ITS#4647: error on bad filter patterns

diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c
index 578bda60e6b43f526092517c9cf7f8a94492c44a..8e0a632133c593a19bb1fac4c421b7233942183c 100644 (file)
--- a/clients/tools/ldapsearch.c
+++ b/clients/tools/ldapsearch.c
@@ -676,12 +676,32 @@ main( int argc, char **argv )
        }
 
        if ( infile != NULL ) {
+               int percent = 0;
+       
                if ( infile[0] == '-' && infile[1] == '\0' ) {
                        fp = stdin;
                } else if (( fp = fopen( infile, "r" )) == NULL ) {
                        perror( infile );
                        return EXIT_FAILURE;
                }
+
+               for( i=0 ; filtpattern[i] ; i++ ) {
+                       if( filtpattern[i] == '%' ) {
+                               if( percent ) {
+                                       fprintf( stderr, _("Bad filter pattern \"%s\"\n"),
+                                               filtpattern );
+                                       return EXIT_FAILURE;
+                               }
+
+                               percent++;
+
+                               if( filtpattern[i+1] != 's' ) {
+                                       fprintf( stderr, _("Bad filter pattern \"%s\"\n"),
+                                               filtpattern );
+                                       return EXIT_FAILURE;
+                               }
+                       }
+               }
        }
 
        if ( tmpdir == NULL ) {

diff --git a/doc/man/man1/ldapsearch.1 b/doc/man/man1/ldapsearch.1
index f274fb26e46e867af9d0fb27facbb516de5e17e2..65ed177d1979b4fc9d7bf77c8db258e8944ecedc 100644 (file)
--- a/doc/man/man1/ldapsearch.1
+++ b/doc/man/man1/ldapsearch.1
@@ -165,9 +165,13 @@ must be compiled with LDAP_DEBUG defined for this option to have any effect.
 .BI \-f \ file
 Read a series of lines from \fIfile\fP, performing one LDAP search for
 each line.  In this case, the \fIfilter\fP given on the command line
-is treated as a pattern where the first occurrence of \fB%s\fP is
-replaced with a line from \fIfile\fP.  If \fIfile\fP is a single \fI-\fP
-character, then the lines are read from standard input.
+is treated as a pattern where the first and only occurrence of \fB%s\fP
+is replaced with a line from \fIfile\fP.  Any other occurence of the
+the \fB%\fP character in the pattern will be regarded as an error.
+Where it is desired that the search filter include a \fB%\fP character,
+the character should be encoded as \fB\\25\fP (see RFC 4515).
+If \fIfile\fP is a single
+\fI-\fP character, then the lines are read from standard input.
 .TP
 .B \-x 
 Use simple authentication instead of SASL.