NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.8k

[Security/Core] fix escape for username in LdapBindAuthenticationProvider.php#36498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:3.4fromstoccc:patch-1

Apr 21, 2020

Merged

[Security/Core] fix escape for username in LdapBindAuthenticationProvider.php#36498

nicolas-grekas merged 1 commit intosymfony:3.4fromstoccc:patch-1

Apr 21, 2020

Conversation

Copy link

Contributor

stoccc commentedApr 19, 2020•
edited
Loading

Q	A
Branch?	3.4
Bug fix?	yes
New feature?	no
Deprecations?	no
License	MIT

I think that when we callldap_search() as definitely it will do the$this->ldap->query() call, the proper filter applied should beLdapInterface::ESCAPE_FILTER as documented in
https://www.php.net/manual/en/function.ldap-escape.php whileLdapInterface::ESCAPE_DN should be used fordn only

This simple change should fix, I'm sorry if I'm wrong.

Update LdapBindAuthenticationProvider.php

4bda68a

carsonbot added Status: Needs Review Bug labels

Apr 19, 2020

stoccc changed the title~~Update LdapBindAuthenticationProvider.php~~fix escape for username in LdapBindAuthenticationProvider.php

Apr 19, 2020

nicolas-grekas added this to the3.4 milestone

Apr 20, 2020

nicolas-grekas changed the title~~fix escape for username in LdapBindAuthenticationProvider.php~~[Security/Core] fix escape for username in LdapBindAuthenticationProvider.php

Apr 20, 2020