upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-26 11:22:28 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Merge pull request #32282 from nextcloud/backport/32246/stable24

Browse source 
[stable24] Don't use hash to check if binding worked
This commit is contained in:
Côme Chilliet 2022-05-09 09:30:55 +02:00 committed by GitHub
commit f2810d0725
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
apps/user_ldap/lib/Connection.php
View file

@ -128,7 +128,7 @@ class Connection extends LDAPUtility {
protected $ignoreValidation = false;
/**
* @var array{dn?: mixed, hash?: string, result?: bool}
* @var array{sum?: string, result?: bool}
*/
protected $bindResult = [];
@ -672,11 +672,7 @@ class Connection extends LDAPUtility {
if (
count($this->bindResult) !== 0
&& $this->bindResult['dn'] === $this->configuration->ldapAgentName
&& \OC::$server->getHasher()->verify(
$this->configPrefix . $this->configuration->ldapAgentPassword,
$this->bindResult['hash']
)
&& $this->bindResult['sum'] === md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword)
) {
// don't attempt to bind again with the same data as before
// bind might have been invoked via getConnectionResource(),
@ -689,8 +685,7 @@ class Connection extends LDAPUtility {
$this->configuration->ldapAgentPassword);
$this->bindResult = [
'dn' => $this->configuration->ldapAgentName,
'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
'sum' => md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword),
'result' => $ldapLogin,
];