Check if a password is not empty to avoid unauthenticated bind

issue2424
review244002
(transplanted from de619252f904a28102bcf3ec746d457dbab78555)

CHANGELOG

@@ -1,3 +1,5 @@
+* Always check if a password is not empty to avoid unauthenticated bind.
+
 Version 2.2.0 - 2011-10-24
 * Bug fixes (see mercurial logs for details)
 

res.py

@@ -124,7 +124,7 @@ class User(ModelSQL, ModelView):
                 con.simple_bind_s(connection.bind_dn, connection.bind_pass)
             [(dn, attrs)] = self.ldap_search_user(login, con, connection,
                     attrs=[str(connection.auth_uid)])
-            if con.simple_bind_s(dn, password):
+            if password and con.simple_bind_s(dn, password):
                 user_id, _, _ = self._get_login(login)
                 if user_id:
                     return user_id