From 6319ae4fb8c10dabc9464ad49faec532096fbcb5 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 31 May 2026 11:50:37 +0100
Subject: Fix escaping LDAP search filters in ldapauth and ldapoper.

---
 src/modules/m_ldapoper.cpp | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'src/modules/m_ldapoper.cpp')

diff --git a/src/modules/m_ldapoper.cpp b/src/modules/m_ldapoper.cpp
index 14776b913..8b8b4ec19 100644
--- a/src/modules/m_ldapoper.cpp
+++ b/src/modules/m_ldapoper.cpp
@@ -151,10 +151,10 @@ class AdminBindInterface final
 	const std::string opername;
 	const std::string password;
 	const std::string base;
-	const std::string what;
+	const LDAPAttribute what;
 
 public:
-	AdminBindInterface(Module* c, const std::string& p, const std::string& u, const std::string& o, const std::string& pa, const std::string& b, const std::string& w)
+	AdminBindInterface(Module* c, const std::string& p, const std::string& u, const std::string& o, const std::string& pa, const std::string& b, const LDAPAttribute& w)
 		: LDAPInterface(c)
 		, provider(p)
 		, user(u)
@@ -172,7 +172,8 @@ public:
 		{
 			try
 			{
-				LDAP->Search(new SearchInterface(this->creator, provider, user, opername, password), base, what);
+				const auto sf = INSP_FORMAT("{}={}", what.first, LDAP->EscapeSF(what.second));
+				LDAP->Search(new SearchInterface(this->creator, provider, user, opername, password), base, sf);
 			}
 			catch (const LDAPException& ex)
 			{
@@ -233,7 +234,9 @@ public:
 
 			try
 			{
-				std::string what = attribute + "=" + opername;
+				LDAPAttribute what;
+				what.first = attribute;
+				what.second = opername;
 				LDAP->BindAsManager(new AdminBindInterface(this, LDAP.GetProvider(), user->uuid, opername, password, base, what));
 				return MOD_RES_DENY;
 			}
-- 
cgit v1.3.1-10-gc9f91