sal/osl/w32/security.cxx

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /*
   3  * This file is part of the LibreOffice project.
   4  *
   5  * This Source Code Form is subject to the terms of the Mozilla Public
   6  * License, v. 2.0. If a copy of the MPL was not distributed with this
   7  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8  *
   9  * This file incorporates work covered by the following license notice:
  10  *
  11  *   Licensed to the Apache Software Foundation (ASF) under one or more
  12  *   contributor license agreements. See the NOTICE file distributed
  13  *   with this work for additional information regarding copyright
  14  *   ownership. The ASF licenses this file to you under the Apache
  15  *   License, Version 2.0 (the "License"); you may not use this file
  16  *   except in compliance with the License. You may obtain a copy of
  17  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  18  */
  19
  20 #include "system.h"
  21
  22 #include <osl/security.h>
  23 #include <osl/diagnose.h>
  24 #include <osl/thread.h>
  25 #include <osl/file.h>
  26 #include <systools/win32/uwinapi.h>
  27 #include <sddl.h>
  28 #include <sal/macros.h>
  29 #include <sal/log.hxx>
  30 #include <o3tl/char16_t2wchar_t.hxx>
  31 #include "secimpl.hxx"
  32
  33 /* Data for use in (un)LoadProfile Functions */
  34 /* Declarations based on USERENV.H for Windows 2000 Beta 2 */
  35 #define PI_NOUI         0x00000001   // Prevents displaying of messages
  36
  37 typedef struct {
  38   DWORD    dwSize;          // Must be set to sizeof(PROFILEINFO)
  39   DWORD    dwFlags;         // See flags above
  40   LPWSTR   lpUserName;      // User name (required)
  41   LPWSTR   lpProfilePath;   // Roaming profile path
  42   LPWSTR   lpDefaultPath;   // Default user profile path
  43   LPWSTR   lpServerName;    // Validating DC name in netbios format
  44   LPWSTR   lpPolicyPath;    // Path to the NT4 style policy file
  45   HANDLE   hProfile;        // Registry key handle - filled by function
  46 } PROFILEINFOW, FAR * LPPROFILEINFOW;
  47
  48 /* Typedefs for function pointers in USERENV.DLL */
  49 typedef BOOL (STDMETHODCALLTYPE FAR * LPFNLOADUSERPROFILE) (
  50   HANDLE hToken,
  51   LPPROFILEINFOW lpProfileInfo
  52 );
  53
  54 typedef BOOL (STDMETHODCALLTYPE FAR * LPFNUNLOADUSERPROFILE) (
  55   HANDLE hToken,
  56   HANDLE hProfile
  57 );
  58
  59 typedef BOOL (STDMETHODCALLTYPE FAR * LPFNGETUSERPROFILEDIR) (
  60   HANDLE hToken,
  61   LPWSTR lpProfileDir,
  62   LPDWORD lpcchSize
  63 );
  64
  65 /* To get an impersonation token we need to create an impersonation
  66    duplicate so every access token has to be created with duplicate
  67    access rights */
  68
  69 #define TOKEN_DUP_QUERY (TOKEN_QUERY|TOKEN_DUPLICATE)
  70
  71 static bool GetSpecialFolder(rtl_uString **strPath,int nFolder);
  72 // We use LPCTSTR here, because we use it with SE_foo_NAME constants
  73 // which are defined in winnt.h as UNICODE-dependent TEXT("PrivilegeName")
  74 static BOOL Privilege(LPCTSTR pszPrivilege, BOOL bEnable);
  75 static bool getUserNameImpl(oslSecurity Security, rtl_uString **strName, bool bIncludeDomain);
  76
  77 oslSecurity SAL_CALL osl_getCurrentSecurity(void)
  78 {
  79     oslSecurityImpl* pSecImpl = static_cast<oslSecurityImpl *>(malloc(sizeof(oslSecurityImpl)));
  80     if (pSecImpl)
  81     {
  82         pSecImpl->m_pNetResource = nullptr;
  83         pSecImpl->m_User[0] = '\0';
  84         pSecImpl->m_hToken = nullptr;
  85         pSecImpl->m_hProfile = nullptr;
  86     }
  87     return pSecImpl;
  88 }
  89
  90 oslSecurityError SAL_CALL osl_loginUser( rtl_uString *strUserName, rtl_uString *strPasswd, oslSecurity *pSecurity )
  91 {
  92     oslSecurityError ret;
  93
  94     sal_Unicode*    strUser;
  95     sal_Unicode*    strDomain = o3tl::toU(_wcsdup(o3tl::toW(rtl_uString_getStr(strUserName))));
  96     HANDLE  hUserToken;
