From bfdf39b9bd286e7739937f8856f85787e987043a Mon Sep 17 00:00:00 2001
From: Arthur Schiwon <blizzz@owncloud.com>
Date: Thu, 9 Jul 2015 12:19:04 +0200
Subject: LDAP: when checking group for matching filter, also take base DN into
 consideration. Fixes #17516

---
 apps/user_ldap/lib/access.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'apps/user_ldap/lib/access.php')

diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php
index b201220d725..44237b52393 100644
--- a/apps/user_ldap/lib/access.php
+++ b/apps/user_ldap/lib/access.php
@@ -365,10 +365,21 @@ class Access extends LDAPUtility implements user\IUserTools {
 				continue;
 			}
 
+			// Check the base DN first. If this is not met already, we don't
+			// need to ask the server at all.
+			if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
+				$this->connection->writeToCache($cacheKey, false);
+				continue;
+			}
+
 			$result = $this->readAttribute($dn, 'cn', $this->connection->ldapGroupFilter);
 			if(is_array($result)) {
+				$this->connection->writeToCache($cacheKey, true);
 				$validGroupDNs[] = $dn;
+			} else {
+				$this->connection->writeToCache($cacheKey, false);
 			}
+
 		}
 		return $validGroupDNs;
 	}
-- 
cgit v1.2.3