From a35298e7f37ebb7c48076f6c3fc2707473c2258e Mon Sep 17 00:00:00 2001 From: Deon George Date: Fri, 29 Apr 2011 12:08:38 +1000 Subject: [PATCH] SF Bug #3036033 - Error if CN begins with a % sign --- htdocs/add_attr_form.php | 2 +- htdocs/create.php | 4 ++-- htdocs/create_confirm.php | 4 ++-- htdocs/update.php | 2 +- htdocs/update_confirm.php | 4 ++-- lib/AJAXTree.php | 14 +++++++------- lib/Query.php | 8 ++++++++ lib/QueryRender.php | 4 ++-- lib/Template.php | 16 ++++++++++++++++ lib/TemplateRender.php | 24 ++++++++++++------------ lib/TreeItem.php | 4 ++++ 11 files changed, 57 insertions(+), 29 deletions(-) diff --git a/htdocs/add_attr_form.php b/htdocs/add_attr_form.php index dda6edc..7f72841 100644 --- a/htdocs/add_attr_form.php +++ b/htdocs/add_attr_form.php @@ -169,7 +169,7 @@ if (get_request('meth','REQUEST') != 'ajax') { echo ''; printf(''; printf('',$app['server']->getIndex()); - printf('',htmlspecialchars($request['template']->getContainer())); + printf('',$request['template']->getContainerEncode(false)); printf('',$request['template']->getID()); foreach ($request['template']->getRDNAttrs() as $rdn) printf('',htmlspecialchars($rdn)); @@ -127,7 +127,7 @@ if (count($request['template']->getLDAPadd(true))) { } else { $href = sprintf('cmd=template_engine&server_id=%s&dn=%s', - $app['server']->getIndex(),rawurlencode($request['dn'])); + $app['server']->getIndex(),$request['template']->getDNEncode()); echo '
'; echo _('You made no changes'); diff --git a/htdocs/update.php b/htdocs/update.php index f2e1833..45762cf 100644 --- a/htdocs/update.php +++ b/htdocs/update.php @@ -64,7 +64,7 @@ if ($result) { } $redirect_url = sprintf('cmd.php?cmd=template_engine&server_id=%s&dn=%s', - $app['server']->getIndex(),rawurlencode($request['dn'])); + $app['server']->getIndex(),$request['template']->getDNEncode()); foreach ($request['template']->getLDAPmodify() as $attr => $junk) $redirect_url .= sprintf('&modified_attrs[]=%s',$attr); diff --git a/htdocs/update_confirm.php b/htdocs/update_confirm.php index 28842c5..037b91d 100644 --- a/htdocs/update_confirm.php +++ b/htdocs/update_confirm.php @@ -42,7 +42,7 @@ if (count($request['template']->getLDAPmodify(true))) { echo '
'; echo ''; printf('',$app['server']->getIndex()); - printf('',htmlspecialchars($request['dn'])); + printf('',$request['template']->getDNEncode(false)); echo "\n"; $request['page']->drawHiddenAttributes(); @@ -221,7 +221,7 @@ if (count($request['template']->getLDAPmodify(true))) { } else { $href = sprintf('cmd=template_engine&server_id=%s&dn=%s', - $app['server']->getIndex(),rawurlencode($request['dn'])); + $app['server']->getIndex(),$request['template']->getDNEncode()); echo '
'; echo _('You made no changes'); diff --git a/lib/AJAXTree.php b/lib/AJAXTree.php index f2652c0..300a976 100644 --- a/lib/AJAXTree.php +++ b/lib/AJAXTree.php @@ -57,7 +57,7 @@ class AJAXTree extends HTMLTree { return ''; # Get our children. - $child_count = $this->readChildrenNumber($item); + $child_count = $this->readChildrenNumber($entry->getDN()); $nb = 0; if ($first_child) @@ -81,12 +81,12 @@ class AJAXTree extends HTMLTree { $new_code = array('1','1','0','0'); # Links - $parms['openclose'] = htmlspecialchars(sprintf('server_id=%s&dn=%s&code=%s%s',$this->getServerID(),rawurlencode($item),$code,$new_code[$nb])); - $parms['edit'] = htmlspecialchars(sprintf('cmd=template_engine&server_id=%s&dn=%s',$this->getServerID(),rawurlencode($item))); + $parms['openclose'] = htmlspecialchars(sprintf('server_id=%s&dn=%s&code=%s%s',$this->getServerID(),$entry->getDNEncode(),$code,$new_code[$nb])); + $parms['edit'] = htmlspecialchars(sprintf('cmd=template_engine&server_id=%s&dn=%s',$this->getServerID(),$entry->getDNEncode())); $href = sprintf('cmd.php?