Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not allow LDAP login with empty password #1345

Merged
merged 2 commits into from
Oct 24, 2020
Merged

Conversation

satterly
Copy link
Member

@satterly satterly commented Oct 24, 2020

(venv) ➜  python-alerta-client git:(master) http -v :8080/auth/login username=foo password=
POST /auth/login HTTP/1.1
Accept: application/json, */*;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 35
Content-Type: application/json
Host: localhost:8080
User-Agent: HTTPie/2.1.0

{
    "username": "foo",
    "password": ""
}

HTTP/1.0 401 UNAUTHORIZED
Access-Control-Allow-Origin: http://localhost
Content-Length: 131
Content-Type: application/json
Date: Sat, 24 Oct 2020 20:31:10 GMT
Server: Werkzeug/1.0.1 Python/3.7.3
Vary: Origin
X-Request-ID: 06eefaf8-1716-49de-998f-e3c05f59292e

{
    "code": 401,
    "errors": null,
    "message": "password not allowed to be empty",
    "requestId": null,
    "status": "error"
}

Fixes #1277

@satterly satterly merged commit 2bfa317 into master Oct 24, 2020
@satterly satterly added the security This important issue will not be marked as stale by @probot label Nov 5, 2020
saivarunr pushed a commit to rudderlabs/alerta that referenced this pull request Nov 27, 2021
Do not allow LDAP login with empty password
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security This important issue will not be marked as stale by @probot
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Disallow LDAP anonymous bind
1 participant