diff options
| author | Pavel Březina <pbrezina@redhat.com> | 2015-04-09 13:03:08 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-06-18 10:45:32 +0200 |
| commit | ea10cbf8ec9669f4041c1df511b5f1b48aecce21 (patch) | |
| tree | 0ef2c75ae1557f81eabafce02c6181661e57955e | |
| parent | 8e382375715232130f7b96d3098a7c7a0d6cef7d (diff) | |
| download | sssd-ea10cbf8ec9669f4041c1df511b5f1b48aecce21.tar.gz sssd-ea10cbf8ec9669f4041c1df511b5f1b48aecce21.tar.xz sssd-ea10cbf8ec9669f4041c1df511b5f1b48aecce21.zip | |
sudo: sanitize filter values
Resolves:
https://fedorahosted.org/sssd/ticket/2613
Reviewed-by: Pavel Reichl <preichl@redhat.com>
(cherry picked from commit c526cd124515cc2d44a413dcbfd4a74ddb490150)
(cherry picked from commit 2fb2a267d0d15cce84b0ccea7e088a4b580e42fb)
| -rw-r--r-- | src/db/sysdb_sudo.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c index 261ed82d6..cd072dd29 100644 --- a/src/db/sysdb_sudo.c +++ b/src/db/sysdb_sudo.c @@ -221,6 +221,7 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, TALLOC_CTX *tmp_ctx = NULL; char *filter = NULL; char *specific_filter = NULL; + char *sanitized = NULL; time_t now; errno_t ret; int i; @@ -246,9 +247,14 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, } if ((flags & SYSDB_SUDO_FILTER_USERNAME) && (username != NULL)) { + ret = sss_filter_sanitize(tmp_ctx, username, &sanitized); + if (ret != EOK) { + goto done; + } + specific_filter = talloc_asprintf_append(specific_filter, "(%s=%s)", SYSDB_SUDO_CACHE_AT_USER, - username); + sanitized); NULL_CHECK(specific_filter, ret, done); } @@ -261,9 +267,14 @@ sysdb_get_sudo_filter(TALLOC_CTX *mem_ctx, const char *username, if ((flags & SYSDB_SUDO_FILTER_GROUPS) && (groupnames != NULL)) { for (i=0; groupnames[i] != NULL; i++) { + ret = sss_filter_sanitize(tmp_ctx, groupnames[i], &sanitized); + if (ret != EOK) { + goto done; + } + specific_filter = talloc_asprintf_append(specific_filter, "(%s=%%%s)", SYSDB_SUDO_CACHE_AT_USER, - groupnames[i]); + sanitized); NULL_CHECK(specific_filter, ret, done); } } |