%s',$parms['edit']); # Each node has a unique id based on dn - $node_id = sprintf('node%s',base64_encode(sprintf('%s-%s',$server->getIndex(),$item))); + $node_id = sprintf('node%s',base64_encode(sprintf('%s-%s',$server->getIndex(),$entry->getDN()))); $node_id = str_replace('=','_',$node_id); if ($level == 0) @@ -110,12 +110,12 @@ class AJAXTree extends HTMLTree { echo ''; } - printf('',$href,$parms['edit'],_('Retrieving DN'),htmlspecialchars($item)); + printf('',$href,$parms['edit'],_('Retrieving DN'),htmlspecialchars($entry->getDN())); printf('->',$node_id,IMGDIR,$entry->getIcon($server)); echo ''; echo ' '; - printf('',$href,$parms['edit'],_('Retrieving DN'),htmlspecialchars($item)); + printf('',$href,$parms['edit'],_('Retrieving DN'),htmlspecialchars($entry->getDN())); echo $this->get_formatted_dn($entry,$level-1); echo ($child_count ? (sprintf(' (%s%s)',$child_count,($entry->isSizeLimited() ? '+' : ''))) : ''); echo ''; @@ -264,7 +264,7 @@ class AJAXTree extends HTMLTree { $output = ''; - $href = sprintf('cmd=template_engine&server_id=%s&container=%s',$this->getServerID(),rawurlencode($entry->getDN())); + $href = sprintf('cmd=template_engine&server_id=%s&container=%s',$this->getServerID(),$entry->getDNEncode()); $output .= $this->get_indentation($level); $output .= sprintf('--',$img); diff --git a/lib/Query.php b/lib/Query.php index 869bb9f..a6941e5 100644 --- a/lib/Query.php +++ b/lib/Query.php @@ -195,6 +195,14 @@ class Query extends xmlTemplate { return $this->dn; } + public function getDNEncode($url=true) { + // @todo Be nice to do all this in 1 location + if ($url) + return urlencode(preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->dn)); + else + return preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->dn); + } + public function getAttrSortOrder() { if (DEBUG_ENABLED && (($fargs=func_get_args())||$fargs='NOARGS')) debug_log('Entered (%%)',5,0,__FILE__,__LINE__,__METHOD__,$fargs); diff --git a/lib/QueryRender.php b/lib/QueryRender.php index 140a22c..291ec40 100644 --- a/lib/QueryRender.php +++ b/lib/QueryRender.php @@ -273,7 +273,7 @@ class QueryRender extends PageRender { printf('icon',IMGDIR,get_icon($server->getIndex(),$dndetails['dn'])); printf('%s', - $server->getIndex(),rawurlencode($dndetails['dn']),htmlspecialchars(get_rdn($dndetails['dn']))); + $server->getIndex(),$this->template->getDNEncode(),htmlspecialchars(get_rdn($dndetails['dn']))); echo ''; printf(' dn%s', @@ -363,7 +363,7 @@ class QueryRender extends PageRender { if ($_SESSION[APPCONFIG]->getValue('mass','enabled')) printf('',$j,$dndetails['dn']); - $href = sprintf('cmd=template_engine&server_id=%s&dn=%s',$server->getIndex(),rawurlencode($dndetails['dn'])); + $href = sprintf('cmd=template_engine&server_id=%s&dn=%s',$server->getIndex(),$this->template->getDNEncode()); printf('icon', htmlspecialchars($href), IMGDIR,get_icon($server->getIndex(),$dndetails['dn'])); diff --git a/lib/Template.php b/lib/Template.php index 295ac46..0406795 100644 --- a/lib/Template.php +++ b/lib/Template.php @@ -634,6 +634,14 @@ class Template extends xmlTemplate { return $this->getRDN(); } + public function getDNEncode($url=true) { + // @todo Be nice to do all this in 1 location + if ($url) + return urlencode(preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->getDN())); + else + return preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->getDN()); + } + /** * Set the container for this template, if we are creating entries * @@ -665,6 +673,14 @@ class Template extends xmlTemplate { return $this->container; } + public function getContainerEncode($url=true) { + // @todo Be nice to do all this in 1 location + if ($url) + return urlencode(preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->container)); + else + return preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->container); + } + /** * Copy a DN */ diff --git a/lib/TemplateRender.php b/lib/TemplateRender.php index 58aaf83..5adffa8 100644 --- a/lib/TemplateRender.php +++ b/lib/TemplateRender.php @@ -53,7 +53,7 @@ class TemplateRender extends PageRender { parent::accept(); $this->url_base = sprintf('server_id=%s&dn=%s', - $this->getServerID(),rawurlencode($this->template->getDN())); + $this->getServerID(),$this->template->getDNEncode()); $this->layout['hint'] = sprintf('%s%%s', IMGDIR,_('Hint')); $this->layout['action'] = '%s%s'; @@ -646,7 +646,7 @@ class TemplateRender extends PageRender { } elseif ($this->template->getContext() == 'copyasnew') { $this->drawStepFormStart($this->page); - printf('',htmlspecialchars($this->template->getContainer())); + printf('',$this->template->getContainer(false)); echo '