  97     LUID luid;
  98
  99     if (nullptr != (strUser = o3tl::toU(wcschr(o3tl::toW(strDomain), L'/'))))
 100         *strUser++ = L'\0';
 101     else
 102     {
 103         strUser   = strDomain;
 104         strDomain = nullptr;
 105     }
 106
 107     // this process must have the right: 'act as a part of operatingsystem'
 108     OSL_ASSERT(LookupPrivilegeValue(nullptr, SE_TCB_NAME, &luid));
 109     (void) luid;
 110
 111     if (LogonUserW(o3tl::toW(strUser), strDomain ? o3tl::toW(strDomain) : L"", o3tl::toW(rtl_uString_getStr(strPasswd)),
 112                   LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT,
 113                    &hUserToken))
 114     {
 115         oslSecurityImpl* pSecImpl = static_cast<oslSecurityImpl *>(malloc(sizeof(oslSecurityImpl)));
 116         if (pSecImpl)
 117         {
 118             pSecImpl->m_pNetResource = nullptr;
 119             pSecImpl->m_hToken = hUserToken;
 120             pSecImpl->m_hProfile = nullptr;
 121             wcscpy(o3tl::toW(pSecImpl->m_User), o3tl::toW(strUser));
 122         }
 123         *pSecurity = pSecImpl;
 124         ret = pSecImpl ? osl_Security_E_None : osl_Security_E_Unknown;
 125     }
 126     else
 127     {
 128         ret = osl_Security_E_UserUnknown;
 129     }
 130
 131     if (strDomain)
 132         free(strDomain);
 133     else
 134         free(strUser);
 135
 136     return ret;
 137 }
 138
 139 oslSecurityError SAL_CALL osl_loginUserOnFileServer(rtl_uString *strUserName,
 140                                                     rtl_uString *strPasswd,
 141                                                     rtl_uString *strFileServer,
 142                                                     oslSecurity *pSecurity)
 143 {
 144     oslSecurityError    ret;
 145     DWORD               err;
 146     NETRESOURCEW        netResource;
 147     sal_Unicode*                remoteName;
 148     sal_Unicode*                userName;
 149
 150     remoteName  = static_cast<sal_Unicode *>(malloc((rtl_uString_getLength(strFileServer) + rtl_uString_getLength(strUserName) + 4) * sizeof(sal_Unicode)));
 151     userName    = static_cast<sal_Unicode *>(malloc((rtl_uString_getLength(strFileServer) + rtl_uString_getLength(strUserName) + 2) * sizeof(sal_Unicode)));
 152
 153     wcscpy(o3tl::toW(remoteName), L"\\\\");
 154     wcscat(o3tl::toW(remoteName), o3tl::toW(rtl_uString_getStr(strFileServer)));
 155     wcscat(o3tl::toW(remoteName), L"\\");
 156     wcscat(o3tl::toW(remoteName), o3tl::toW(rtl_uString_getStr(strUserName)));
 157
 158     wcscpy(o3tl::toW(userName), o3tl::toW(rtl_uString_getStr(strFileServer)));
 159     wcscat(o3tl::toW(userName), L"\\");
 160     wcscat(o3tl::toW(userName), o3tl::toW(rtl_uString_getStr(strUserName)));
 161
 162     netResource.dwScope         = RESOURCE_GLOBALNET;
 163     netResource.dwType          = RESOURCETYPE_DISK;
 164     netResource.dwDisplayType   = RESOURCEDISPLAYTYPE_SHARE;
 165     netResource.dwUsage         = RESOURCEUSAGE_CONNECTABLE;
 166     netResource.lpLocalName     = nullptr;
 167     netResource.lpRemoteName    = o3tl::toW(remoteName);
 168     netResource.lpComment       = nullptr;
 169     netResource.lpProvider      = nullptr;
 170
 171     err = WNetAddConnection2W(&netResource, o3tl::toW(rtl_uString_getStr(strPasswd)), o3tl::toW(userName), 0);
 172
 173     if ((err == NO_ERROR) || (err == ERROR_ALREADY_ASSIGNED))
 174     {
 175         oslSecurityImpl* pSecImpl = static_cast<oslSecurityImpl *>(malloc(sizeof(oslSecurityImpl)));
 176         if (pSecImpl)
 177         {
 178             pSecImpl->m_pNetResource = static_cast<NETRESOURCEW *>(malloc(sizeof(NETRESOURCE)));
 179             if (pSecImpl->m_pNetResource)
 180             {
 181                 *pSecImpl->m_pNetResource = netResource;
 182                 pSecImpl->m_hToken = nullptr;
 183                 pSecImpl->m_hProfile = nullptr;
