Fix slight bug about trustedDomains regex: domains might be tampered (#467)

12 years ago · 65252af36b
parent ec22ab2592
commit 65252af36b
1 changed files with 1 additions and 1 deletions
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Simple.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Simple.pm
@ -458,7 +458,7 @@ sub new {
    $self->{trustedDomains} = "*"
      if ( $self->{trustedDomains} =~ /(^|\s)\*(\s|$)/ );
    if ( $self->{trustedDomains} and $self->{trustedDomains} ne "*" ) {
-        $self->{trustedDomains} =~ s#(^|\s+)\.#[^/]+.#g;
+        $self->{trustedDomains} =~ s#((^|\s+))\.#${1}[^/]+.#g;
        $self->{trustedDomains} =
          '(' . join( '|', split( /\s+/, $self->{trustedDomains} ) ) . ')';
        $self->{trustedDomains} =~ s/\./\\./g;