summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPavel Březina <pbrezina@redhat.com>2015-04-09 13:03:08 +0200
committerJakub Hrozek <jhrozek@redhat.com>2015-08-31 11:00:58 +0200
commitea10b6f7020cf2eb50a247f29c20f460fd0586a5 (patch)
treedeffe420eeb4ec1d73c3f02b0409cd6daf45d6e0
parentcc437c90f6848e4cbf7b1607411f7130d0326c6f (diff)
downloadsssd-rhel-6.8.zip
sssd-rhel-6.8.tar.gz
sssd-rhel-6.8.tar.xz
sudo: sanitize filter valuesrhel-6.8
Resolves: https://fedorahosted.org/sssd/ticket/2613 Reviewed-by: Pavel Reichl <preichl@redhat.com> (cherry picked from commit c526cd124515cc2d44a413dcbfd4a74ddb490150)
-rw-r--r--src/db/sysdb_sudo.c15
1 files changed, 13 insertions, 2 deletions
diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c
index 4c50d32..784ac8a 100644
--- a/src/db/sysdb_sudo.c
+++ b/src/db/sysdb_sudo.c
@@ -221,6 +221,7 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username,
TALLOC_CTX *tmp_ctx = NULL;
char *filter = NULL;
char *specific_filter = NULL;
+ char *sanitized = NULL;
time_t now;
errno_t ret;
int i;
@@ -246,9 +247,14 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username,
}
if ((flags & SYSDB_SUDO_FILTER_USERNAME) && (username != NULL)) {
+ ret = sss_filter_sanitize(tmp_ctx, username, &sanitized);
+ if (ret != EOK) {
+ goto done;
+ }
+
specific_filter = talloc_asprintf_append(specific_filter, "(%s=%s)",
SYSDB_SUDO_CACHE_AT_USER,
- username);
+ sanitized);
NULL_CHECK(specific_filter, ret, done);
}
@@ -261,9 +267,14 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username,
if ((flags & SYSDB_SUDO_FILTER_GROUPS) && (groupnames != NULL)) {
for (i=0; groupnames[i] != NULL; i++) {
+ ret = sss_filter_sanitize(tmp_ctx, groupnames[i], &sanitized);
+ if (ret != EOK) {
+ goto done;
+ }
+
specific_filter = talloc_asprintf_append(specific_filter, "(%s=%%%s)",
SYSDB_SUDO_CACHE_AT_USER,
- groupnames[i]);
+ sanitized);
NULL_CHECK(specific_filter, ret, done);
}
}