 184                 wcscpy(o3tl::toW(pSecImpl->m_User), o3tl::toW(rtl_uString_getStr(strUserName)));
 185             }
 186             else
 187             {
 188                 free(pSecImpl);
 189                 pSecImpl = nullptr;
 190             }
 191         }
 192         *pSecurity = pSecImpl;
 193
 194         ret = pSecImpl ? osl_Security_E_None : osl_Security_E_Unknown;
 195     }
 196     else
 197     {
 198         ret = osl_Security_E_UserUnknown;
 199     }
 200
 201     free(remoteName);
 202     free(userName);
 203
 204     return ret;
 205 }
 206
 207 sal_Bool SAL_CALL osl_isAdministrator(oslSecurity Security)
 208 {
 209     if (Security != nullptr)
 210     {
 211         HANDLE                      hImpersonationToken = nullptr;
 212         PSID                        psidAdministrators;
 213         SID_IDENTIFIER_AUTHORITY    siaNtAuthority = { SECURITY_NT_AUTHORITY };
 214         bool                    bSuccess = false;
 215
 216         /* If Security contains an access token we need to duplicate it to an impersonation
 217            access token. NULL works with CheckTokenMembership() as the current effective
 218            impersonation token
 219          */
 220
 221         if ( static_cast<oslSecurityImpl*>(Security)->m_hToken )
 222         {
 223             if ( !DuplicateToken (static_cast<oslSecurityImpl*>(Security)->m_hToken, SecurityImpersonation, &hImpersonationToken) )
 224                 return false;
 225         }
 226
 227         /* CheckTokenMembership() can be used on W2K and higher (NT4 no longer supported by OOo)
 228            and also works on Vista to retrieve the effective user rights. Just checking for
 229            membership of Administrators group is not enough on Vista this would require additional
 230            complicated checks as described in KB article Q118626: http://support.microsoft.com/kb/118626/en-us
 231         */
 232
 233         if (AllocateAndInitializeSid(&siaNtAuthority,
 234                                      2,
 235                                      SECURITY_BUILTIN_DOMAIN_RID,
 236                                      DOMAIN_ALIAS_RID_ADMINS,
 237                                      0, 0, 0, 0, 0, 0,
 238                                      &psidAdministrators))
 239         {
 240             BOOL fSuccess = FALSE;
 241
 242             if (CheckTokenMembership(hImpersonationToken, psidAdministrators, &fSuccess) && fSuccess)
 243                 bSuccess = true;
 244
 245             FreeSid(psidAdministrators);
 246         }
 247
 248         if (hImpersonationToken)
 249             CloseHandle(hImpersonationToken);
 250
 251         return bSuccess;
 252     }
 253     else
 254     {
 255         return false;
 256     }
 257 }
 258
 259 void SAL_CALL osl_freeSecurityHandle(oslSecurity Security)
 260 {
 261     if (Security)
 262     {
 263         oslSecurityImpl *pSecImpl = static_cast<oslSecurityImpl*>(Security);
 264
 265         if (pSecImpl->m_pNetResource != nullptr)
 266         {
 267             WNetCancelConnection2W(pSecImpl->m_pNetResource->lpRemoteName, 0, true);
 268
 269             free(pSecImpl->m_pNetResource->lpRemoteName);
 270             free(pSecImpl->m_pNetResource);
 271         }
 272
 273         if (pSecImpl->m_hToken)
 274             CloseHandle(pSecImpl->m_hToken);
 275
 276         if ( pSecImpl->m_hProfile )
 277             CloseHandle(pSecImpl->m_hProfile);
 278
 279         free (pSecImpl);
 280     }
 281 }
 282
 283 sal_Bool SAL_CALL osl_getUserIdent(oslSecurity Security, rtl_uString **strIdent)
 284 {
 285     if (Security != nullptr)
 286     {
 287         oslSecurityImpl *pSecImpl = static_cast<oslSecurityImpl*>(Security);
 288
 289         HANDLE hAccessToken = pSecImpl->m_hToken;
 290
 291         if (hAccessToken == nullptr)
 292             OpenProcessToken(GetCurrentProcess(), TOKEN_DUP_QUERY, &hAccessToken);
 293
 294         if (hAccessToken)
 295         {
 296             DWORD  nInfoBuffer = 512;
