{"action":"created","issue":{"url":"https://api.github.com/repos/ltb-project/white-pages/issues/21","repository_url":"https://api.github.com/repos/ltb-project/white-pages","labels_url":"https://api.github.com/repos/ltb-project/white-pages/issues/21/labels{/name}","comments_url":"https://api.github.com/repos/ltb-project/white-pages/issues/21/comments","events_url":"https://api.github.com/repos/ltb-project/white-pages/issues/21/events","html_url":"https://github.com/ltb-project/white-pages/issues/21","id":293471503,"number":21,"title":"[Security] LDAP Injection in quick search","user":{"login":"nqb","id":10830260,"avatar_url":"https://avatars2.githubusercontent.com/u/10830260?v=4","gravatar_id":"","url":"https://api.github.com/users/nqb","html_url":"https://github.com/nqb","followers_url":"https://api.github.com/users/nqb/followers","following_url":"https://api.github.com/users/nqb/following{/other_user}","gists_url":"https://api.github.com/users/nqb/gists{/gist_id}","starred_url":"https://api.github.com/users/nqb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nqb/subscriptions","organizations_url":"https://api.github.com/users/nqb/orgs","repos_url":"https://api.github.com/users/nqb/repos","events_url":"https://api.github.com/users/nqb/events{/privacy}","received_events_url":"https://api.github.com/users/nqb/received_events","type":"User","site_admin":false},"labels":[{"id":466716154,"url":"https://api.github.com/repos/ltb-project/white-pages/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/ltb-project/white-pages/milestones/1","html_url":"https://github.com/ltb-project/white-pages/milestone/1","labels_url":"https://api.github.com/repos/ltb-project/white-pages/milestones/1/labels","id":2178502,"number":1,"title":"0.2","description":null,"creator":{"login":"coudot","id":883396,"avatar_url":"https://avatars1.githubusercontent.com/u/883396?v=4","gravatar_id":"","url":"https://api.github.com/users/coudot","html_url":"https://github.com/coudot","followers_url":"https://api.github.com/users/coudot/followers","following_url":"https://api.github.com/users/coudot/following{/other_user}","gists_url":"https://api.github.com/users/coudot/gists{/gist_id}","starred_url":"https://api.github.com/users/coudot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coudot/subscriptions","organizations_url":"https://api.github.com/users/coudot/orgs","repos_url":"https://api.github.com/users/coudot/repos","events_url":"https://api.github.com/users/coudot/events{/privacy}","received_events_url":"https://api.github.com/users/coudot/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":5,"state":"open","created_at":"2016-12-06T10:23:00Z","updated_at":"2018-02-02T18:12:39Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2018-02-01T10:08:46Z","updated_at":"2018-02-02T19:11:26Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nCurrently, it is possible to make an LDAP injection when using quick search because `$search_query` is use directly in `$ldap_filter`.\r\n\r\nSteps to reproduce : \r\n- Go https://ltb-project.org/star-pages/\r\n- In quick search, enter `c3po)(uid=*sky`\r\n=> WP returns three results : c3po, lskywalker, askywalker\r\n\r\nWith this kind of `$search_query`, you can request an LDAP attribute which not mentioned in `$quick_search_attributes`."},"comment":{"url":"https://api.github.com/repos/ltb-project/white-pages/issues/comments/362677751","html_url":"https://github.com/ltb-project/white-pages/issues/21#issuecomment-362677751","issue_url":"https://api.github.com/repos/ltb-project/white-pages/issues/21","id":362677751,"user":{"login":"coudot","id":883396,"avatar_url":"https://avatars1.githubusercontent.com/u/883396?v=4","gravatar_id":"","url":"https://api.github.com/users/coudot","html_url":"https://github.com/coudot","followers_url":"https://api.github.com/users/coudot/followers","following_url":"https://api.github.com/users/coudot/following{/other_user}","gists_url":"https://api.github.com/users/coudot/gists{/gist_id}","starred_url":"https://api.github.com/users/coudot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coudot/subscriptions","organizations_url":"https://api.github.com/users/coudot/orgs","repos_url":"https://api.github.com/users/coudot/repos","events_url":"https://api.github.com/users/coudot/events{/privacy}","received_events_url":"https://api.github.com/users/coudot/received_events","type":"User","site_admin":false},"created_at":"2018-02-02T19:11:26Z","updated_at":"2018-02-02T19:11:26Z","author_association":"OWNER","body":"Hello @plewin \r\n\r\nI think we can require at least php 5.6 for white pages."}}
{"actor":{"display_login":"coudot"}}