From 741f0183e6dda33b7458cc1e897c0a2397c07196 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Thu, 16 Mar 2017 22:43:43 +0000
Subject: [PATCH 1/7] Prevent ldap injections in autocompletion views

We only allow alphanumeric characters in the query in order to avoid
injections
---
 gestioncof/autocomplete.py | 34 ++++++++++++++++++----------------
 kfet/autocomplete.py       | 34 ++++++++++++++++++----------------
 2 files changed, 36 insertions(+), 32 deletions(-)

diff --git a/gestioncof/autocomplete.py b/gestioncof/autocomplete.py
index 1eae6920..65f62fab 100644
--- a/gestioncof/autocomplete.py
+++ b/gestioncof/autocomplete.py
@@ -56,22 +56,24 @@ def autocomplete(request):
     # Fetching data from the SPI
     if hasattr(settings, 'LDAP_SERVER_URL'):
         # Fetching
-        ldap_query = '(|{:s})'.format(''.join(
-            ['(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(**{"bit": bit})
-             for bit in bits]
-        ))
-        with Connection(settings.LDAP_SERVER_URL) as conn:
-            conn.search(
-                'dc=spi,dc=ens,dc=fr', ldap_query,
-                attributes=['uid', 'cn']
-            )
-            queries['clippers'] = conn.entries
-        # Clearing redundancies
-        queries['clippers'] = [
-            Clipper(clipper.uid, clipper.cn)
-            for clipper in queries['clippers']
-            if str(clipper.uid) not in usernames
-        ]
+        ldap_query = '(|{:s})'.format(''.join([
+            '(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=bit)
+            for bit in bits if bit.isalnum()
+        ]))
+        if ldap_query != "(|)":
+            # If none of the bits were legal, we do not perform the query
+            with Connection(settings.LDAP_SERVER_URL) as conn:
+                conn.search(
+                    'dc=spi,dc=ens,dc=fr', ldap_query,
+                    attributes=['uid', 'cn']
+                )
+                queries['clippers'] = conn.entries
+            # Clearing redundancies
+            queries['clippers'] = [
+                Clipper(clipper.uid, clipper.cn)
+                for clipper in queries['clippers']
+                if str(clipper.uid) not in usernames
+            ]
 
     # Resulting data
     data.update(queries)
diff --git a/kfet/autocomplete.py b/kfet/autocomplete.py
index 64fa52cf..3b5e0ab5 100644
--- a/kfet/autocomplete.py
+++ b/kfet/autocomplete.py
@@ -75,22 +75,24 @@ def account_create(request):
     # Fetching data from the SPI
     if hasattr(settings, 'LDAP_SERVER_URL'):
         # Fetching
-        ldap_query = '(|{:s})'.format(''.join(
-            ['(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=word)
-             for word in search_words]
-        ))
-        with Connection(settings.LDAP_SERVER_URL) as conn:
-            conn.search(
-                'dc=spi,dc=ens,dc=fr', ldap_query,
-                attributes=['uid', 'cn']
-            )
-            queries['clippers'] = conn.entries
-        # Clearing redundancies
-        queries['clippers'] = [
-            Clipper(clipper.uid, clipper.cn)
-            for clipper in queries['clippers']
-            if str(clipper.uid) not in usernames
-        ]
+        ldap_query = '(|{:s})'.format(''.join([
+            '(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=word)
+            for word in search_words if word.isalnum()
+        ]))
+        if ldap_query != "(|)":
+            # If none of the bits were legal, we do not perform the query
+            with Connection(settings.LDAP_SERVER_URL) as conn:
+                conn.search(
+                    'dc=spi,dc=ens,dc=fr', ldap_query,
+                    attributes=['uid', 'cn']
+                )
+                queries['clippers'] = conn.entries
+            # Clearing redundancies
+            queries['clippers'] = [
+                Clipper(clipper.uid, clipper.cn)
+                for clipper in queries['clippers']
+                if str(clipper.uid) not in usernames
+            ]
 
