diff options
author | Pavel Březina <pbrezina@redhat.com> | 2015-04-09 13:03:08 +0200 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-08-31 11:00:58 +0200 |
commit | ea10b6f7020cf2eb50a247f29c20f460fd0586a5 (patch) | |
tree | deffe420eeb4ec1d73c3f02b0409cd6daf45d6e0 | |
parent | cc437c90f6848e4cbf7b1607411f7130d0326c6f (diff) | |
download | sssd-ea10b6f7020cf2eb50a247f29c20f460fd0586a5.tar.gz sssd-ea10b6f7020cf2eb50a247f29c20f460fd0586a5.tar.xz sssd-ea10b6f7020cf2eb50a247f29c20f460fd0586a5.zip |
sudo: sanitize filter valuesrhel-6.8
Resolves:
https://fedorahosted.org/sssd/ticket/2613
Reviewed-by: Pavel Reichl <preichl@redhat.com>
(cherry picked from commit c526cd124515cc2d44a413dcbfd4a74ddb490150)
-rw-r--r-- | src/db/sysdb_sudo.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c index 4c50d32c7..784ac8af3 100644 --- a/src/db/sysdb_sudo.c +++ b/src/db/sysdb_sudo.c @@ -221,6 +221,7 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, TALLOC_CTX *tmp_ctx = NULL; char *filter = NULL; char *specific_filter = NULL; + char *sanitized = NULL; time_t now; errno_t ret; int i; @@ -246,9 +247,14 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, } if ((flags & SYSDB_SUDO_FILTER_USERNAME) && (username != NULL)) { + ret = sss_filter_sanitize(tmp_ctx, username, &sanitized); + if (ret != EOK) { + goto done; + } + specific_filter = talloc_asprintf_append(specific_filter, "(%s=%s)", SYSDB_SUDO_CACHE_AT_USER, - username); + sanitized); NULL_CHECK(specific_filter, ret, done); } @@ -261,9 +267,14 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, if ((flags & SYSDB_SUDO_FILTER_GROUPS) && (groupnames != NULL)) { for (i=0; groupnames[i] != NULL; i++) { + ret = sss_filter_sanitize(tmp_ctx, groupnames[i], &sanitized); + if (ret != EOK) { + goto done; + } + specific_filter = talloc_asprintf_append(specific_filter, "(%s=%%%s)", SYSDB_SUDO_CACHE_AT_USER, - groupnames[i]); + sanitized); NULL_CHECK(specific_filter, ret, done); } } |