'; $this->drawRDNChooser(); echo '
'; @@ -699,7 +699,7 @@ class TemplateRender extends PageRender { break; case 'modification': - $title = get_rdn($this->dn); + $title = htmlspecialchars(get_rdn($this->dn)); break; default: @@ -1188,7 +1188,7 @@ class TemplateRender extends PageRender { if (DEBUGTMP) printf('%s
',__METHOD__); - $href = sprintf('cmd=template_engine&server_id=%s&container=%s',$this->getServerID(),rawurlencode($this->template->getDN())); + $href = sprintf('cmd=template_engine&server_id=%s&container=%s',$this->getServerID(),$this->template->getDNEncode()); if (isAjaxEnabled()) return sprintf($this->layout['actionajax'],IMGDIR,'create.png',_('Create'), @@ -1227,7 +1227,7 @@ class TemplateRender extends PageRender { if (DEBUGTMP) printf('%s
',__METHOD__); $href = sprintf('cmd=query_engine&server_id=%s&filter=%s&base=%s&scope=one&query=none&size_limit=0&search=true', - $this->getServerID(),rawurlencode('objectClass=*'),rawurlencode($this->template->getDN())); + $this->getServerID(),rawurlencode('objectClass=*'),$this->template->getDNEncode()); if (isAjaxEnabled()) return sprintf($this->layout['actionajax'],IMGDIR,'children.png',_('Children'), @@ -1389,7 +1389,7 @@ class TemplateRender extends PageRender { echo '
'; printf('',$this->getServerID()); - printf('',htmlspecialchars($this->template->getDN())); + printf('',$this->template->getDNEncode(false)); printf('',$this->template->getID()); echo '
'; @@ -1514,7 +1514,7 @@ class TemplateRender extends PageRender { $this->drawObjectClassChooser(); } else { - printf('',htmlspecialchars($this->template->getContainer())); + printf('',$this->template->getContainerEncode(false)); echo '
'; echo ''; @@ -2075,7 +2075,7 @@ function fillRec(id,value) { if (DEBUGTMP) printf('%s
',__METHOD__); $href_parm = htmlspecialchars(sprintf('cmd=add_value_form&server_id=%s&dn=%s&attr=%s', - $this->getServerID(),rawurlencode($this->template->getDN()),rawurlencode($attribute->getName(false)))); + $this->getServerID(),$this->template->getDNEncode(),rawurlencode($attribute->getName(false)))); if (isAjaxEnabled()) return sprintf('(%s)', @@ -2093,7 +2093,7 @@ function fillRec(id,value) { if (DEBUGTMP) printf('%s
',__METHOD__); $href_parm = htmlspecialchars(sprintf('cmd=add_value_form&server_id=%s&dn=%s&attr=%s', - $this->getServerID(),rawurlencode($this->template->getDN()),rawurlencode($attribute->getName(false)))); + $this->getServerID(),$this->template->getDNEncode(),rawurlencode($attribute->getName(false)))); if (isAjaxEnabled()) return sprintf('(%s)', @@ -2111,7 +2111,7 @@ function fillRec(id,value) { if (DEBUGTMP) printf('%s
',__METHOD__); $href = sprintf('cmd=modify_member_form&server_id=%s&dn=%s&attr=%s', - $this->getServerID(),rawurlencode($this->template->getDN()),rawurlencode($attribute->getName())); + $this->getServerID(),$this->template->getDNEncode(),rawurlencode($attribute->getName())); if (isAjaxEnabled()) return sprintf('(%s)', @@ -2130,7 +2130,7 @@ function fillRec(id,value) { if (DEBUGTMP) printf('%s
',__METHOD__); $href = sprintf('cmd.php?cmd=rename_form&server_id=%s&dn=%s&template=%s', - $this->getServerID(),rawurlencode($this->template->getDN()),$this->template->getID()); + $this->getServerID(),$this->template->getDNEncode(),$this->template->getID()); return sprintf('(%s)',htmlspecialchars($href),_('rename')); } @@ -2285,7 +2285,7 @@ function fillRec(id,value) { echo ''; echo ''; printf('',$this->getServerID()); - printf('',htmlspecialchars($this->template->getDN())); + printf('',$this->template->getDNEncode()); printf('',$this->template->getID()); echo ''; echo ''; diff --git a/lib/TreeItem.php b/lib/TreeItem.php index 61cee56..8c95ad8 100644 --- a/lib/TreeItem.php +++ b/lib/TreeItem.php @@ -58,6 +58,10 @@ class TreeItem { return $this->dn; } + public function getDNEncode() { + return urlencode(preg_replace('/%([0-9a-fA-F]+)/',"%25\\1",$this->dn)); + } + /** * Get the RDN of this tree items DN. *