From 698ed2606dadfd71bf86a1dfaa565fbb98646004 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 21 Jun 2022 10:17:02 +0200
Subject: [PATCH] Enforce certificate validation for LDAP connection

issue11564
review417381003
(grafted from 366cca2d391e3fda2e038b34a032f4acf0efdce5)

--HG--
branch : 6.0
---
 CHANGELOG | 2 ++
 res.py    | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 190100b0ab..a071087b9f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,5 @@
+* Enforce certificate validation for LDAP connection (issue11564)
+
 Version 6.0.0 - 2021-05-03
 * Bug fixes (see mercurial logs for details)
 
diff --git a/res.py b/res.py
index 2bd22293df..7c08eea49f 100644
--- a/res.py
+++ b/res.py
@@ -1,6 +1,7 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
 import logging
+import ssl
 import urllib.parse
 
 import ldap3
@@ -42,10 +43,12 @@ def ldap_server():
     uri, _, _, _, _, extensions = parse_ldap_url(uri)
     if uri.scheme.startswith('ldaps'):
         scheme, port = 'ldaps', 636
+        tls = ldap3.Tls(validate=ssl.CERT_REQUIRED)
     else:
         scheme, port = 'ldap', 389
+        tls = None
     return ldap3.Server('%s://%s:%s' % (
-            scheme, uri.hostname, uri.port or port))
+            scheme, uri.hostname, uri.port or port), tls=tls)
 
 
 class User(metaclass=PoolMeta):