Add more LDAP escaping rules from RFC 2253

diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index aa709cd..53c966c 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -848,7 +848,9 @@ static int ldap_escape_func(char *out, int outlen, const char *in)
                /*
                 *      Encode unsafe characters.
                 */
-               if (strchr("*=\\,()", *in)) {
+               if (((len == 0) &&
+                   ((in[0] == ' ') || (in[0] == '#'))) ||
+                   (strchr(",+\"\\<>;*=()", *in))) {
                        static const char hex[] = "0123456789abcdef";
 
                        /*