]> git.ipfire.org Git - thirdparty/apache/httpd.git/commit
Before doing any bind check that the provided username is not NULL and that the
authorRuediger Pluem <rpluem@apache.org>
Wed, 27 Jan 2021 08:08:56 +0000 (08:08 +0000)
committerRuediger Pluem <rpluem@apache.org>
Wed, 27 Jan 2021 08:08:56 +0000 (08:08 +0000)
commitec1d14ccf6d4f8061f3aea0f4d9870f5c445f5c9
treede0043fc4b32e7120b500b4b646bfa7db953d6b9
parent3e4c918fba9fe8306eed1fcbdc19699af30e23b8
Before doing any bind check that the provided username is not NULL and that the
password is neither NULL nor empty.

Binds with empty passwords always succeed, but in case the password of the
user was not empty subsequent LDAP operations fail.
This causes authentications that use user supplied credentials
(AuthLDAPInitialBindAsUser set to on) to fail with status code 500 instead of
401 if the user supplied an empty password.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1885940 13f79535-47bb-0310-9956-ffa450edef68
modules/aaa/mod_authnz_ldap.c