Escape LDAP string

This commit is contained in:
Marius Lindvall 2019-12-29 21:39:26 +01:00
parent b169caf778
commit cc4c43ba49

View file

@ -825,7 +825,7 @@ function authenticated() {
if ($ldbind === false) die($LANG["ldap_connection_failed"]);
// Search for the user.
$ldsearch = @ldap_search($ldc, getConfig("ldap_base_dn"), str_replace("%s", $_POST["usr"], getConfig("ldap_user_filter")), array("dn"));
$ldsearch = @ldap_search($ldc, getConfig("ldap_base_dn"), str_replace("%s", ldap_escape($_POST["usr"]), getConfig("ldap_user_filter")), array("dn"));
if ($ldsearch === false) {
ldap_unbind($ldc);
die($LANG["ldap_search_failed"]);