AIUS/Overleaf
1
0
Fork 0
mirror of https://git.unistra.fr/aius/root/ldap-overleaf-sl.git synced 2025-05-04 19:55:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Escape user input in ladp filters

Browse source
This commit is contained in:
Sven Feyerabend 2021-05-08 02:08:03 +02:00
parent fcebf5f33d
commit 34614356c9
2 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ldap-overleaf-sl/Dockerfile
View file

@ -18,6 +18,7 @@ RUN npm install -g npm
#RUN npm cache clean --force
RUN npm install ldapts-search
RUN npm install ldapts
RUN npm install ldap-escape
#RUN npm install bcrypt@5.0.0
# This variant of updateing texlive does not work

8
ldap-overleaf-sl/sharelatex/AuthenticationManager.js
View file

@ -10,7 +10,7 @@ const {
const util = require('util')
const { Client } = require('ldapts');
const ldapEscape = require('ldap-escape');
// https://www.npmjs.com/package/@overleaf/o-error
// have a look if we can do nice error messages.
@ -275,7 +275,7 @@ const AuthenticationManager = {
const ldap_base = process.env.LDAP_BASE
var mail = query.email
var uid = query.email.split('@')[0]
const filterstr = '(&' + process.env.LDAP_GROUP_FILTER + '(uid=' + uid + '))'
const filterstr = '(&' + process.env.LDAP_GROUP_FILTER + '(' + ldapEscape.filter`uid=${uid}` + '))'
var userDn = "" //'uid=' + uid + ',' + ldap_bd;
var firstname = ""
var lastname = ""
@ -314,7 +314,7 @@ const AuthenticationManager = {
// if admin filter is set - only set admin for user in ldap group
// does not matter - admin is deactivated: managed through ldap
if (process.env.LDAP_ADMIN_GROUP_FILTER) {
const adminfilter = '(&' + process.env.LDAP_ADMIN_GROUP_FILTER + '(uid=' + uid + '))'
const adminfilter = '(&' + process.env.LDAP_ADMIN_GROUP_FILTER + '(' +ldapEscape.filter`uid=${uid}` + '))'
adminEntry = await client.search(ldap_base, {
scope: 'sub',
filter: adminfilter,
@ -341,6 +341,8 @@ const AuthenticationManager = {
} catch (ex) {
console.log("Could not bind User: " + userDn + " err: " + String(ex))
return callback(null, null)
} finally{
await client.unbind()
}
//console.log("Logging in user: " + mail + " Name: " + firstname + " " + lastname + " isAdmin: " + String(isAdmin))