 297             UCHAR* pInfoBuffer = static_cast<UCHAR *>(malloc(nInfoBuffer));
 298
 299             while (!GetTokenInformation(hAccessToken, TokenUser,
 300                                            pInfoBuffer, nInfoBuffer, &nInfoBuffer))
 301             {
 302                 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
 303                 {
 304                     if (auto p = static_cast<UCHAR *>(realloc(pInfoBuffer, nInfoBuffer)))
 305                         pInfoBuffer = p;
 306                     else
 307                     {
 308                         free(pInfoBuffer);
 309                         pInfoBuffer = nullptr;
 310                         break;
 311                     }
 312                 }
 313                 else
 314                 {
 315                     free(pInfoBuffer);
 316                     pInfoBuffer = nullptr;
 317                     break;
 318                 }
 319             }
 320
 321             if (pSecImpl->m_hToken == nullptr)
 322                 CloseHandle(hAccessToken);
 323
 324             if (pInfoBuffer)
 325             {
 326                 PSID pSid = reinterpret_cast<PTOKEN_USER>(pInfoBuffer)->User.Sid;
 327
 328                 LPWSTR pSidStr = nullptr;
 329                 BOOL bResult = ConvertSidToStringSidW(pSid, &pSidStr);
 330                 if (bResult)
 331                 {
 332                     rtl_uString_newFromStr(strIdent, o3tl::toU(pSidStr));
 333                     LocalFree(pSidStr);
 334                 }
 335                 else
 336                 {
 337                     const DWORD dwError = GetLastError();
 338                     SAL_WARN(
 339                         "sal.osl",
 340                         "ConvertSidToStringSidW failed. GetLastError returned: " << dwError);
 341                 }
 342
 343                 free(pInfoBuffer);
 344
 345                 return bResult != FALSE;
 346             }
 347         }
 348         else
 349         {
 350             DWORD needed = 0;
 351
 352             WNetGetUserW(nullptr, nullptr, &needed);
 353             if (needed < 16)
 354                 needed = 16;
 355
 356             if (auto Ident = static_cast<sal_Unicode *>(malloc(needed*sizeof(sal_Unicode))))
 357             {
 358                 if (WNetGetUserW(nullptr, o3tl::toW(Ident), &needed) != NO_ERROR)
 359                 {
 360                     wcscpy(o3tl::toW(Ident), L"unknown");
 361                     Ident[7] = L'\0';
 362                 }
 363
 364                 rtl_uString_newFromStr( strIdent, Ident);
 365                 free(Ident);
 366                 return true;
 367             }
 368         }
 369     }
 370
 371     return false;
 372 }
 373
 374 sal_Bool SAL_CALL osl_getUserName(oslSecurity Security, rtl_uString **strName)
 375 {
 376     return getUserNameImpl(Security, strName, true);
 377 }
 378
 379 sal_Bool SAL_CALL osl_getShortUserName(oslSecurity Security, rtl_uString **strName)
 380 {
 381     return getUserNameImpl(Security, strName, false);
 382 }
 383
 384 sal_Bool SAL_CALL osl_getHomeDir(oslSecurity Security, rtl_uString **pustrDirectory)
 385 {
 386     rtl_uString *ustrSysDir = nullptr;
 387     bool    bSuccess = false;
 388
 389     if (Security != nullptr)
 390     {
 391         oslSecurityImpl *pSecImpl = static_cast<oslSecurityImpl*>(Security);
 392
 393         if (pSecImpl->m_pNetResource != nullptr)
 394         {
 395             rtl_uString_newFromStr( &ustrSysDir, o3tl::toU(pSecImpl->m_pNetResource->lpRemoteName));
 396
 397             bSuccess = osl_File_E_None == osl_getFileURLFromSystemPath( ustrSysDir, pustrDirectory );
 398         }
 399         else
 400         {
 401                 bSuccess = GetSpecialFolder(&ustrSysDir, CSIDL_PERSONAL) &&
 402                                      (osl_File_E_None == osl_getFileURLFromSystemPath(ustrSysDir, pustrDirectory));
