From 9d7e0ba94e6e8086e36b6b1e1bd73d56002f1a2a Mon Sep 17 00:00:00 2001
From: Alex Tselegidis <alextselegidis@gmail.com>
Date: Sat, 1 Jun 2024 13:22:15 +0200
Subject: [PATCH] Whitelist the supported LDAP attributes in order to avoid
 parsing issues with Samba AD servers

---
 application/config/constants.php      | 23 ++++++++++++++++++++++-
 application/libraries/Ldap_client.php |  2 +-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/application/config/constants.php b/application/config/constants.php
index 9d607214..339be6b0 100644
--- a/application/config/constants.php
+++ b/application/config/constants.php
@@ -94,7 +94,28 @@ const EVENT_MINIMUM_DURATION = 5; // Minutes
 
 const DEFAULT_COMPANY_COLOR = '#ffffff';
 
-const LDAP_DEFAULT_FILTER = '(&(objectClass=person)(|(cn={{KEYWORD}})(sn={{KEYWORD}})(mail={{KEYWORD}})(givenName={{KEYWORD}})(uid={{KEYWORD}})))';
+const LDAP_DEFAULT_FILTER = '(&(objectClass=*)(|(cn={{KEYWORD}})(sn={{KEYWORD}})(mail={{KEYWORD}})(givenName={{KEYWORD}})(uid={{KEYWORD}})))';
+
+const LDAP_WHITELISTED_ATTRIBUTES = [
+    'givenname',
+    'cn',
+    'dn',
+    'sn',
+    'mail',
+    'telephonenumber',
+    'description',
+    'member',
+    'objectclass',
+    'objectcategory',
+    'instancetype',
+    'whencreated',
+    'name',
+    'samaccountname',
+    'samaccounttype',
+    'objectcategory',
+    'memberof',
+    'distinguishedname',
+];
 
 const LDAP_DEFAULT_FIELD_MAPPING = [
     'first_name' => 'givenname',
diff --git a/application/libraries/Ldap_client.php b/application/libraries/Ldap_client.php
index 56684509..9c55e642 100644
--- a/application/libraries/Ldap_client.php
+++ b/application/libraries/Ldap_client.php
@@ -221,7 +221,7 @@ class Ldap_client
             ];
 
             foreach ($ldap_entry as $key => $value) {
-                if (!is_array($value)) {
+                if (!is_array($value) || !in_array($key, LDAP_WHITELISTED_ATTRIBUTES)) {
                     continue;
                 }