Index: ldapgroups.admin.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/ldap_integration/ldapgroups.admin.inc,v
retrieving revision 1.11
diff -u -p -r1.11 ldapgroups.admin.inc
--- ldapgroups.admin.inc	4 May 2009 00:26:17 -0000	1.11
+++ ldapgroups.admin.inc	19 Aug 2009 20:04:28 -0000
@@ -197,7 +197,7 @@ function ldapgroups_admin_edit(&$form_st
       '#default_value' => $edit['ldapgroups_filter_php'],
       '#cols' => 25,
       '#rows' => 5,
-      '#description' => t('Enter PHP to filter LDAP groups. Careful, bad PHP code here will break your site. If left empty, no filtering will be done. The groups array <code>$groups</code> is available in the code context. It should return a filtered <code>$groups</code> array as in example below. The code is evaluated before the above mapping is applied.<br /><code>$groups = array_filter($groups, create_function(\'$a\', \'return preg_match(\\\'/Staff/\\\', $a);\'));</code><br /><code>return $groups;</code>'),
+      '#description' => t('Enter PHP to filter LDAP groups. PHP module must be enabled to use this. Do not include opening and closing <code>&lt;?php   ?&gt;</code> tags. Careful, bad PHP code here will break your site. If left empty, no filtering will be done. The groups array is available as the global variable <code>$groups</code> in the code context. The code does not need to return the $groups variable as its a global variable. The code is evaluated before the above "Mapping of LDAP groups to Drupal roles" is applied.<br /><code>$groups = array_filter($groups, create_function(\'$a\', \'return preg_match(\\\'/Staff/\\\', $a);\'));</code><br /><code>return $groups;</code>'),
     );
 
     $form['sid'] = array(
@@ -266,6 +266,23 @@ function ldapgroups_admin_edit_validate(
         if (trim($line))
           $form_state['ldapgroups_groups'][] = trim($line);
       $form_state['ldapgroups_groups'] = !empty($form_state['ldapgroups_groups']) ? serialize($form_state['ldapgroups_groups']) : '';
+ 
+ 
+      if ($values['ldapgroups_filter_php'] && (! module_exists('php') ) ) {
+        form_set_error('ldapgroups_filter_php', t('PHP execution is not enabled so ldap groups filters cannot be applied. Please remove PHP filter code or enable the php module.'));
+      }
+      
+      if ( strpos($values['ldapgroups_filter_php'],'<?php') || strpos($values['ldapgroups_filter_php'],'?>')) {
+        form_set_error('ldapgroups_filter_php', t('"PHP to filter roles by" should not have opening or closing <code>&lt;?php   ?&gt;</code> tags. ')); 
+        
+     }
+     
+    if (strpos($values['ldapgroups_filter_php'],'$groups') === FALSE ) {
+        form_set_error('ldapgroups_filter_php', t('"$groups" was not found in your entry. "PHP to filter roles by" should alter the variable $groups.')); 
+        
+     }
+     
+ 
       break;
   }
 }
Index: ldapgroups.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/ldap_integration/ldapgroups.module,v
retrieving revision 1.39
diff -u -p -r1.39 ldapgroups.module
--- ldapgroups.module	28 Jul 2009 14:03:05 -0000	1.39
+++ ldapgroups.module	19 Aug 2009 20:20:50 -0000
@@ -3,9 +3,8 @@
 
 /**
  * @file
- * ldapgroups integrates ldap groups with drupal roles.
+ * ldapgroups maps ldap groups and user attributes to drupal roles.
  */
-
 //////////////////////////////////////////////////////////////////////////////
 
 define('LDAPGROUPS_DEFAULT_DN_ATTRIBUTE',      'ou');
@@ -15,13 +14,6 @@ define('LDAPGROUPS_DEFAULT_ENTRIES_ATTRI
 // Core API hooks
 
 /**
- * Implements hook_init().
- */
-function ldapgroups_init() {
-  require_once(drupal_get_path('module', 'ldapgroups') .'/includes/LDAPInterface.inc');
-}
-
-/**
  * Implementation of hook_menu().
  */
 function ldapgroups_menu() {
@@ -60,14 +52,22 @@ function ldapgroups_menu() {
 function ldapgroups_user($op, &$edit, &$account, $category = NULL) {
   switch ($op) {
     case 'login':
+      require_once(drupal_get_path('module', 'ldapgroups') .'/includes/LDAPInterface.inc');
       ldapgroups_user_login($account);
       break;
   }
 }
 
+<?php
+// $Id: ldapgroups.module,v 1.39 2009/07/28 14:03:05 miglius Exp $
+
+/**
+ * @file
+ * ldapgroups maps ldap groups and user attributes with drupal roles.
+ */
+
 //////////////////////////////////////////////////////////////////////////////
 // hook_user() functions
-
 /**
  * Implements hook_user() login operation.
  */
@@ -105,12 +105,13 @@ function ldapgroups_user_login(&$account
   // Next, we apply site-specific rules.
   $groups = _ldapgroups_filter($account, $groups);
 
+
   // At this point, the roles are in the full DN format.
   $roles = array();
   if (!empty($groups)) {
     $ldapgroups_mappings = _ldapgroups_ldap_info($account, 'ldapgroups_mappings');
     foreach ($groups as $group) {
-      $role = _ldapgroups_mapping($account, $group);
+      $role = _ldapgroups_mapping($account, $group, $ldapgroups_mappings);
       _ldapgroups_create_role($role);
       _ldapgroups_grant_role($account, $role);
       $roles[] = $role;
@@ -272,8 +273,19 @@ function _ldapgroups_filter($account, $g
     $groups = $groups_new;
   }
 
-  if ($code = _ldapgroups_ldap_info($account, 'ldapgroups_filter_php'))
-    $groups = eval($code);
+  if ($code = _ldapgroups_ldap_info($account, 'ldapgroups_filter_php')) {
+    global $ldap_groups;
+    if (module_exists('php')) {
+      $ldap_groups = $groups;
+      $code =  '<?php  global $ldap_groups; $groups = $ldap_groups; '. $code .' $ldap_groups = $groups; ?>';
+      php_filter('process', 0, -1, $code );
+    } else {
+      // if not enabled most secure response is to give warning, but allow no groups to pass through filter.
+      drupal_set_message(t('PHP execution is not enabled so ldap groups filters cannot be applied. Please remove PHP filter code or enable the php module.'),'error');
+      $ldap_groups = array();
+    }
+    $groups = $ldap_groups;
+  }
 
   return $groups;
 }
@@ -289,8 +301,7 @@ function _ldapgroups_filter($account, $g
  * @return
  *   An Drupal role.
  */
-function _ldapgroups_mapping($user, $group) {
-  $ldapgroups_mappings = _ldapgroups_ldap_info($user, 'ldapgroups_mappings');
+function _ldapgroups_mapping($user, $group, $ldapgroups_mappings) {
   if (isset($ldapgroups_mappings[$group]))
     return $ldapgroups_mappings[$group];
   else if (preg_match('/^[^=]+=([^,]+),.*$/', $group, $matches))
@@ -376,3 +387,5 @@ function _ldapgroups_ldap_info($sid, $re
   }
 }
 
+
+