[PATCH access-control v2] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[PATCH access-control v2] fix #7144: auth: ldap: force utf-8 encoding for bind credentials

[Elias Huhsovitz]

When saving the LDAP/AD bind password to /etc/pve/priv/realm/<realm>.pw,
the file was written using the default byte encoding. This caused
passwords containing non-ASCII characters (e.g., '£' or '§') to be
truncated to their lowest byte, resulting in authentication failures
during subsequent sync operations.

Pass the 'force_utf8' flag to file_set_contents to ensure the password
is encoded as UTF-8 before being written to disk.

Explicitly pass 0600 as the permission mask.
(Previously undef, using the default 0644 for
PVE::File::file_set_contents).

Decode the password into a UTF-8 string after reading from disk.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
changes since v1:
* explain the choice of 0600 in the commit message.
* decode ldap bind credential as UTF-8 before sending it.

 src/PVE/Auth/LDAP.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 6a73ee8..bf6ba17 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -438,7 +438,7 @@ sub ldap_set_credentials {
     my $cred_file = ldap_cred_file_name($realmid);
     mkdir $ldap_pw_dir;
 
-    PVE::Tools::file_set_contents($cred_file, $password);
+    PVE::Tools::file_set_contents($cred_file, $password, 0600, 1);
 
     return $cred_file;
 }
@@ -447,7 +447,8 @@ sub ldap_get_credentials {
     my ($realmid) = @_;
 
     if (my $cred_file = get_cred_file($realmid)) {
-        return PVE::Tools::file_read_firstline($cred_file);
+        my $raw = PVE::Tools::file_read_firstline($cred_file);
+        return defined($raw) ? decode('UTF-8', $raw) : undef;
     }
     return undef;
 }
-- 
2.47.3