fix pylint warnings

uffd/ldap/__init__.py

 from .ldap import bp as ldap_bp
-from .ldap import get_conn, user_conn, escape_filter_chars, uid_to_dn, loginname_to_dn, get_next_uid, loginname_is_safe
+from .ldap import get_conn, user_conn, escape_filter_chars, uid_to_dn
+from .ldap import loginname_to_dn, get_next_uid, loginname_is_safe
+from .ldap import get_ldap_array_attribute_safe, get_ldap_attribute_safe
 
 bp = [ldap_bp]

uffd/ldap/ldap.py

@@ -2,7 +2,7 @@ import string
 
 from flask import Blueprint, current_app
 from ldap3.utils.conv import escape_filter_chars
-from ldap3.core.exceptions import LDAPBindError
+from ldap3.core.exceptions import LDAPBindError, LDAPCursorError
 
 from ldap3 import Server, Connection, ALL, ALL_ATTRIBUTES, ALL_OPERATIONAL_ATTRIBUTES
 
@@ -42,8 +42,7 @@ def uid_to_dn(uid):
 def loginname_to_dn(loginname):
 	if loginname_is_safe(loginname):
 		return 'uid={},{}'.format(loginname, current_app.config["LDAP_BASE_USER"])
-	else:
-		raise Exception('unsafe login name')
+	raise Exception('unsafe login name')
 
 def loginname_is_safe(value):
 	if len(value) > 32 or len(value) < 1:
@@ -68,3 +67,25 @@ def get_next_uid():
 	if uid_to_dn(next_uid):
 		raise Exception('No free uid found')
 	return next_uid
+
+def get_ldap_attribute_safe(ldapobject, attribute):
+	try:
+		result = ldapobject[attribute].value if attribute in ldapobject  else None
+	# we have to catch LDAPCursorError here, because ldap3 in older versions has a broken __contains__ function
+	# see https://github.com/cannatag/ldap3/issues/493
+	# fixed in version 2.5
+	# debian buster ships 2.4.1
+	except LDAPCursorError:
+		result = None
+	return result
+
+def get_ldap_array_attribute_safe(ldapobject, attribute):
+	# if the aray is empty, the attribute does not exist.
+	# if there is only one elemtent, ldap returns a string and not an array with one element
+	# we sanitize this to always be an array
+	result = get_ldap_attribute_safe(ldapobject, attribute)
+	if not result:
+		result = []
+	if isinstance(result, str):
+		result = [result]
+	return result

uffd/role/models.py

@@ -21,12 +21,12 @@ class LdapMapping():
 	id = Column(Integer(), primary_key=True, autoincrement=True)
 	dn = Column(String(128))
 	@declared_attr
-	def role_id(cls):
+	def role_id(self):
 		return Column(ForeignKey('role.id'))
 	ldapclass = None
 
 	def get_ldap(self):
-		return self.ldapclass.from_ldap_dn(dn)
+		return self.ldapclass.from_ldap_dn(self.dn)
 
 	def set_ldap(self, value):
 		self.dn = value['dn']
@@ -38,4 +38,3 @@ class RoleGroup(LdapMapping, db.Model):
 class RoleUser(LdapMapping, db.Model):
 	__tablename__ = 'role-user'
 	ldapclass = Group
-

uffd/role/views.py

@@ -2,10 +2,8 @@ from flask import Blueprint, render_template, request, url_for, redirect, flash,
 
 from uffd.navbar import register_navbar
 from uffd.csrf import csrf_protect
-from uffd.user.models import User, Group
 from uffd.role.models import Role
 from uffd.session import get_current_user, login_required, is_valid_session
-from uffd.ldap import loginname_to_dn
 from uffd.database import db
 
 bp = Blueprint("role", __name__, template_folder='templates', url_prefix='/role/')

uffd/user/models.py

@@ -16,21 +16,12 @@ class User():
 
 	@classmethod
 	def from_ldap(cls, ldapobject):
-		# if you are in no groups, the "memberOf" attribute does not exist
-		# if you are only in one group, ldap returns a string not an array with one element
-		# we sanitize this to always be an array
-		try:
-			sanitized_groups = ldapobject['memberOf'].value if hasattr(ldapobject, 'memberOf') else []
-		except:
-			sanitized_groups = []
-		if isinstance(sanitized_groups, str):
-			sanitized_groups = [sanitized_groups]
 		return User(
 				uid=ldapobject['uidNumber'].value,
 				loginname=ldapobject['uid'].value,
 				displayname=ldapobject['cn'].value,
 				mail=ldapobject['mail'].value,
-				groups=sanitized_groups,
+				groups=ldap.get_ldap_array_attribute_safe(ldapobject, 'memberOf')
 			)
 
 	@classmethod
@@ -124,21 +115,11 @@ class Group():
 
 	@classmethod
 	def from_ldap(cls, ldapobject):
-		try:
-			description = ldapobject['description'].value if hasattr(ldapobject, 'description') else ''
-		except:
-			description = ''
-		# if a group has no members, "uniqueMember" attribute does not exist
-		# if a group has exactly one member, ldap returns a string not an array with one element
-		# we sanitize this to always be an array
-		sanitized_members = ldapobject['uniqueMember']
-		if isinstance(sanitized_members, str):
-			sanitized_members = [sanitized_members]
 		return Group(
 				gid=ldapobject['gidNumber'].value,
 				name=ldapobject['cn'].value,
-				members=sanitized_members,
-				description=description,
+				members=ldap.get_ldap_array_attribute_safe(ldapobject, 'uniqueMember'),
+				description=ldap.get_ldap_attribute_safe(ldapobject, 'description') or '',
 			)
 
 	@classmethod