diff options
| author | Côme Chilliet <91878298+come-nc@users.noreply.github.com> | 2023-10-02 09:49:22 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-02 09:49:22 +0200 |
| commit | 9ebcd287efeea3cf720c2c552a1692f71de5797a (patch) | |
| tree | 607f47df83019cf7ae91350b0f2bef6151f09713 /apps | |
| parent | 3622af9b433cd69761645c9e45c5778e72bc40bb (diff) | |
| parent | aefa3664958daed83f283997b57577603820b671 (diff) | |
| download | nextcloud-server-9ebcd287efeea3cf720c2c552a1692f71de5797a.tar.gz nextcloud-server-9ebcd287efeea3cf720c2c552a1692f71de5797a.zip | |
Merge pull request #37201 from AaronDewes/fix/ldap-filter-generation
Fix: Escape group names for LDAP
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/user_ldap/lib/Access.php | 4 | ||||
| -rw-r--r-- | apps/user_ldap/lib/Wizard.php | 12 | ||||
| -rw-r--r-- | apps/user_ldap/tests/AccessTest.php | 4 |
3 files changed, 9 insertions, 11 deletions
diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index 49e431820ac..90c2d72a2ff 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -1421,9 +1421,7 @@ class Access extends LDAPUtility { $asterisk = '*'; $input = mb_substr($input, 1, null, 'UTF-8'); } - $search = ['*', '\\', '(', ')']; - $replace = ['\\*', '\\\\', '\\(', '\\)']; - return $asterisk . str_replace($search, $replace, $input); + return $asterisk . ldap_escape($input, '', LDAP_ESCAPE_FILTER); } /** diff --git a/apps/user_ldap/lib/Wizard.php b/apps/user_ldap/lib/Wizard.php index 3014ec8e8a7..29407ceb0a5 100644 --- a/apps/user_ldap/lib/Wizard.php +++ b/apps/user_ldap/lib/Wizard.php @@ -909,7 +909,7 @@ class Wizard extends LDAPUtility { if (is_array($objcs) && count($objcs) > 0) { $filter .= '(|'; foreach ($objcs as $objc) { - $filter .= '(objectclass=' . $objc . ')'; + $filter .= '(objectclass=' . ldap_escape($objc, '', LDAP_ESCAPE_FILTER) . ')'; } $filter .= ')'; $parts++; @@ -925,7 +925,7 @@ class Wizard extends LDAPUtility { } $base = $this->configuration->ldapBase[0]; foreach ($cns as $cn) { - $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']); + $rr = $this->ldap->search($cr, $base, 'cn=' . ldap_escape($cn, '', LDAP_ESCAPE_FILTER), ['dn', 'primaryGroupToken']); if (!$this->ldap->isResource($rr)) { continue; } @@ -936,10 +936,10 @@ class Wizard extends LDAPUtility { if ($dn === false || $dn === '') { continue; } - $filterPart = '(memberof=' . $dn . ')'; + $filterPart = '(memberof=' . ldap_escape($dn, '', LDAP_ESCAPE_FILTER) . ')'; if (isset($attrs['primaryGroupToken'])) { $pgt = $attrs['primaryGroupToken'][0]; - $primaryFilterPart = '(primaryGroupID=' . $pgt .')'; + $primaryFilterPart = '(primaryGroupID=' . ldap_escape($pgt, '', LDAP_ESCAPE_FILTER) .')'; $filterPart = '(|' . $filterPart . $primaryFilterPart . ')'; } $filter .= $filterPart; @@ -963,7 +963,7 @@ class Wizard extends LDAPUtility { if (is_array($objcs) && count($objcs) > 0) { $filter .= '(|'; foreach ($objcs as $objc) { - $filter .= '(objectclass=' . $objc . ')'; + $filter .= '(objectclass=' . ldap_escape($objc, '', LDAP_ESCAPE_FILTER) . ')'; } $filter .= ')'; $parts++; @@ -973,7 +973,7 @@ class Wizard extends LDAPUtility { if (is_array($cns) && count($cns) > 0) { $filter .= '(|'; foreach ($cns as $cn) { - $filter .= '(cn=' . $cn . ')'; + $filter .= '(cn=' . ldap_escape($cn, '', LDAP_ESCAPE_FILTER) . ')'; } $filter .= ')'; } diff --git a/apps/user_ldap/tests/AccessTest.php b/apps/user_ldap/tests/AccessTest.php index ce05839c842..5469b9267e7 100644 --- a/apps/user_ldap/tests/AccessTest.php +++ b/apps/user_ldap/tests/AccessTest.php @@ -137,13 +137,13 @@ class AccessTest extends TestCase { public function testEscapeFilterPartEscapeWildcard() { $input = '*'; - $expected = '\\\\*'; + $expected = '\\2a'; $this->assertTrue($expected === $this->access->escapeFilterPart($input)); } public function testEscapeFilterPartEscapeWildcard2() { $input = 'foo*bar'; - $expected = 'foo\\\\*bar'; + $expected = 'foo\\2abar'; $this->assertTrue($expected === $this->access->escapeFilterPart($input)); } |