LDAP: improve compilation of filters

diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php
index 6795aecafeea48cc6a802a7d38e9c40af3331f0b..b7e4023dd7354cccc3f5caae2cd477fba18c70b5 100644 (file)
--- a/apps/user_ldap/lib/access.php
+++ b/apps/user_ldap/lib/access.php
@@ -921,6 +921,17 @@ class Access extends LDAPUtility {
                return $name;
        }
 
+       /**
+       * @brief escapes (user provided) parts for LDAP filter
+       * @param String $input, the provided value
+       * @returns the escaped string
+       */
+       public function escapeFilterPart($input) {
+               $search  = array('*', '\\', '(', ')');
+               $replace = array('\\*', '\\\\', '\\(', '\\)');
+               return str_replace($search, $replace, $input);
+       }
+
        /**
         * @brief combines the input filters with AND
         * @param $filters array, the filters to connect

diff --git a/apps/user_ldap/user_ldap.php b/apps/user_ldap/user_ldap.php
index 4a147cf9884c365b73b7b44bc1d4e25b562c35e3..757de6b60f4cedbd57162294f6ace9961c4b8d8c 100644 (file)
--- a/apps/user_ldap/user_ldap.php
+++ b/apps/user_ldap/user_ldap.php
@@ -163,6 +163,8 @@ class USER_LDAP extends BackendUtility implements \OCP\UserInterface {
         * Check if the password is correct without logging in the user
         */
        public function checkPassword($uid, $password) {
+               $uid = $this->access->escapeFilterPart($uid);
+
                //find out dn of the user name
                $filter = \OCP\Util::mb_str_replace(
                        '%uid', $uid, $this->access->connection->ldapLoginFilter, 'UTF-8');
@@ -203,6 +205,7 @@ class USER_LDAP extends BackendUtility implements \OCP\UserInterface {
         * Get a list of all users.
         */
        public function getUsers($search = '', $limit = 10, $offset = 0) {
+               $search = $this->access->escapeFilterPart($search);
                $cachekey = 'getUsers-'.$search.'-'.$limit.'-'.$offset;
 
                //check if users are cached, if so return