X-Git-Url: https://git.quassel-irc.org/?p=quassel.git;a=blobdiff_plain;f=src%2Fcore%2Fldapauthenticator.cpp;h=02f927d03d5da39cf4071b8b1e89359ea6cb9071;hp=82ae5b46dc0650e691b2bf83e7b2ab6d10212e5b;hb=HEAD;hpb=cc6e7c08709c4e761e2fd9c2e322751015497003

diff --git a/src/core/ldapauthenticator.cpp b/src/core/ldapauthenticator.cpp
index 82ae5b46..89b390fc 100644
--- a/src/core/ldapauthenticator.cpp
+++ b/src/core/ldapauthenticator.cpp
@@ -1,5 +1,5 @@
 /***************************************************************************
- *   Copyright (C) 2005-2019 by the Quassel Project                        *
+ *   Copyright (C) 2005-2022 by the Quassel Project                        *
  *   devel@quassel-irc.org                                                 *
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
@@ -28,11 +28,12 @@
 
 #include "ldapauthenticator.h"
 
+#include "ldapescaper.h"
 #include "network.h"
 #include "quassel.h"
 
 /* We should use openldap on windows if at all possible, rather than trying to
- * write some kind of compatiblity routine.
+ * write some kind of compatibility routine.
 #ifdef Q_CC_MSVC
 #include <windows.h>
 #include <winldap.h>
@@ -128,7 +129,7 @@ UserId LdapAuthenticator::validateUser(const QString& username, const QString& p
     // Users created via LDAP have empty passwords, but authenticator column = LDAP.
     // On the other hand, if auth succeeds and the user already exists, do a final
     // cross-check to confirm we're using the right auth provider.
-    UserId quasselId = Core::validateUser(lUsername, QString());
+    UserId quasselId = Core::getUserId(lUsername);
     if (!quasselId.isValid()) {
         return Core::addUser(lUsername, QString(), backendId());
     }
@@ -241,7 +242,7 @@ bool LdapAuthenticator::ldapAuth(const QString& username, const QString& passwor
 
     LDAPMessage *msg = nullptr, *entry = nullptr;
 
-    const QByteArray ldapQuery = "(&(" + uidAttribute + '=' + username.toLocal8Bit() + ")" + _filter.toLocal8Bit() + ")";
+    const QByteArray ldapQuery = "(&(" + uidAttribute + '=' + LdapEscaper::escapeQuery(username).toLatin1() + ")" + _filter.toLocal8Bit() + ")";
 
     res = ldap_search_ext_s(_connection,
                             baseDN.constData(),