gearheads
/
mastodon
Archived
2
0
Fork 0
Code Releases 4 Activity

Fix unescaped user input in LDAP query (#24379) 

Fix CVE-2023-28853
gh/stable
Claire 2023-04-03 15:47:04 +02:00
parent 4eaa6d58b2
commit b9f271364e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/models/concerns/ldap_authenticable.rb
View File

@ -6,7 +6,7 @@ module LdapAuthenticable
class_methods do class_methods do
def authenticate_with_ldap(params = {}) def authenticate_with_ldap(params = {})
ldap = Net::LDAP.new(ldap_options) ldap = Net::LDAP.new(ldap_options)
filter = format(Devise.ldap_search_filter, uid: Devise.ldap_uid, mail: Devise.ldap_mail, email: params[:email]) filter = format(Devise.ldap_search_filter, uid: Devise.ldap_uid, mail: Devise.ldap_mail, email: Net::LDAP::Filter.escape(params[:email]))
if (user_info = ldap.bind_as(base: Devise.ldap_base, filter: filter, password: params[:password])) if (user_info = ldap.bind_as(base: Devise.ldap_base, filter: filter, password: params[:password]))
ldap_get_user(user_info.first) ldap_get_user(user_info.first)