SYSDB: Sanitize filter before removing ghost attrs

sysdb_add_user fails with EIO if enumeration is disabled and user contains
backslashes.
We try to remove ghost attributes from groups with disabled enumeration,
but unsanitized filter is used to find ghost attributes
"(|(ghost=usr\\\\002)" and ldb cannot parse this filter.

Resolves:
https://fedorahosted.org/sssd/ticket/2163

1 files changed, 8 insertions, 1 deletions

diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index b4ed202cc..327345212 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -1082,6 +1082,7 @@ sysdb_remove_ghostattr_from_groups(struct sss_domain_info *domain,
     struct ldb_dn *tmpdn;
     const char *group_attrs[] = {SYSDB_NAME, SYSDB_GHOST, SYSDB_ORIG_MEMBER, NULL};
     const char *userdn;
+    char *sanitized_name;
     char *filter;
     errno_t ret = EOK;
     size_t group_count = 0;
@@ -1092,7 +1093,13 @@ sysdb_remove_ghostattr_from_groups(struct sss_domain_info *domain,
         return ENOENT;
     }
 
-    filter = talloc_asprintf(tmp_ctx, "(|(%s=%s)", SYSDB_GHOST, name);
+    ret = sss_filter_sanitize(tmp_ctx, name, &sanitized_name);
+    if (ret != EOK) {
+        goto done;
+    }
+
+    filter = talloc_asprintf(tmp_ctx, "(|(%s=%s)",
+                                      SYSDB_GHOST, sanitized_name);
     if (!filter) {
         ret = ENOMEM;
         goto done;