     # Resulting data
     data.update(queries)

From 55b67f38c8a4e61ddf7e51a4e851ed23e2a4204b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Thu, 16 Mar 2017 23:16:56 +0000
Subject: [PATCH 2/7] =?UTF-8?q?Notice=20the=20users=20about=20the=20=CE=B1?=
 =?UTF-8?q?-numeric=20restriction?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a help text above the two autocompletion inputs letting the users
know that non-alphanumeric characters will not be used.
---
 gestioncof/static/css/cof.css           | 9 ++++++++-
 gestioncof/templates/registration.html  | 5 +++--
 kfet/static/kfet/css/index.css          | 4 ++++
 kfet/templates/kfet/account_create.html | 1 +
 4 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/gestioncof/static/css/cof.css b/gestioncof/static/css/cof.css
index 269736d0..fda55d98 100644
--- a/gestioncof/static/css/cof.css
+++ b/gestioncof/static/css/cof.css
@@ -800,7 +800,7 @@ input#search_autocomplete {
  height: 40px;
  padding: 10px 8px;
  margin: 0 auto;
- margin-top: 20px;
+ margin-top: 0px;
  display: block;
  color: #aaa;
 }
@@ -1119,3 +1119,10 @@ div.messages div.alert-success div.container {
 div.messages div.alert div.container a {
     color: inherit;
 }
+
+/* Help text */
+
+p.help-block {
+  margin: 5px auto;
+  width: 90%;
+}
diff --git a/gestioncof/templates/registration.html b/gestioncof/templates/registration.html
index 769808de..d6914f64 100644
--- a/gestioncof/templates/registration.html
+++ b/gestioncof/templates/registration.html
@@ -9,7 +9,9 @@
 
 {% block realcontent %}
     <h2>Inscription d'un nouveau membre</h2>
-    <input type="text" name="q" id="search_autocomplete" spellcheck="false" />
+    <p class="help-block">Les mots contentant des caractères non alphanumériques seront ignorés</p>
+    <input type="text" name="q" id="search_autocomplete" spellcheck="false"
+           placeholder="Chercher un utilisateur par nom, prénom ou identifiant clipper" />
     <div id="form-placeholder"></div>
     <div class="yourlabs-autocomplete"></div>
     <script type="text/javascript">
@@ -20,7 +22,6 @@
                 minimumCharacters: 3,
                 id: 'search_autocomplete',
                 choiceSelector: 'li:has(a)',
-                placeholder: "Chercher un utilisateur par nom, prénom ou identifiant clipper",
                 box: $(".yourlabs-autocomplete"),
             });
             $('input#search_autocomplete').bind(
diff --git a/kfet/static/kfet/css/index.css b/kfet/static/kfet/css/index.css
index f3e9bf8c..ce6c5be7 100644
--- a/kfet/static/kfet/css/index.css
+++ b/kfet/static/kfet/css/index.css
@@ -341,3 +341,7 @@ textarea {
 .help h4 {
     margin:15px 0;
 }
+
+.help-block {
+    padding-top: 15px;
+}
diff --git a/kfet/templates/kfet/account_create.html b/kfet/templates/kfet/account_create.html
index ac6c5daa..9c5b09a5 100644
--- a/kfet/templates/kfet/account_create.html
+++ b/kfet/templates/kfet/account_create.html
@@ -23,6 +23,7 @@
           {{ trigramme_form.trigramme }}
         </div>
         <div id="trigramme_valid"></div>
+        <p class="help-block">Les mots contentant des caractères non alphanumériques seront ignorés</p>
         <input type="text" name="q" id="search_autocomplete" spellcheck="false" placeholder="Chercher un utilisateur par nom, prénom ou identifiant clipper" class="form-control">
         <div style="position:relative;">
           <div id="search_results"></div>

From 4899bba1f78168b78ad6e353eb2d6f08ef87577e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Sun, 19 Mar 2017 14:05:25 +0000
Subject: [PATCH 3/7] Replace list comprehensions by iterators in dal

