upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-22 07:00:02 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Merge pull request #61320 from nextcloud/fix/escape-ldap-members-in-filter

Browse source 
fix(user_ldap): Escape filter part when searching for group members
This commit is contained in:
Côme Chilliet 2026-06-16 12:30:01 +02:00 committed by GitHub
commit eccffd03e8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
apps/user_ldap/lib/Group_LDAP.php
View file

@ -120,7 +120,7 @@ class Group_LDAP extends ABackend implements GroupInterface, IGroupLDAP, IGetDis
$parts = explode('@', $mid); //making sure we get only the uid
$mid = $parts[0];
}
$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
$filter = str_replace('%uid', $this->access->escapeFilterPart($mid), $this->access->connection->ldapLoginFilter);
$filterParts[] = $filter;
$bytes += strlen($filter);
if ($bytes >= 9000000) {
@ -921,7 +921,7 @@ class Group_LDAP extends ABackend implements GroupInterface, IGroupLDAP, IGetDis
case 'memberuid':
//we got uids, need to get their DNs to 'translate' them to user names
$filter = $this->access->combineFilterWithAnd([
str_replace('%uid', trim($member), $this->access->connection->ldapLoginFilter),
str_replace('%uid', $this->access->escapeFilterPart($member), $this->access->connection->ldapLoginFilter),
$this->access->combineFilterWithAnd([
$this->access->getFilterPartForUserSearch($search),
$this->access->connection->ldapUserFilter
@ -1044,7 +1044,7 @@ class Group_LDAP extends ABackend implements GroupInterface, IGroupLDAP, IGetDis
}
//we got uids, need to get their DNs to 'translate' them to user names
$filter = $this->access->combineFilterWithAnd([
str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
str_replace('%uid', $this->access->escapeFilterPart($member), $this->access->connection->ldapLoginFilter),
$this->access->getFilterPartForUserSearch($search)
]);
$ldap_users = $this->access->fetchListOfUsers($filter, ['dn'], 1);