Repository navigation
ldap_modify: no way to unset single valued attribute any more #21262
Description
Description
The following code:
<?php
$ds = ldap_bind(...);
$dn = '....';
$entry = ['personalTitle' => []]))
try {
if (ldap_modify($ds, $dn, $entry)) {
echo "success";
}
}
catch (\ValueError $e) {
echo $e->getMessage();
}Resulted in this output:
ldap_modify(): Argument #3 ($entry) attribute "url" must be a non-empty list of attribute values
But I expected this output instead:
success
Using an empty array is the documented way to unset both single- and multi-valued attributes.
Trying NULL for single-valued attributes also gives a php-side validation error, so this is also not working.
It was nice to have a way to unset attributes without knowing if they are single- or multi-values, but I could also live with two separate ways, thought there should be at least one (documented) way to unset single-valued attributes with ldap_modify too.
PHP Version
PHP 8.5.3 (cli) (built: Feb 13 2026 15:52:21) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.5.3, Copyright (c) Zend Technologies
with Xdebug v3.5.0, Copyright (c) 2002-2025, by Derick Rethans
with Zend OPcache v8.5.3, Copyright (c), by Zend Technologies
Operating System
Ubuntu 24.04 in a Docker container
Activity
ralfbecker commentedon Feb 20, 2026
Wired thing the above mentioned error is also given when I set multi-valued attributes like ActiveDirectory's "description" to an empty array().
I also tried setting an empty string "" instead, that triggers no php-side validation errors, but an LDAP server-side error :(
I'll try downgrading PHP now, so see when that was broken.
Ralf
ralfbecker commentedon Feb 20, 2026
Ok, unsetting single- or multi-values attributes via setting them to an empty array still work with the latest PHP 8.4:
Ralf
sircubbi commentedon Feb 20, 2026
I too justed stumbled over this problem after updating our systems from PHP 8.3 to 8.5 yesterday. There is no mention of this change in the release notes, so I didn't catch the problem beforehand.
Reviewing the code this change was introduced in 9e91810 some 16 months ago. That commit mentions no reason for the change, nor was the documentation updated.
sircubbi commentedon Feb 20, 2026
null-values are not allowed (by PHP-validation), empty-strings don't work (by LDAP-validation) and an array with any empty-string also not (by LDAP-validation).However, while trying with
nullI got this error:TypeError: LDAP value must be of type string|int|bool, null given. So it seems a boolean is possible. And from my first testing setting the value tofalseactually seems to work.Fix phpGH-21262: ldap_modify() too strict controls argument validation.
ralfbecker commentedon Feb 22, 2026
@devnexen Thanks for taking care of that so quickly. I'll change EGroupware's Docker images to use PHP 8.4 until this is merged and released.
Ralf
Merge branch 'PHP-8.5'
Fix GH-21262: ldap_modify() too strict controls argument validation.
conf(php): we support PHP 8.5 only if greater > 8.5.4