-
-
Notifications
You must be signed in to change notification settings - Fork 400
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[16.0][FIX] users_ldap_groups: safe LDAP decode #596
base: 16.0
Are you sure you want to change the base?
Conversation
a7c568b
to
162ecfc
Compare
This same bug affects all other versions, too. I'm about to give up writing the test coverage for this change because codecov keeps complaining about everything I try. (Especially I didn't understand why it demands test coverage for the tests, too.) My idea is to add binary data to the LDAP response, e.g., a minimal GIF image as the LDAP attribute
|
Tested with Odoo 16.0.20240102 on Ubuntu 22.04. |
789dafd
to
080ae25
Compare
d663b58
to
a38accd
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm no ldap specialist at all, but I understand the vulnerability and your fix seems both reasonable and safe so I approve it. Let's give it a couple more days to see if we get another reviewer. If not I will be able to merge it.
But yeah the ldap module isn't very actively maintained and possibly the maintainers just missed your issue. You could eventually propose yourself as a module maintainer (adding your GitHub user to the maintainers value of the module manifest file in a PR will be enough to enable to let you merge and publish improvements in the module).
Thank you for the fix.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for submitting this fix.
For next time, note security@odoo-community.org may be contacted for reporting such issues.
This decode-that-encodes-in-base64 looks a bit weird to me. Why is the Perhaps, to move faster, you could do the security fix in a PR, so I can merge this, and do the decode improvement in another PR and work on that one with folks who are more familiar with this module? |
This simply replaces the original So, why not use this Does this satisfactorily explain the situation here? |
The group mapping in query mode fails if LDAP returns binary data in any of the fields. This adds a function that handles such situation by base64 encoding it. The new test test_users_ldap_groups_ldap_returns_binary_data covers the common case where LDAP return binary data in thumbnailPhoto.
Rebased to fix the checks that didn't pass; the problem was in another module. Could someone please review & merge this already? |
The group mapping in query mode fails if LDAP returns binary data in any of the fields. This adds a function that handles such situation by base64 encoding it.