From 8eed9fc5101da8caa1c8ffd84d4f741ba084a55a Mon Sep 17 00:00:00 2001
From: Udo Spallek <udono@virtual-things.biz>
Date: Fri, 10 Feb 2012 07:01:38 +0000
Subject: [PATCH] Check if a password is not empty to avoid unauthenticated
 bind issue2424 review244002 (transplanted from
 de619252f904a28102bcf3ec746d457dbab78555)

---
 CHANGELOG | 2 ++
 res.py    | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index f989c92cd4..17838defaa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,5 @@
+* Always check if a password is not empty to avoid unauthenticated bind.
+
 Version 2.2.0 - 2011-10-24
 * Bug fixes (see mercurial logs for details)
 
diff --git a/res.py b/res.py
index d34e93e44f..65b07f260b 100644
--- a/res.py
+++ b/res.py
@@ -124,7 +124,7 @@ class User(ModelSQL, ModelView):
                 con.simple_bind_s(connection.bind_dn, connection.bind_pass)
             [(dn, attrs)] = self.ldap_search_user(login, con, connection,
                     attrs=[str(connection.auth_uid)])
-            if con.simple_bind_s(dn, password):
+            if password and con.simple_bind_s(dn, password):
                 user_id, _, _ = self._get_login(login)
                 if user_id:
                     return user_id