[Security] LDAP Injection in quick search

[ltb-project]

[Security] LDAP Injection in quick search

[coudot]

We indeed need to use ldap_escape: http://php.net/manual/en/function.ldap-escape.php

[plewin]

@coudot depends. ldap_escape is not supported under 5.6. what is the php minimum version for white pages ?

People use the polyfill when supporting previous php (like we do in ssp)
https://github.com/symfony/polyfill-php56

Or the original code
https://stackoverflow.com/questions/8560874/php-ldap-add-function-to-escape-ldap-special-characters-in-dn-syntax

[coudot]

Hello @plewin

I think we can require at least php 5.6 for white pages.

[coudot]

Done. Just "*" is allowed for the moment in advanced search for default text inputs.

[nqb]

Update doc #24 and LTB wiki (https://ltb-project.org/documentation/white-pages/0.2/install_tarball).

Maybe we need to add php 5.6 depends in :

• packaging/rpm/SPECS/white-pages.spec (RPM)
• packaging/debian/conffiles (Debian)

[coudot]

I'm not sure PHP < 5.6 is still packaged on current Deb/RPM distros. We have PHP 5.6 on CentOS 6 and PHP 7 on CentOS 7.

[nqb]

Debian Wheezy (oldoldstable) has PHP 5.4.45 but I don't know if we can run WP on that distro (regarding other depends).

[coudot]

It's not a problem to not support such old versions. Wheezy is supported by Debian as LTS only until may 2018: https://www.debian.org/releases/wheezy/