LDAP: improve compilation of filters

diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php
index aa8db2955185bf08aa55b87667d37765a0091e57..44a5fe6c19a11c4f697ee38261321bd3e8c48913 100644 (file)
--- a/apps/user_ldap/lib/access.php
+++ b/apps/user_ldap/lib/access.php
@@ -797,6 +797,17 @@ abstract class Access {
                return $name;
        }
 
+       /**
+       * @brief escapes (user provided) parts for LDAP filter
+       * @param String $input, the provided value
+       * @returns the escaped string
+       */
+       public function escapeFilterPart($input) {
+               $search  = array('*', '\\', '(', ')');
+               $replace = array('\\*', '\\\\', '\\(', '\\)');
+               return str_replace($search, $replace, $input);
+       }
+
        /**
         * @brief combines the input filters with AND
         * @param $filters array, the filters to connect

diff --git a/apps/user_ldap/user_ldap.php b/apps/user_ldap/user_ldap.php
index 60000cfb2f4b7f60820a481558da8adc196f1b48..3b8089be58cb910148c538464100770b05bcc7e2 100644 (file)
--- a/apps/user_ldap/user_ldap.php
+++ b/apps/user_ldap/user_ldap.php
@@ -69,6 +69,8 @@ class USER_LDAP extends lib\Access implements \OCP\UserInterface {
         * Check if the password is correct without logging in the user
         */
        public function checkPassword($uid, $password) {
+               $uid = $this->escapeFilterPart($uid);
+
                //find out dn of the user name
                $filter = \OCP\Util::mb_str_replace('%uid', $uid, $this->connection->ldapLoginFilter, 'UTF-8');
                $ldap_users = $this->fetchListOfUsers($filter, 'dn');
@@ -104,6 +106,7 @@ class USER_LDAP extends lib\Access implements \OCP\UserInterface {
         * Get a list of all users.
         */
        public function getUsers($search = '', $limit = 10, $offset = 0) {
+               $search = $this->escapeFilterPart($search);
                $cachekey = 'getUsers-'.$search.'-'.$limit.'-'.$offset;
 
                //check if users are cached, if so return