Gracefully deny users or groups with too long DNs

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php
index cace64a7deb26f5c91f6ece7941bf461dca470ae..9f6639c0db0175947de2303fe2faf3952137d09c 100644 (file)
--- a/apps/user_ldap/lib/Access.php
+++ b/apps/user_ldap/lib/Access.php
@@ -678,6 +678,9 @@ class Access extends LDAPUtility implements IUserTools {
         */
        public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
                $user = $this->userManager->get($ocName);
+               if($user === null) {
+                       return;
+               }
                $displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
                $cacheKeyTrunk = 'getDisplayName';
                $this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);

diff --git a/apps/user_ldap/lib/Mapping/AbstractMapping.php b/apps/user_ldap/lib/Mapping/AbstractMapping.php
index 8e7f1f8b13735d3f29fc9ca9308032c45f0cf3c7..6fb4a5436c3ec201f99eaa6efaeb24c315ba1c5e 100644 (file)
--- a/apps/user_ldap/lib/Mapping/AbstractMapping.php
+++ b/apps/user_ldap/lib/Mapping/AbstractMapping.php
@@ -209,6 +209,17 @@ abstract class AbstractMapping {
         * @return bool
         */
        public function map($fdn, $name, $uuid) {
+               if(mb_strlen($fdn) > 255) {
+                       \OC::$server->getLogger()->error(
+                               'Cannot map, because the DN exceeds 255 characters: {dn}',
+                               [
+                                       'app' => 'user_ldap',
+                                       'dn' => $fdn,
+                               ]
+                       );
+                       return false;
+               }
+
                $row = array(
                        'ldap_dn'        => $fdn,
                        'owncloud_name'  => $name,

diff --git a/apps/user_ldap/tests/Mapping/AbstractMappingTest.php b/apps/user_ldap/tests/Mapping/AbstractMappingTest.php
index 91013085c2c9c86a26013c132845a65432287f8c..5c3474d9ad22f8aff7136f295c7fc08e7c494cff 100644 (file)
--- a/apps/user_ldap/tests/Mapping/AbstractMappingTest.php
+++ b/apps/user_ldap/tests/Mapping/AbstractMappingTest.php
@@ -106,7 +106,8 @@ abstract class AbstractMappingTest extends \Test\TestCase {
                list($mapper, $data) = $this->initTest();
 
                // test that mapping will not happen when it shall not
-               $paramKeys = array('', 'dn', 'name', 'uuid');
+               $tooLongDN = 'uid=joann,ou=Secret Small Specialized Department,ou=Some Tremendously Important Department,ou=Another Very Important Department,ou=Pretty Meaningful Derpartment,ou=Quite Broad And General Department,ou=The Topmost Department,dc=hugelysuccessfulcompany,dc=com';
+               $paramKeys = array('', 'dn', 'name', 'uuid', $tooLongDN);
                foreach($paramKeys as $key) {
                        $failEntry = $data[0];
                        if(!empty($key)) {