From 83c0f57d79e58ee59117864587e094b760a42828 Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Sat, 8 Mar 2008 00:21:43 +0000 Subject: [PATCH] Escape the hostname before inserting it in an LDAP query. Signed-off-by: Anders Kaseorg --- mod_vhost_ldap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mod_vhost_ldap.c b/mod_vhost_ldap.c index 735706d..1ed8b17 100644 --- a/mod_vhost_ldap.c +++ b/mod_vhost_ldap.c @@ -471,7 +471,12 @@ fallback: ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, "[mod_vhost_ldap.c]: translating %s", r->uri); - apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(|(apacheServerName=%s)(apacheServerAlias=%s)))", conf->filter, hostname, hostname); + struct berval hostnamebv, shostnamebv; + ber_str2bv(hostname, 0, 0, &hostnamebv); + if (ldap_bv2escaped_filter_value(&hostnamebv, &shostnamebv) != 0) + goto null; + apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(|(apacheServerName=%s)(apacheServerAlias=%s)))", conf->filter, shostnamebv.bv_val, shostnamebv.bv_val); + ber_memfree(shostnamebv.bv_val); result = util_ldap_cache_getuserdn(r, ldc, conf->url, conf->basedn, conf->scope, attributes, filtbuf, &dn, &vals); -- 2.45.2