Commit 34614356 authored by Sven Feyerabend's avatar Sven Feyerabend
Browse files

Escape user input in ladp filters

parent fcebf5f3
Loading
Loading
Loading
Loading
+1 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ RUN npm install -g npm
#RUN npm cache clean --force
RUN npm install ldapts-search
RUN npm install ldapts
RUN npm install ldap-escape
#RUN npm install bcrypt@5.0.0

# This variant of updateing texlive does not work
+6 −4
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ const {
const util = require('util')

const { Client } = require('ldapts');

const ldapEscape = require('ldap-escape');
// https://www.npmjs.com/package/@overleaf/o-error
// have a look if we can do nice error messages.

@@ -275,7 +275,7 @@ const AuthenticationManager = {
    const ldap_base = process.env.LDAP_BASE
    var mail = query.email
    var uid = query.email.split('@')[0]
    const filterstr = '(&' + process.env.LDAP_GROUP_FILTER + '(uid=' + uid + '))'
    const filterstr = '(&' + process.env.LDAP_GROUP_FILTER + '(' + ldapEscape.filter`uid=${uid}` + '))'
    var userDn = "" //'uid=' + uid + ',' + ldap_bd;
    var firstname = ""
    var lastname = ""
@@ -314,7 +314,7 @@ const AuthenticationManager = {
      // if admin filter is set - only set admin for user in ldap group
      // does not matter - admin is deactivated: managed through ldap
      if (process.env.LDAP_ADMIN_GROUP_FILTER) {
        const adminfilter = '(&' + process.env.LDAP_ADMIN_GROUP_FILTER + '(uid=' + uid + '))' 
        const adminfilter = '(&' + process.env.LDAP_ADMIN_GROUP_FILTER + '(' +ldapEscape.filter`uid=${uid}` + '))'
        adminEntry = await client.search(ldap_base, {
          scope: 'sub',
          filter: adminfilter,
@@ -341,6 +341,8 @@ const AuthenticationManager = {
    } catch (ex) {
      console.log("Could not bind User: " + userDn + " err: " + String(ex))
      return callback(null, null)
    } finally{
      await client.unbind()
    }

    //console.log("Logging in user: " + mail + " Name: " + firstname + " " + lastname + " isAdmin: " + String(isAdmin))