From bae8ff5eb02155309b0a12571a7b6a147bc8ec56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean=20Charles=20Del=C3=A9pine?= <delepine@u-picardie.fr>
Date: Wed, 15 Jul 2026 21:41:10 +0200
Subject: [PATCH] fix(auth): merge IMP login params independently of auth
 driver

LoginService::buildLoginFormData() and login.php's equivalent inline
code only resolved extra login form fields (e.g. IMP's server
selector) through the primary Horde auth driver instance. With
auth.driver = 'application' pointed at imp, this worked because
'horde' auth delegates directly to 'imp'. With any other driver
(LDAP, SQL, etc.), IMP's authLoginParams() was never consulted,
silently dropping the server selector even when
$conf['server']['server_list'] = 'shown'.

Both login.php and LoginService now additionally resolve IMP's login
params via the new 'loginparams' auth capability (see horde/imp),
independently of which driver authenticates the user to Horde itself.
---
 login.php                    | 14 ++++++++++++++
 src/Service/LoginService.php | 17 +++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/login.php b/login.php
index 67f844bf..9f81e665 100644
--- a/login.php
+++ b/login.php
@@ -368,6 +368,20 @@ function _addAnchor($url, $type, $vars, $url_anchor = null)
 } catch (Horde_Exception $e) {
 }
 
+// IMP declares extra login params (e.g. server selector) via the
+// 'loginparams' auth capability. Merge these independently of the
+// primary Horde auth driver.
+try {
+    $impAuth = $injector->getInstance('Horde_Core_Factory_Auth')->create('imp');
+    if ($impAuth->hasCapability('loginparams')) {
+        $impResult = $impAuth->getLoginParams();
+        $loginparams = array_filter(array_merge($loginparams, $impResult['params'] ?? []));
+        $js_code = array_merge($js_code, $impResult['js_code'] ?? []);
+        $js_files = array_merge($js_files, $impResult['js_files'] ?? []);
+    }
+} catch (\Throwable $e) {
+}
+
 /* If we currently are authenticated, and are not trying to authenticate to
  * an application, redirect to initial page. This is done in index.php.
  * If we are trying to authenticate to an application, but don't have to,
diff --git a/src/Service/LoginService.php b/src/Service/LoginService.php
index c8b1c5af..0c21e923 100644
--- a/src/Service/LoginService.php
+++ b/src/Service/LoginService.php
@@ -114,6 +114,23 @@ public function buildLoginFormData(
             // No backend-specific params
         }
 
+        // IMP declares extra login params (e.g. server selector) via the
+        // 'loginparams' auth capability. Merge these independently of the
+        // primary Horde auth driver, so the server list still appears when
+        // Horde authenticates via LDAP/etc. rather than the 'application'
+        // driver pointed at IMP.
+        try {
+            $impAuth = $this->injector->getInstance('Horde_Core_Factory_Auth')->create('imp');
+            if ($impAuth->hasCapability('loginparams')) {
+                $impResult = $impAuth->getLoginParams();
+                $loginparams = array_filter(array_merge($loginparams, $impResult['params'] ?? []));
+                $jsCode = array_merge($jsCode, $impResult['js_code'] ?? []);
+                $jsFiles = array_merge($jsFiles, $impResult['js_files'] ?? []);
+            }
+        } catch (\Throwable $e) {
+            // IMP not installed, or no extra login params
+        }
+
         // Mode selector
         $modeSelector = '';
         if (!empty($this->conf['user']['select_view'])) {