 403         }
 404     }
 405
 406     if ( ustrSysDir )
 407         rtl_uString_release( ustrSysDir );
 408
 409     return bSuccess;
 410 }
 411
 412 sal_Bool SAL_CALL osl_getConfigDir(oslSecurity Security, rtl_uString **pustrDirectory)
 413 {
 414     bool bSuccess = false;
 415
 416     if (Security != nullptr)
 417     {
 418         oslSecurityImpl *pSecImpl = static_cast<oslSecurityImpl*>(Security);
 419
 420         if (pSecImpl->m_pNetResource != nullptr)
 421         {
 422             rtl_uString *ustrSysDir = nullptr;
 423
 424             rtl_uString_newFromStr( &ustrSysDir, o3tl::toU(pSecImpl->m_pNetResource->lpRemoteName));
 425             bSuccess = osl_File_E_None == osl_getFileURLFromSystemPath( ustrSysDir, pustrDirectory);
 426
 427             if ( ustrSysDir )
 428                 rtl_uString_release( ustrSysDir );
 429         }
 430         else
 431         {
 432             if (pSecImpl->m_hToken)
 433             {
 434                 /* not implemented */
 435                 OSL_ASSERT(false);
 436             }
 437             else
 438             {
 439                 rtl_uString *ustrFile = nullptr;
 440                 sal_Unicode sFile[_MAX_PATH];
 441
 442                 if ( !GetSpecialFolder( &ustrFile, CSIDL_APPDATA) )
 443                 {
 444                     OSL_VERIFY(GetWindowsDirectoryW(o3tl::toW(sFile), _MAX_DIR) > 0);
 445
 446                     rtl_uString_newFromStr( &ustrFile, sFile);
 447                 }
 448
 449                 bSuccess = osl_File_E_None == osl_getFileURLFromSystemPath(ustrFile, pustrDirectory);
 450
 451                 if ( ustrFile )
 452                     rtl_uString_release( ustrFile );
 453             }
 454         }
 455     }
 456
 457     return bSuccess;
 458 }
 459
 460 sal_Bool SAL_CALL osl_loadUserProfile(oslSecurity Security)
 461 {
 462     /*  CreateProcessAsUser does not load the specified user's profile
 463         into the HKEY_USERS registry key. This means that access to information
 464         in the HKEY_CURRENT_USER registry key may not produce results consistent
 465         with a normal interactive logon.
 466         It is your responsibility to load the user's registry hive into HKEY_USERS
 467         with the LoadUserProfile function before calling CreateProcessAsUser.
 468     */
 469     bool bOk = false;
 470
 471     RegCloseKey(HKEY_CURRENT_USER);
 472
 473     if (Privilege(SE_RESTORE_NAME, TRUE))
 474     {
 475         HMODULE                 hUserEnvLib         = nullptr;
 476         LPFNLOADUSERPROFILE     fLoadUserProfile    = nullptr;
 477         LPFNUNLOADUSERPROFILE   fUnloadUserProfile  = nullptr;
 478         HANDLE                  hAccessToken        = static_cast<oslSecurityImpl*>(Security)->m_hToken;
 479
 480         /* try to create user profile */
 481         if ( !hAccessToken )
 482         {
 483             /* retrieve security handle if not done before e.g. osl_getCurrentSecurity()
 484             */
 485             HANDLE hProcess = GetCurrentProcess();
 486
 487             if (hProcess != nullptr)
 488             {
 489                 OpenProcessToken(hProcess, TOKEN_IMPERSONATE, &hAccessToken);
 490                 CloseHandle(hProcess);
 491             }
 492         }
 493
 494         hUserEnvLib = LoadLibraryW(L"userenv.dll");
 495
 496         if (hUserEnvLib)
 497         {
 498             fLoadUserProfile = reinterpret_cast<LPFNLOADUSERPROFILE>(GetProcAddress(hUserEnvLib, "LoadUserProfileW"));
 499             fUnloadUserProfile = reinterpret_cast<LPFNUNLOADUSERPROFILE>(GetProcAddress(hUserEnvLib, "UnloadUserProfile"));
 500
 501             if (fLoadUserProfile && fUnloadUserProfile)
 502             {
 503                 rtl_uString *buffer = nullptr;
 504                 PROFILEINFOW pi;
 505
 506                 getUserNameImpl(Security, &buffer, false);
 507
 508                 ZeroMemory(&pi, sizeof(pi));
