projects / quassel.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (from: 37f3c64)
Fix a security issue with LDAP usernames
authorJanne Koschinski <janne@kuschku.de>
Mon, 20 May 2019 22:32:05 +0000 (00:32 +0200)
committerManuel Nickschas <sputnick@quassel-irc.org>
Tue, 12 Oct 2021 11:27:51 +0000 (13:27 +0200)
LDAP usernames are directly concatenated into the filter query,
which opens up the risk of unauthenticated LDAP injection,
potentially allowing to bypass the authentication.

To solve this, apply escaping as per RFC 4515.

Co-authored-by: Shane Synan <digitalcircuit36939@gmail.com>
Co-authored-by: Manuel Nickschas <sputnick@quassel-irc.org>

No differences found
Quassel IRC