diff options
| author | Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi> | 2017-12-14 16:23:39 +0200 |
|---|---|---|
| committer | Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi> | 2017-12-14 16:23:57 +0200 |
| commit | 7e331b087fbd132905a91efa6180ce03b40a7156 (patch) | |
| tree | 4fd3e28c13743125185586a9e6cdcd03383a5cf8 /community/homer-api/0001-Update-LDAP.php.patch | |
| parent | 776cc8c2af5b4519fec9e5724ef88a2f167e7384 (diff) | |
| download | aports-7e331b087fbd132905a91efa6180ce03b40a7156.tar.bz2 aports-7e331b087fbd132905a91efa6180ce03b40a7156.tar.xz | |
community/homer-api: apply LDAP security fix
Diffstat (limited to 'community/homer-api/0001-Update-LDAP.php.patch')
| -rw-r--r-- | community/homer-api/0001-Update-LDAP.php.patch | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/community/homer-api/0001-Update-LDAP.php.patch b/community/homer-api/0001-Update-LDAP.php.patch new file mode 100644 index 0000000000..a0b7e91756 --- /dev/null +++ b/community/homer-api/0001-Update-LDAP.php.patch @@ -0,0 +1,27 @@ +From c2771cbb452949fb5b1e921d8c051c59b024fc28 Mon Sep 17 00:00:00 2001 +From: Alexandr Dubovikov <alexandr.dubovikov@gmail.com> +Date: Thu, 14 Dec 2017 15:16:58 +0100 +Subject: [PATCH] Update LDAP.php + +prevent some potentially leading to privilege escalation. Thanks go to Kaarle R. +--- + api/Authentication/LDAP.php | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/api/Authentication/LDAP.php b/api/Authentication/LDAP.php +index 653af2e..f3f0c9d 100644 +--- a/api/Authentication/LDAP.php ++++ b/api/Authentication/LDAP.php +@@ -72,8 +72,7 @@ class LDAP extends Authentication { + return array(); + } + } +- +- $r=@ldap_search( $ds, LDAP_BASEDN, LDAP_USERNAME_ATTRIBUTE_OPEN .$param['username'].LDAP_USERNAME_ATTRIBUTE_CLOSE); ++ $r=@ldap_search( $ds, LDAP_BASEDN, LDAP_USERNAME_ATTRIBUTE_OPEN.@ldap_escape($param['username']).LDAP_USERNAME_ATTRIBUTE_CLOSE); + if ($r) { + $result = @ldap_get_entries( $ds, $r); + +-- +2.14.3 + |