 509                 pi.dwSize = sizeof(pi);
 510                 pi.lpUserName = o3tl::toW(rtl_uString_getStr(buffer));
 511                 pi.dwFlags = PI_NOUI;
 512
 513                 if (fLoadUserProfile(hAccessToken, &pi))
 514                 {
 515                     fUnloadUserProfile(hAccessToken, pi.hProfile);
 516
 517                     bOk = true;
 518                 }
 519
 520                 rtl_uString_release(buffer);
 521             }
 522
 523             FreeLibrary(hUserEnvLib);
 524         }
 525
 526         if (hAccessToken && (hAccessToken != static_cast<oslSecurityImpl*>(Security)->m_hToken))
 527             CloseHandle(hAccessToken);
 528     }
 529
 530     return bOk;
 531 }
 532
 533 void SAL_CALL osl_unloadUserProfile(oslSecurity Security)
 534 {
 535     if ( static_cast<oslSecurityImpl*>(Security)->m_hProfile != nullptr )
 536     {
 537         HMODULE                 hUserEnvLib         = nullptr;
 538         LPFNUNLOADUSERPROFILE   fUnloadUserProfile  = nullptr;
 539         HANDLE                  hAccessToken        = static_cast<oslSecurityImpl*>(Security)->m_hToken;
 540
 541         if ( !hAccessToken )
 542         {
 543             /* retrieve security handle if not done before e.g. osl_getCurrentSecurity()
 544             */
 545             HANDLE hProcess = GetCurrentProcess();
 546
 547             if (hProcess != nullptr)
 548             {
 549                 OpenProcessToken(hProcess, TOKEN_IMPERSONATE, &hAccessToken);
 550                 CloseHandle(hProcess);
 551             }
 552         }
 553
 554         hUserEnvLib = LoadLibraryW(L"userenv.dll");
 555
 556         if (hUserEnvLib)
 557         {
 558             fUnloadUserProfile = reinterpret_cast<LPFNUNLOADUSERPROFILE>(GetProcAddress(hUserEnvLib, "UnloadUserProfile"));
 559
 560             if (fUnloadUserProfile)
 561             {
 562                 /* unloading the user profile */
 563                 fUnloadUserProfile(hAccessToken, static_cast<oslSecurityImpl*>(Security)->m_hProfile);
 564             }
 565
 566             FreeLibrary(hUserEnvLib);
 567         }
 568
 569         static_cast<oslSecurityImpl*>(Security)->m_hProfile = nullptr;
 570
 571         if (hAccessToken && (hAccessToken != static_cast<oslSecurityImpl*>(Security)->m_hToken))
 572             CloseHandle(hAccessToken);
 573     }
 574 }
 575
 576 static bool GetSpecialFolder(rtl_uString **strPath, int nFolder)
 577 {
 578     bool bRet = false;
 579     HINSTANCE hLibrary = LoadLibraryW(L"shell32.dll");
 580
 581     if (hLibrary != nullptr)
 582     {
 583         sal_Unicode PathW[_MAX_PATH];
 584         BOOL (WINAPI *pSHGetSpecialFolderPathW)(HWND, LPWSTR, int, BOOL) = reinterpret_cast<BOOL (WINAPI *)(HWND, LPWSTR, int, BOOL)>(GetProcAddress(hLibrary, "SHGetSpecialFolderPathW"));
 585
 586         if (pSHGetSpecialFolderPathW)
 587         {
 588             if (pSHGetSpecialFolderPathW(GetActiveWindow(), o3tl::toW(PathW), nFolder, TRUE))
 589             {
 590                 rtl_uString_newFromStr( strPath, PathW);
 591                 bRet = true;
 592             }
 593         }
 594         else
 595         {
 596             HRESULT (WINAPI *pSHGetSpecialFolderLocation)(HWND, int, LPITEMIDLIST *) = reinterpret_cast<HRESULT (WINAPI *)(HWND, int, LPITEMIDLIST *)>(GetProcAddress(hLibrary, "SHGetSpecialFolderLocation"));
 597             BOOL (WINAPI *pSHGetPathFromIDListW)(LPCITEMIDLIST, LPWSTR) = reinterpret_cast<BOOL (WINAPI *)(LPCITEMIDLIST, LPWSTR)>(GetProcAddress(hLibrary, "SHGetPathFromIDListW"));
 598             HRESULT (WINAPI *pSHGetMalloc)(LPMALLOC *) = reinterpret_cast<HRESULT (WINAPI *)(LPMALLOC *)>(GetProcAddress(hLibrary, "SHGetMalloc"));
 599
 600             if (pSHGetSpecialFolderLocation && pSHGetPathFromIDListW && pSHGetMalloc )
 601             {
 602                 LPITEMIDLIST pidl;
 603                 LPMALLOC pMalloc;
 604                 HRESULT  hr;
 605
