From 82aa341a5fa7830c658024308ac7c134511af6b6 Mon Sep 17 00:00:00 2001 From: Wolfgang Sourdeau Date: Thu, 4 Jun 2009 14:42:50 +0000 Subject: [PATCH] Monotone-Parent: 5a279242bcd0a7239b0fee3400fe08b944a04d51 Monotone-Revision: fbaf51f1b9944aee510a816b001f424db9802648 Monotone-Author: wsourdeau@inverse.ca Monotone-Date: 2009-06-04T14:42:50 Monotone-Branch: ca.inverse.sogo --- ChangeLog | 3 +++ SoObjects/Contacts/SOGoContactGCSFolder.m | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index a27c11639..39eeb62a7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2009-06-04 Wolfgang Sourdeau + * SoObjects/Contacts/SOGoContactGCSFolder.m + (-lookupContactsWithFilter:sortBy:ordering:): same as below. + * SoObjects/SOGo/LDAPSource.m: properly escaped user-entered strings which may contain quotes and thereby mess up the LDAP queries. diff --git a/SoObjects/Contacts/SOGoContactGCSFolder.m b/SoObjects/Contacts/SOGoContactGCSFolder.m index 0ba541de5..8c627c1e4 100644 --- a/SoObjects/Contacts/SOGoContactGCSFolder.m +++ b/SoObjects/Contacts/SOGoContactGCSFolder.m @@ -216,7 +216,8 @@ if (filter && [filter length] > 0) { - filter = [filter stringByReplacingString: @"'" withString: @"\\'\\'"]; + filter = [[filter stringByReplacingString: @"\\" withString: @"\\\\"] + stringByReplacingString: @"'" withString: @"\\'\\'"]; qs = [NSString stringWithFormat: @"(c_sn isCaseInsensitiveLike: '%@%%') OR " @"(c_givenname isCaseInsensitiveLike: '%@%%') OR "