Escape search input. Search by uid and cn.

1 files changed, 23 insertions, 1 deletions

diff --git a/ipa-server/ipa-gui/ipagui/controllers.py b/ipa-server/ipa-gui/ipagui/controllers.py
index ab6fbc7a..089bbda2 100644
--- a/ipa-server/ipa-gui/ipagui/controllers.py
+++ b/ipa-server/ipa-gui/ipagui/controllers.py
@@ -1,6 +1,7 @@
 import random
 from pickle import dumps, loads
 from base64 import b64encode, b64decode
+import re
 
 import cherrypy
 import turbogears
@@ -37,6 +38,22 @@ def utf8_encode(value):
         value = value.encode('utf-8')
     return value
 
+def ldap_search_escape(match):
+    """Escapes out nasty characters from the ldap search.
+       See RFC 2254."""
+    value = match.group()
+    if (len(value) != 1):
+        return u""
+
+    if value == u"(":
+        return u"\\28"
+    elif value == ")":
+        return u"\\29"
+    elif value == u"\\":
+        return u"\\5c"
+    else:
+        return value
+
 
 class Root(controllers.RootController):
 
@@ -141,7 +158,12 @@ class Root(controllers.RootController):
         users = None
         uid = kw.get('uid')
         if uid != None and len(uid) > 0:
-            users = client.find_users(uid)
+            try:
+                uid = re.sub(r'[\(\)\\]', ldap_search_escape, uid)
+                users = client.find_users(uid.encode('utf-8'))
+            except xmlrpclib.Fault, f:
+                turbogears.flash("User show failed: " + str(f.faultString))
+                raise turbogears.redirect("/userlist")
 
         return dict(users=users, fields=forms.user.UserFields())