diff options
| author | Arthur Schiwon <blizzz@owncloud.com> | 2012-08-05 21:28:59 +0200 |
|---|---|---|
| committer | Arthur Schiwon <blizzz@owncloud.com> | 2012-08-05 21:28:59 +0200 |
| commit | d54671817929651b2533f5e0875828844bcf44f1 (patch) | |
| tree | 55ddedf4fa065dfbff7d6eac3091bce3dc072156 | |
| parent | 6fbc4f712a118bba199db8e154722325e1ba414c (diff) | |
| download | nextcloud-server-d54671817929651b2533f5e0875828844bcf44f1.tar.gz nextcloud-server-d54671817929651b2533f5e0875828844bcf44f1.zip | |
LDAP: sanitize user and group base trees for strripos comparison. fixes oc-1302
| -rw-r--r-- | apps/user_ldap/lib/access.php | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php index a50afd0d602..986700ff05f 100644 --- a/apps/user_ldap/lib/access.php +++ b/apps/user_ldap/lib/access.php @@ -28,6 +28,8 @@ abstract class Access { public function setConnector(Connection &$connection) { $this->connection = $connection; + + } private function checkConnection() { @@ -181,7 +183,7 @@ abstract class Access { * returns the internal ownCloud name for the given LDAP DN of the group, false on DN outside of search DN or failure */ public function dn2groupname($dn, $ldapname = null) { - if(mb_strripos($dn, $this->connection->ldapBaseGroups, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($this->connection->ldapBaseGroups, 'UTF-8'))) { + if(mb_strripos($dn, $this->sanitizeDN($this->connection->ldapBaseGroups), 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($this->sanitizeDN($this->connection->ldapBaseGroups), 'UTF-8'))) { return false; } return $this->dn2ocname($dn, $ldapname, false); @@ -196,7 +198,7 @@ abstract class Access { * returns the internal ownCloud name for the given LDAP DN of the user, false on DN outside of search DN or failure */ public function dn2username($dn, $ldapname = null) { - if(mb_strripos($dn, $this->connection->ldapBaseUsers, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($this->connection->ldapBaseUsers, 'UTF-8'))) { + if(mb_strripos($dn, $this->sanitizeDN($this->connection->ldapBaseUsers), 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($this->sanitizeDN($this->connection->ldapBaseUsers), 'UTF-8'))) { return false; } return $this->dn2ocname($dn, $ldapname, true); |