---
 gestioncof/autocomplete.py | 4 ++--
 kfet/autocomplete.py       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gestioncof/autocomplete.py b/gestioncof/autocomplete.py
index 65f62fab..7caea48b 100644
--- a/gestioncof/autocomplete.py
+++ b/gestioncof/autocomplete.py
@@ -56,10 +56,10 @@ def autocomplete(request):
     # Fetching data from the SPI
     if hasattr(settings, 'LDAP_SERVER_URL'):
         # Fetching
-        ldap_query = '(|{:s})'.format(''.join([
+        ldap_query = '(|{:s})'.format(''.join(
             '(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=bit)
             for bit in bits if bit.isalnum()
-        ]))
+        ))
         if ldap_query != "(|)":
             # If none of the bits were legal, we do not perform the query
             with Connection(settings.LDAP_SERVER_URL) as conn:
diff --git a/kfet/autocomplete.py b/kfet/autocomplete.py
index 3b5e0ab5..d8582ccb 100644
--- a/kfet/autocomplete.py
+++ b/kfet/autocomplete.py
@@ -75,10 +75,10 @@ def account_create(request):
     # Fetching data from the SPI
     if hasattr(settings, 'LDAP_SERVER_URL'):
         # Fetching
-        ldap_query = '(|{:s})'.format(''.join([
+        ldap_query = '(|{:s})'.format(''.join(
             '(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=word)
             for word in search_words if word.isalnum()
-        ]))
+        ))
         if ldap_query != "(|)":
             # If none of the bits were legal, we do not perform the query
             with Connection(settings.LDAP_SERVER_URL) as conn:

From dc50a23b1045fcddd3dd486c7d43f9402ccb4b6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Sun, 19 Mar 2017 14:48:04 +0000
Subject: [PATCH 4/7] Escape the content of the regex in `highligh_text`

---
 gestioncof/templatetags/utils.py | 2 +-
 kfet/templatetags/kfet_tags.py   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gestioncof/templatetags/utils.py b/gestioncof/templatetags/utils.py
index 90855165..76bc6003 100644
--- a/gestioncof/templatetags/utils.py
+++ b/gestioncof/templatetags/utils.py
@@ -23,7 +23,7 @@ def key(d, key_name):
 
 
 def highlight_text(text, q):
-    q2 = "|".join(q.split())
+    q2 = "|".join(re.escape(word) for word in q.split())
     pattern = re.compile(r"(?P<filter>%s)" % q2, re.IGNORECASE)
     return mark_safe(re.sub(pattern,
                             r"<span class='highlight'>\g<filter></span>",
diff --git a/kfet/templatetags/kfet_tags.py b/kfet/templatetags/kfet_tags.py
index b3976326..c8b6a228 100644
--- a/kfet/templatetags/kfet_tags.py
+++ b/kfet/templatetags/kfet_tags.py
@@ -11,7 +11,7 @@ register = template.Library()
 
 
 def highlight_text(text, q):
-    q2 = "|".join(q.split())
+    q2 = "|".join(re.escape(word) for word in q.split())
     pattern = re.compile(r"(?P<filter>%s)" % q2, re.IGNORECASE)
     regex = r"<span class='highlight_autocomplete'>\g<filter></span>"
     return mark_safe(re.sub(pattern, regex, text))

From 74f0b63e9641504b25c1c865a12fdee6d3fb0ce1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Sun, 19 Mar 2017 15:06:41 +0000
Subject: [PATCH 5/7] Change ldap query behaviour if multiple inputs

It is now consistent with the other lookups over the User database
---
 gestioncof/autocomplete.py | 4 ++--
 kfet/autocomplete.py       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gestioncof/autocomplete.py b/gestioncof/autocomplete.py
index 7caea48b..1146e1c0 100644
--- a/gestioncof/autocomplete.py
+++ b/gestioncof/autocomplete.py
@@ -56,8 +56,8 @@ def autocomplete(request):
     # Fetching data from the SPI
     if hasattr(settings, 'LDAP_SERVER_URL'):
         # Fetching
-        ldap_query = '(|{:s})'.format(''.join(
-            '(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=bit)
+        ldap_query = '(&{:s})'.format(''.join(
+            '(|(cn=*{bit:s}*)(uid=*{bit:s}*))'.format(bit=bit)
             for bit in bits if bit.isalnum()
         ))
         if ldap_query != "(|)":
diff --git a/kfet/autocomplete.py b/kfet/autocomplete.py
index d8582ccb..2dd3c32f 100644
--- a/kfet/autocomplete.py
+++ b/kfet/autocomplete.py
@@ -75,8 +75,8 @@ def account_create(request):
     # Fetching data from the SPI
     if hasattr(settings, 'LDAP_SERVER_URL'):
         # Fetching
-        ldap_query = '(|{:s})'.format(''.join(
-            '(cn=*{bit:s}*)(uid=*{bit:s}*)'.format(bit=word)
+        ldap_query = '(&{:s})'.format(''.join(
+            '(|(cn=*{bit:s}*)(uid=*{bit:s}*))'.format(bit=word)
             for word in search_words if word.isalnum()
         ))
         if ldap_query != "(|)":

From 0aed975615f9f5869223742f2c11287b13a02129 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Mon, 20 Mar 2017 08:14:20 +0000
Subject: [PATCH 6/7] Fix the empty-query test in autocomplete

If there is no valid word to search in the LDAP database, no query is
performed. Since 74f0b63e, that behaviour was broken because of a typo
---
 gestioncof/autocomplete.py | 2 +-
 kfet/autocomplete.py       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gestioncof/autocomplete.py b/gestioncof/autocomplete.py
index 1146e1c0..a9abbad7 100644
--- a/gestioncof/autocomplete.py
+++ b/gestioncof/autocomplete.py
@@ -60,7 +60,7 @@ def autocomplete(request):
             '(|(cn=*{bit:s}*)(uid=*{bit:s}*))'.format(bit=bit)
             for bit in bits if bit.isalnum()
         ))
-        if ldap_query != "(|)":
+        if ldap_query != "(&)":
             # If none of the bits were legal, we do not perform the query
             with Connection(settings.LDAP_SERVER_URL) as conn:
                 conn.search(
diff --git a/kfet/autocomplete.py b/kfet/autocomplete.py
index 2dd3c32f..c0019bf9 100644
--- a/kfet/autocomplete.py
+++ b/kfet/autocomplete.py
@@ -79,7 +79,7 @@ def account_create(request):
             '(|(cn=*{bit:s}*)(uid=*{bit:s}*))'.format(bit=word)
             for word in search_words if word.isalnum()
         ))
-        if ldap_query != "(|)":
+        if ldap_query != "(&)":
             # If none of the bits were legal, we do not perform the query
             with Connection(settings.LDAP_SERVER_URL) as conn:
                 conn.search(

From 59f57793babf718004b78821d9651626aaa43c6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Mon, 20 Mar 2017 22:05:48 +0000
Subject: [PATCH 7/7] typo

---
 gestioncof/templates/registration.html  | 2 +-
 kfet/templates/kfet/account_create.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gestioncof/templates/registration.html b/gestioncof/templates/registration.html
index d6914f64..8f05dfb0 100644
--- a/gestioncof/templates/registration.html
+++ b/gestioncof/templates/registration.html
@@ -9,7 +9,7 @@
 
 {% block realcontent %}
     <h2>Inscription d'un nouveau membre</h2>
-    <p class="help-block">Les mots contentant des caractères non alphanumériques seront ignorés</p>
+    <p class="help-block">Les mots contenant des caractères non alphanumériques seront ignorés</p>
     <input type="text" name="q" id="search_autocomplete" spellcheck="false"
            placeholder="Chercher un utilisateur par nom, prénom ou identifiant clipper" />
     <div id="form-placeholder"></div>
diff --git a/kfet/templates/kfet/account_create.html b/kfet/templates/kfet/account_create.html
index 9c5b09a5..3b4829d8 100644
--- a/kfet/templates/kfet/account_create.html
+++ b/kfet/templates/kfet/account_create.html
@@ -23,7 +23,7 @@
           {{ trigramme_form.trigramme }}
         </div>
         <div id="trigramme_valid"></div>
-        <p class="help-block">Les mots contentant des caractères non alphanumériques seront ignorés</p>
+        <p class="help-block">Les mots contenant des caractères non alphanumériques seront ignorés</p>
         <input type="text" name="q" id="search_autocomplete" spellcheck="false" placeholder="Chercher un utilisateur par nom, prénom ou identifiant clipper" class="form-control">
         <div style="position:relative;">
           <div id="search_results"></div>