From edae6c8e40057b21679208e34778fdebc1aca5c2 Mon Sep 17 00:00:00 2001
From: Wytze van der Raay <wytze@cacert.org>
Date: Sat, 25 Jul 2015 14:51:01 +0000
Subject: [PATCH] Fix for https://bugs.cacert.org/view.php?id=1392 Issue of
 certificates to arbitrary domains

---
 includes/general.php | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/includes/general.php b/includes/general.php
index 17b449b..e6e440f 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -298,8 +298,14 @@
 				}
 			}
 
-			if($cnok == 0)
+			if(!preg_match("/(?=^.{4,253}$)(^(?:\\*\\.)?((?!-)[a-zA-Z0-9_-]{1,63}(?<!-)\\.)+[a-zA-Z]{2,63}$)/i", $CN)) {
+				$cnok = 0;
+			}
+
+			if($cnok == 0) {
 				$_SESSION['_config']['rejected'][] = $CN;
+				continue;
+			}
 
 			if($_SESSION['_config']['row'] != "")
 				$rows[] = $CN;
@@ -350,8 +356,14 @@
 				}
 			}
 
-			if($altok == 0)
+			if(!preg_match("/(?=^.{4,253}$)(^(?:\\*\\.)?((?!-)[a-zA-Z0-9_-]{1,63}(?<!-)\\.)+[a-zA-Z]{2,63}$)/i", $subalt)) {
+				$altok = 0;
+			}
+
+			if($altok == 0) {
 				$_SESSION['_config']['rejected'][] = $alt;
+				continue;
+			}
 
 			if($_SESSION['_config']['altrow'] != "")
 				$altrows[] = $subalt;
@@ -391,6 +403,10 @@
 				}
 			}
 
+			if(!preg_match("/(?=^.{4,253}$)(^(?:\\*\\.)?((?!-)[a-zA-Z0-9_-]{1,63}(?<!-)\\.)+[a-zA-Z]{2,63}$)/i", $CN)) {
+				continue;
+			}
+
 			if($_SESSION['_config']['row'] != "")
 				$rows[] = $CN;
 		}
@@ -439,6 +455,10 @@
 				}
 			}
 
+			if(!preg_match("/(?=^.{4,253}$)(^(?:\\*\\.)?((?!-)[a-zA-Z0-9_-]{1,63}(?<!-)\\.)+[a-zA-Z]{2,63}$)/i", $subalt)) {
+				continue;
+			}
+
 			if($_SESSION['_config']['altrow'] != "")
 				$altrows[] = $subalt;
 		}