ldap_auth: An empty password worked for any valid user

See: go-ldap/ldap#93
segevfiner · Dec 23, 2016 · 655f41e · 655f41e
1 parent b5b63d9
commit 655f41e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
@@ -54,7 +54,7 @@ func NewLDAPAuth(c *LDAPAuthConfig) (*LDAPAuth, error) {
 
 //How to authenticate user, please refer to https://github.com/go-ldap/ldap/blob/master/example_test.go#L166
 func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool, Labels, error) {
-	if account == "" {
+	if account == "" || password == "" {
 		return false, nil, NoMatch
 	}
 	l, err := la.ldapConnection()