Check no extra fields are present when parsing credentials.

(This used to be commit fff081d3440373071d8859b7a7d71cf6489126a4)

1 files changed, 17 insertions, 2 deletions

diff --git a/source3/python/py_common.c b/source3/python/py_common.c
index 6247bf6371..e21858e072 100644
--- a/source3/python/py_common.c
+++ b/source3/python/py_common.c
@@ -144,6 +144,8 @@ BOOL py_parse_creds(PyObject *creds, char **username, char **domain,
 
 	if (creds && PyDict_Size(creds) > 0) {
 		PyObject *username_obj, *password_obj, *domain_obj;
+		PyObject *key, *value;
+		int i;
 
 		/* Check for presence of required fields */
 
@@ -166,8 +168,6 @@ BOOL py_parse_creds(PyObject *creds, char **username, char **domain,
 			return False;
 		}
 
-		/* Look for any other fields */
-
 		/* Check type of required fields */
 
 		if (!PyString_Check(username_obj)) {
@@ -185,6 +185,21 @@ BOOL py_parse_creds(PyObject *creds, char **username, char **domain,
 			return False;
 		}
 
+		/* Look for any extra fields */
+
+		i = 0;
+
+		while (PyDict_Next(creds, &i, &key, &value)) {
+			if (strcmp(PyString_AsString(key), "domain") != 0 &&
+			    strcmp(PyString_AsString(key), "username") != 0 &&
+			    strcmp(PyString_AsString(key), "password") != 0) {
+				asprintf(errstr,
+					 "creds contain extra field '%s'",
+					 PyString_AsString(key));
+				return False;
+			}
+		}
+
 		/* Assign values */
 
 		*username = PyString_AsString(username_obj);