 606                 hr = pSHGetSpecialFolderLocation(GetActiveWindow(), nFolder, &pidl);
 607
 608                 /* Get SHGetSpecialFolderLocation fails if directory does not exists. */
 609                 /* If it fails we try to create the directory and redo the call */
 610                 if (! SUCCEEDED(hr))
 611                 {
 612                     HKEY hRegKey;
 613
 614                     if (RegOpenKeyW(HKEY_CURRENT_USER,
 615                                    L"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",
 616                                    &hRegKey) == ERROR_SUCCESS)
 617                     {
 618                         LONG lRet;
 619                         DWORD lSize = sizeof(PathW);
 620                         DWORD Type = REG_SZ;
 621
 622                         switch (nFolder)
 623                         {
 624                             case CSIDL_APPDATA:
 625                                 lRet = RegQueryValueExW(hRegKey, L"AppData", nullptr, &Type, reinterpret_cast<LPBYTE>(PathW), &lSize);
 626                                   break;
 627
 628                             case CSIDL_PERSONAL:
 629                                 lRet = RegQueryValueExW(hRegKey, L"Personal", nullptr, &Type, reinterpret_cast<LPBYTE>(PathW), &lSize);
 630                                 break;
 631
 632                             default:
 633                                 lRet = -1l;
 634                         }
 635
 636                         if ((lRet == ERROR_SUCCESS) && (Type == REG_SZ))
 637                         {
 638                             if (_waccess(o3tl::toW(PathW), 0) < 0)
 639                                 CreateDirectoryW(o3tl::toW(PathW), nullptr);
 640
 641                                hr = pSHGetSpecialFolderLocation(GetActiveWindow(), nFolder, &pidl);
 642                         }
 643
 644                         RegCloseKey(hRegKey);
 645                     }
 646                 }
 647
 648                 if (SUCCEEDED(hr))
 649                 {
 650                     if (pSHGetPathFromIDListW(pidl, o3tl::toW(PathW)))
 651                     {
 652                         /* if directory does not exist, create it */
 653                         if (_waccess(o3tl::toW(PathW), 0) < 0)
 654                             CreateDirectoryW(o3tl::toW(PathW), nullptr);
 655
 656                         rtl_uString_newFromStr( strPath, PathW);
 657                         bRet = true;
 658                     }
 659                 }
 660
 661                 if (SUCCEEDED(pSHGetMalloc(&pMalloc)))
 662                 {
 663                     pMalloc->Free(pidl);
 664                     pMalloc->Release();
 665                 }
 666             }
 667         }
 668
 669         FreeLibrary(hLibrary);
 670     }
 671
 672     return bRet;
 673 }
 674
 675 // We use LPCTSTR here, because we use it with SE_foo_NAME constants
 676 // which are defined in winnt.h as UNICODE-dependent TEXT("PrivilegeName")
 677 static BOOL Privilege(LPCTSTR strPrivilege, BOOL bEnable)
 678 {
 679     HANDLE           hToken;
 680     TOKEN_PRIVILEGES tp;
 681
 682     // obtain the processes token
 683     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_DUP_QUERY, &hToken))
 684         return FALSE;
 685
 686     // get the luid
 687     if (!LookupPrivilegeValue(nullptr, strPrivilege, &tp.Privileges[0].Luid))
 688         return FALSE;
 689
 690     tp.PrivilegeCount = 1;
 691
 692     if (bEnable)
 693         tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
 694     else
 695         tp.Privileges[0].Attributes = 0;
 696
 697     // enable or disable the privilege
 698     if (!AdjustTokenPrivileges(hToken, FALSE, &tp, 0, nullptr, nullptr))
 699         return FALSE;
 700
 701     if (!CloseHandle(hToken))
 702         return FALSE;
 703
 704     return TRUE;
 705 }
 706
 707 static bool getUserNameImpl(oslSecurity Security, rtl_uString **strName,  bool bIncludeDomain)
