they log in??
Just like other mailing system i think it is very important.

lisa

[metux]

Originally Posted by lisasali

Can zimbra generate an automatic welcoming screen to all its firts time users when they log in??

We've already done this by a zimlet.

It's yet a bit hackish as it stores the data in the mailboxd node's local mysql database,
we probably should use LDAP instead. But it works quite well, eg. in a big international
bank.

[tdesorbaix]

Here is a simple example zimlet creating a welcome message that show up only the first time the user log in.

This use a zimlet user properties (stored in LDAP) to check if this is the first time the user log in.

[metux]

Originally Posted by tdesorbaix

Here is a simple example zimlet creating a welcome message that show up only the first time the user log in :
Attachment 4988

This use a zimlet user properties (stored in LDAP) to check if this is the first time the user log in.

Are you sure, these properties you set on *client* side with the

this.setUserProperty(...)

call are really written back to LDAP ?

I really doubt it, as it would be a big security hole.

[tdesorbaix]

If you have doubts, then just use an ldap explorer software and check your ldap.

The user preferences, including zimlets user preferences are in your LDAP.

Why do you think this is a big security hole?

[metux]

Originally Posted by tdesorbaix

The user preferences, including zimlets user preferences are in your LDAP.

The question isn't whether they are store in LDAP, but whether the frontend
javascript code can simply overwrite them.

Why do you think this is a big security hole?

Because the user then can arbitrarily change them at will.

[metux]

By the way: did you already confirm that they're actually written back to LDAP when changing them this way ?

[tdesorbaix]

Of course the user can change them, since this is user preferences.

Also, you don't even need the javascript frontend.
The changes are made by a soap request (called by the javascript).
So you just need to make the correct soap request.

And yes, I confirm that this overwrite the values in ldap.

[metux]

Originally Posted by tdesorbaix

Of course the user can change them, since this is user preferences.

Oh, that really *has* security impact in certain environments (not an unusual
customer requirement in our projects) users should not be allowed to change
certain user properties.

Do you know which things are stored there ?

[tdesorbaix]

It's not like the user can modify everything in the LDAP.
I use the word preferences instead of properties on purpose.

The values the user can modify are the values corresponding to the preferences you can find in the User Web Client preferences tab, and the zimlets user preferences.

As example, there is a user property to enable/disable the Calendar feature, but it can't be changed by the user, only the admins can change it.