we previously added support for ',' in the dns attribute by allowing a quoted format. the regex was sadly too restrictive:
in a quoted attribute we'd only allow \w (alphanumeric + _) and the restricted characters. this patch now changes that to everything except " (nearer to the original regex which allowed everything aside from ',') the unquoted attributes now did not allow spaces, but reading the RFC[0] again, spaces are only forbidden at the beginning (also #) and end so fix the regex to accommodate for that Fixes 1aa2355 ("ldap: Allow quoted values for DN attribute values") 0: https://www.ietf.org/rfc/rfc2253.txt Signed-off-by: Dominik Csapak <d.csa...@proxmox.com> --- src/PVE/Auth/LDAP.pm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm index 4d771e7..57782ad 100755 --- a/src/PVE/Auth/LDAP.pm +++ b/src/PVE/Auth/LDAP.pm @@ -10,7 +10,8 @@ use PVE::Tools; use base qw(PVE::Auth::Plugin); -our $dn_regex = qr!\w+=("[\w ,+/<>;=]+"|[^ ,+"/<>;=]+)(,\s*\w+=("[\w ,+/<>;=]+"|[^ ,+"/<>;=]+))*!; +my $dn_part_regex = qr!("[^"]+"|[^ ,+"/<>;=#][^,+"/<>;=]*[^ ,+"/<>;=]|[^,+"/<>;=#])!; +our $dn_regex = qr!\w+=${dn_part_regex}(,\s*\w+=${dn_part_regex})*!; sub type { return 'ldap'; -- 2.30.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel