diff options
-rw-r--r-- | Makefile.am | 1 | ||||
-rw-r--r-- | src/providers/ldap/ldap_id_cleanup.c | 18 |
2 files changed, 17 insertions, 2 deletions
diff --git a/Makefile.am b/Makefile.am index 5a99c9784..08799c729 100644 --- a/Makefile.am +++ b/Makefile.am @@ -236,6 +236,7 @@ if HAVE_CMOCKA test_ipa_subdom_server \ test_krb5_wait_queue \ test_cert_utils \ + test_ldap_id_cleanup \ $(NULL) if HAVE_LIBRESOLV diff --git a/src/providers/ldap/ldap_id_cleanup.c b/src/providers/ldap/ldap_id_cleanup.c index 461e1834e..cde2ad818 100644 --- a/src/providers/ldap/ldap_id_cleanup.c +++ b/src/providers/ldap/ldap_id_cleanup.c @@ -410,6 +410,8 @@ static int cleanup_groups(TALLOC_CTX *memctx, } for (i = 0; i < count; i++) { + char *sanitized_dn; + dn = ldb_dn_get_linearized(msgs[i]->dn); if (!dn) { DEBUG(SSSDBG_CRIT_FAILURE, "Cannot linearize DN!\n"); @@ -417,6 +419,15 @@ static int cleanup_groups(TALLOC_CTX *memctx, goto done; } + /* sanitize dn */ + ret = sss_filter_sanitize(tmpctx, dn, &sanitized_dn); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, + "sss_filter_sanitize failed: %s:[%d]\n", + sss_strerror(ret), ret); + goto done; + } + posix = ldb_msg_find_attr_as_string(msgs[i], SYSDB_POSIX, NULL); if (!posix || strcmp(posix, "TRUE") == 0) { /* Search for users that are members of this group, or @@ -426,11 +437,14 @@ static int cleanup_groups(TALLOC_CTX *memctx, gid = (gid_t) ldb_msg_find_attr_as_uint(msgs[i], SYSDB_GIDNUM, 0); subfilter = talloc_asprintf(tmpctx, "(&(%s=%s)(|(%s=%s)(%s=%lu)))", SYSDB_OBJECTCLASS, SYSDB_USER_CLASS, - SYSDB_MEMBEROF, dn, + SYSDB_MEMBEROF, sanitized_dn, SYSDB_GIDNUM, (long unsigned) gid); } else { - subfilter = talloc_asprintf(tmpctx, "(%s=%s)", SYSDB_MEMBEROF, dn); + subfilter = talloc_asprintf(tmpctx, "(%s=%s)", SYSDB_MEMBEROF, + sanitized_dn); } + talloc_zfree(sanitized_dn); + if (!subfilter) { DEBUG(SSSDBG_OP_FAILURE, "Failed to build filter\n"); ret = ENOMEM; |