LDAP login not possible with double quote in password

[kaese]

We use phpMyFAQ with ActiveDirectory ldap login configured. If the user password contains a double quote ( " ) the user cannot login. The message "Wrong login name or password." is displayed instead. We use phpMyFAQ 2.8.26.

[thorsten]

I might have a fix, but I need your help, is that possible?

[kaese]

Sure, just let me know what to do.

[thorsten]

Please could you try to add to this line

https://github.com/thorsten/phpMyFAQ/blob/2.8/phpmyfaq/inc/PMF/Auth/Ldap.php#L206

the following:

stripslashes($password)

Thank you!

[kaese]

stripslashes did not do the trick, but htmlspecialchars_decode did. Adding it around

https://github.com/thorsten/phpMyFAQ/blob/2.8/phpmyfaq/inc/PMF/Auth/Ldap.php#L206
https://github.com/thorsten/phpMyFAQ/blob/2.8/phpmyfaq/inc/PMF/Auth/Ldap.php#L209
https://github.com/thorsten/phpMyFAQ/blob/2.8/phpmyfaq/inc/PMF/Auth/Ldap.php#L213

fixed the problem.

Thanks for pointing me into the right direction.