Changeset 786 for trunk

Timestamp:

Apr 26, 2017, 1:14:35 PM (7 years ago)

Author:

autocommit@…

Message:

patch para tener input de variable mas seguro y sacamos la clave por defecto en ldap. Gracias Antoine

File:

• trunk/alternc/patches/class/m_mail_egw.php (modified) (5 diffs)

trunk/alternc/patches/class/m_mail_egw.php

@@ -42 +42 @@
         // usamos
         $mailinfos = $this->get_details($mail_id);
-        $elmail= $mailinfos['address'] ."@" . $mailinfos['domain'];
+        $elmail= escapeshellargs($mailinfos['address'] ."@" . $mailinfos['domain']);
         $err->log("mail_egw", "tries to set password for", $elmail);
 
@@ -56 +56 @@
                 $adminclave = $L_EGW_ADMINCLAVE;
                 //$adminclave= "*******";
-                $account = $elmail;
-
-                $go= $admincli ." " .$command ." " .$adminuser ."," .$adminclave .",\"" .$account ."\"," .$pass ;
+                $account = escapeshellargs($elmail);
+
+                $go= $admincli ." " .$command ." " .$adminuser ."," .$adminclave .",\"" .$account ."\"," .escapeshellargs($pass) ;
 
                 echo "<h3>Actualizamos la contrasena en la base ldap</h3>";
@@ -107 +107 @@
                 $firstname = $mail;                     // the left side of the email
                 $lastname= "-";                         // we have a generic lastname
-                $pass= "*****"; //TEMPORARY
-                $email = $account = $mail ."@" .$domain; // account and email are the same
+                $pass= hash('sha1', rand()); // TEMPORARY
+                $email = $account = escapeshellargs($mail ."@" .$domain); // account and email are the same
                 $expires= "never";
                 $canchangepw= "yes";
@@ -119 +119 @@
                 $loginshell = "/bin/bash";                // everyone can have a shell
 
-                $go= $admincli ." " .$command ." " .$adminuser ."," .$adminclave .",\"" .$account ."\"," .$firstname ."," .$lastname ."," .$pass .",\"" .$email ."\"," .$expires ."," .$canchangepw ."," .$anonuser ."," .$primarygroup ;
+                $go= $admincli ." " .$command ." " .$adminuser ."," .$adminclave .",\"" .$account ."\"," .$firstname ."," .$lastname ."," .escapeshellargs($pass) .",\"" .$email ."\"," .$expires ."," .$canchangepw ."," .$anonuser ."," .$primarygroup ;
         
                 if (isset($secondarygroup)) {
@@ -157 +157 @@
         // usamos 
         $mailinfos = $this->get_details($mail_id);
-        $elmail= $mailinfos['address'] ."@" . $mailinfos['domain'];
+        $elmail= escapeshellargs($mailinfos['address'] ."@" . $mailinfos['domain']);
         $err->log("mail_egw", "tries to delete", $elmail);