upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-03-04 06:21:07 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 14

Merge pull request #37201 from AaronDewes/fix/ldap-filter-generation

Browse source 
Fix: Escape group names for LDAP
This commit is contained in:
Côme Chilliet 2023-10-02 09:49:22 +02:00 committed by GitHub
commit 9ebcd287ef
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
apps/user_ldap/lib/Access.php
View file

@ -1421,9 +1421,7 @@ class Access extends LDAPUtility {
$asterisk = '*';
$input = mb_substr($input, 1, null, 'UTF-8');
}
$search = ['*', '\\', '(', ')'];
$replace = ['\\*', '\\\\', '\\(', '\\)'];
return $asterisk . str_replace($search, $replace, $input);
return $asterisk . ldap_escape($input, '', LDAP_ESCAPE_FILTER);
}
/**

12
apps/user_ldap/lib/Wizard.php
View file

@ -909,7 +909,7 @@ class Wizard extends LDAPUtility {
if (is_array($objcs) && count($objcs) > 0) {
$filter .= '(|';
foreach ($objcs as $objc) {
$filter .= '(objectclass=' . $objc . ')';
$filter .= '(objectclass=' . ldap_escape($objc, '', LDAP_ESCAPE_FILTER) . ')';
}
$filter .= ')';
$parts++;
@ -925,7 +925,7 @@ class Wizard extends LDAPUtility {
}
$base = $this->configuration->ldapBase[0];
foreach ($cns as $cn) {
$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
$rr = $this->ldap->search($cr, $base, 'cn=' . ldap_escape($cn, '', LDAP_ESCAPE_FILTER), ['dn', 'primaryGroupToken']);
if (!$this->ldap->isResource($rr)) {
continue;
}
@ -936,10 +936,10 @@ class Wizard extends LDAPUtility {
if ($dn === false || $dn === '') {
continue;
}
$filterPart = '(memberof=' . $dn . ')';
$filterPart = '(memberof=' . ldap_escape($dn, '', LDAP_ESCAPE_FILTER) . ')';
if (isset($attrs['primaryGroupToken'])) {
$pgt = $attrs['primaryGroupToken'][0];
$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
$primaryFilterPart = '(primaryGroupID=' . ldap_escape($pgt, '', LDAP_ESCAPE_FILTER) .')';
$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
}
$filter .= $filterPart;
@ -963,7 +963,7 @@ class Wizard extends LDAPUtility {
if (is_array($objcs) && count($objcs) > 0) {
$filter .= '(|';
foreach ($objcs as $objc) {
$filter .= '(objectclass=' . $objc . ')';
$filter .= '(objectclass=' . ldap_escape($objc, '', LDAP_ESCAPE_FILTER) . ')';
}
$filter .= ')';
$parts++;
@ -973,7 +973,7 @@ class Wizard extends LDAPUtility {
if (is_array($cns) && count($cns) > 0) {
$filter .= '(|';
foreach ($cns as $cn) {
$filter .= '(cn=' . $cn . ')';
$filter .= '(cn=' . ldap_escape($cn, '', LDAP_ESCAPE_FILTER) . ')';
}
$filter .= ')';
}

4
apps/user_ldap/tests/AccessTest.php
View file

@ -137,13 +137,13 @@ class AccessTest extends TestCase {
public function testEscapeFilterPartEscapeWildcard() {
$input = '*';
$expected = '\\\\*';
$expected = '\\2a';
$this->assertTrue($expected === $this->access->escapeFilterPart($input));
}
public function testEscapeFilterPartEscapeWildcard2() {
$input = 'foo*bar';
$expected = 'foo\\\\*bar';
$expected = 'foo\\2abar';
$this->assertTrue($expected === $this->access->escapeFilterPart($input));
}