Comment 3 for bug 1187305

Revision history for this message
Jose Castro Leon (jose-castro-leon) wrote : Re: LDAP vulnerability when checking user credentials

The problem there is in the get_connection part of the ldap module, if no user or password is specified it doesn't do the simple bind. So the quickest fix is to avoid call this function with empty user or password in the authenticate method.

There is another way by forcing the simple_bind_s when doing the authentication, but there could be users that don't use authentication and store their passwords in user ldap attributes.