 708 {
 709     if (Security != nullptr)
 710     {
 711         oslSecurityImpl *pSecImpl = static_cast<oslSecurityImpl*>(Security);
 712
 713         HANDLE hAccessToken = pSecImpl->m_hToken;
 714
 715         if (hAccessToken == nullptr)
 716             OpenProcessToken(GetCurrentProcess(), TOKEN_DUP_QUERY, &hAccessToken);
 717
 718         if (hAccessToken)
 719         {
 720             DWORD  nInfoBuffer = 512;
 721             UCHAR* pInfoBuffer = static_cast<UCHAR *>(malloc(nInfoBuffer));
 722
 723             while (!GetTokenInformation(hAccessToken, TokenUser,
 724                                            pInfoBuffer, nInfoBuffer, &nInfoBuffer))
 725             {
 726                 if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
 727                 {
 728                     if (auto p = static_cast<UCHAR *>(realloc(pInfoBuffer, nInfoBuffer)))
 729                         pInfoBuffer = p;
 730                     else
 731                     {
 732                         free(pInfoBuffer);
 733                         pInfoBuffer = nullptr;
 734                         break;
 735                     }
 736                 }
 737                 else
 738                 {
 739                     free(pInfoBuffer);
 740                     pInfoBuffer = nullptr;
 741                     break;
 742                 }
 743             }
 744
 745             if (pSecImpl->m_hToken == nullptr)
 746                 CloseHandle(hAccessToken);
 747
 748             if (pInfoBuffer)
 749             {
 750                 sal_Unicode  UserName[128];
 751                 sal_Unicode  DomainName[128];
 752                 sal_Unicode  Name[257];
 753                 DWORD nUserName   = SAL_N_ELEMENTS(UserName);
 754                 DWORD nDomainName = SAL_N_ELEMENTS(DomainName);
 755                 SID_NAME_USE sUse;
 756
 757                 if (LookupAccountSidW(nullptr, reinterpret_cast<PTOKEN_USER>(pInfoBuffer)->User.Sid,
 758                                         o3tl::toW(UserName), &nUserName,
 759                                         o3tl::toW(DomainName), &nDomainName, &sUse))
 760                 {
 761                     if (bIncludeDomain)
 762                     {
 763                         wcscpy(o3tl::toW(Name), o3tl::toW(DomainName));
 764                         wcscat(o3tl::toW(Name), L"/");
 765                         wcscat(o3tl::toW(Name), o3tl::toW(UserName));
 766                     }
 767                     else
 768                     {
 769                         wcscpy(o3tl::toW(Name), o3tl::toW(UserName));
 770                     }
 771
 772                     rtl_uString_newFromStr(strName, Name);
 773                     free(pInfoBuffer);
 774                     return true;
 775                 }
 776             }
 777         }
 778         else
 779         {
 780             DWORD needed=0;
 781             sal_Unicode *pNameW=nullptr;
 782
 783             WNetGetUserW(nullptr, nullptr, &needed);
 784             pNameW = static_cast<sal_Unicode *>(malloc (needed*sizeof(sal_Unicode)));
 785
 786             if (WNetGetUserW(nullptr, o3tl::toW(pNameW), &needed) == NO_ERROR)
 787             {
 788                 rtl_uString_newFromStr( strName, pNameW);
 789
 790                 if (pNameW)
 791                     free(pNameW);
 792                 return true;
 793             }
 794             else if (pSecImpl->m_User[0] != '\0')
 795             {
 796                 rtl_uString_newFromStr(strName, o3tl::toU(pSecImpl->m_pNetResource->lpRemoteName));
 797
 798                 if (pNameW)
 799                     free(pNameW);
 800
 801                 return true;
 802             }
 803
 804             if (pNameW)
 805                 free(pNameW);
 806         }
 807     }
 808
 809     return false;
 810 }
 811
 812 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */