diff options
| author | Stephen Gallagher <sgallagh@redhat.com> | 2011-01-31 13:00:56 -0500 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2011-02-03 12:13:02 -0500 |
| commit | a7cf4dde63cc2c5fa193a9f55825b0ae89443b02 (patch) | |
| tree | 08fe042f0d0fd95a8c4910d2ddda2157b25e6b1b | |
| parent | 038b2300e2fbc39270655dab57eba10978310190 (diff) | |
| download | sssd-a7cf4dde63cc2c5fa193a9f55825b0ae89443b02.tar.gz sssd-a7cf4dde63cc2c5fa193a9f55825b0ae89443b02.tar.xz sssd-a7cf4dde63cc2c5fa193a9f55825b0ae89443b02.zip | |
Sanitize search filters for nested group lookups
| -rw-r--r-- | src/providers/ldap/sdap_async_accounts.c | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/src/providers/ldap/sdap_async_accounts.c b/src/providers/ldap/sdap_async_accounts.c index 648f9a734..5b6d3d74a 100644 --- a/src/providers/ldap/sdap_async_accounts.c +++ b/src/providers/ldap/sdap_async_accounts.c @@ -3409,6 +3409,7 @@ errno_t save_rfc2307bis_user_memberships( { errno_t ret, tret; char *member_dn; + char *sanitized_dn; char *filter; const char **attrs; size_t reply_count, i; @@ -3447,12 +3448,18 @@ errno_t save_rfc2307bis_user_memberships( ret = ENOMEM; goto error; } + ret = sss_filter_sanitize(tmp_ctx, member_dn, &sanitized_dn); + if (ret != EOK) { + goto error; + } + talloc_free(member_dn); - filter = talloc_asprintf(tmp_ctx, "(member=%s)", member_dn); + filter = talloc_asprintf(tmp_ctx, "(member=%s)", sanitized_dn); if (!filter) { ret = ENOMEM; goto error; } + talloc_free(sanitized_dn); ret = sysdb_search_groups(tmp_ctx, state->sysdb, state->dom, filter, attrs, &reply_count, &replies); @@ -3874,6 +3881,7 @@ static errno_t rfc2307bis_nested_groups_update_sysdb( const char *name; bool in_transaction = false; char *member_dn; + char *sanitized_dn; char *filter; const char **attrs; size_t reply_count, i; @@ -3918,12 +3926,18 @@ static errno_t rfc2307bis_nested_groups_update_sysdb( goto error; } - filter = talloc_asprintf(tmp_ctx, "(member=%s)", member_dn); + ret = sss_filter_sanitize(tmp_ctx, member_dn, &sanitized_dn); + if (ret != EOK) { + goto error; + } + talloc_free(member_dn); + + filter = talloc_asprintf(tmp_ctx, "(member=%s)", sanitized_dn); if (!filter) { ret = ENOMEM; goto error; } - talloc_free(member_dn); + talloc_free(sanitized_dn); ret = sysdb_search_groups(tmp_ctx, state->sysdb, state->dom, filter, attrs, |