Allow a wider range of characters to be used in certificate fields, as laid out by RFC 4514. Fixes #7540

1 files changed, 16 insertions, 0 deletions

diff --git a/src/etc/inc/certs.inc b/src/etc/inc/certs.inc
index cb3d1b1..b30a607 100644
--- a/src/etc/inc/certs.inc
+++ b/src/etc/inc/certs.inc
@@ -995,4 +995,20 @@ function cert_get_cn($crt, $isref = false) {
 	return "";
 }
 
+function cert_escape_x509_chars($str, $reverse = false) {
+	/* Characters which need escaped when present in x.509 fields.
+	 * See https://www.ietf.org/rfc/rfc4514.txt
+	 *
+	 * The backslash (\) must be listed first in these arrays!
+	 */
+	$cert_directory_string_special_chars = array('\\', '"', '#', '+', ',', ';', '<', '=', '>');
+	$cert_directory_string_special_chars_esc = array('\\\\', '\"', '\#', '\+', '\,', '\;', '\<', '\=', '\>');
+	if ($reverse) {
+		return str_replace($cert_directory_string_special_chars_esc, $cert_directory_string_special_chars, $str);
+	} else {
+		/* First unescape and then escape again, to prevent possible double escaping. */
+		return str_replace($cert_directory_string_special_chars, $cert_directory_string_special_chars_esc, cert_escape_x509_chars($str, true));
+	}
+}
+
 ?>