bug #36498 [Security/Core] fix escape for username in LdapBindAuthenticationProvider.php (stoccc)
This PR was merged into the 3.4 branch.
Discussion
----------
[Security/Core] fix escape for username in LdapBindAuthenticationProvider.php
| Q | A
| ------------- | ---
| Branch? | 3.4
| Bug fix? | yes
| New feature? | no
| Deprecations? | no
| License | MIT
I think that when we call `ldap_search()` as definitely it will do the `$this->ldap->query()` call, the proper filter applied should be `LdapInterface::ESCAPE_FILTER` as documented in
https://www.php.net/manual/en/function.ldap-escape.php while `LdapInterface::ESCAPE_DN` should be used for `dn` only
This simple change should fix, I'm sorry if I'm wrong.
Commits
-------
4bda68a9a2
Update LdapBindAuthenticationProvider.php
This commit is contained in:
commit
08ded7fed6
@ -87,9 +87,8 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
|
|||||||
}
|
}
|
||||||
|
|
||||||
try {
|
try {
|
||||||
$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN);
|
|
||||||
|
|
||||||
if ($this->queryString) {
|
if ($this->queryString) {
|
||||||
|
$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_FILTER);
|
||||||
$query = str_replace('{username}', $username, $this->queryString);
|
$query = str_replace('{username}', $username, $this->queryString);
|
||||||
$result = $this->ldap->query($this->dnString, $query)->execute();
|
$result = $this->ldap->query($this->dnString, $query)->execute();
|
||||||
if (1 !== $result->count()) {
|
if (1 !== $result->count()) {
|
||||||
@ -98,6 +97,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
|
|||||||
|
|
||||||
$dn = $result[0]->getDn();
|
$dn = $result[0]->getDn();
|
||||||
} else {
|
} else {
|
||||||
|
$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN);
|
||||||
$dn = str_replace('{username}', $username, $this->dnString);
|
$dn = str_replace('{username}', $username, $this->dnString);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user