diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug #36498 [Security/Core] fix escape for username in LdapBindAuthenticationProvider.php (stoccc)

Browse Source 
This PR was merged into the 3.4 branch.

Discussion
----------

[Security/Core] fix escape for username in LdapBindAuthenticationProvider.php

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| License       | MIT

I think that when we call `ldap_search()` as definitely it will do the `$this->ldap->query()` call, the proper filter applied should be `LdapInterface::ESCAPE_FILTER` as documented in
https://www.php.net/manual/en/function.ldap-escape.php while `LdapInterface::ESCAPE_DN` should be used for `dn` only

This simple change should fix, I'm sorry if I'm wrong.

Commits
-------

4bda68a9a2 Update LdapBindAuthenticationProvider.php
This commit is contained in:
Nicolas Grekas 2020-04-21 22:51:56 +02:00
commit 08ded7fed6
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php
View File

@ -87,9 +87,8 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
} }
try { try {
$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN);
if ($this->queryString) { if ($this->queryString) {
$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_FILTER);
$query = str_replace('{username}', $username, $this->queryString); $query = str_replace('{username}', $username, $this->queryString);
$result = $this->ldap->query($this->dnString, $query)->execute(); $result = $this->ldap->query($this->dnString, $query)->execute();
if (1 !== $result->count()) { if (1 !== $result->count()) {
@ -98,6 +97,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
$dn = $result[0]->getDn(); $dn = $result[0]->getDn();
} else { } else {
$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN);
$dn = str_replace('{username}', $username, $this->dnString); $dn = str_replace('{username}', $username, $this->dnString);
} }