This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new b2c4a63b5 [OPENMEETINGS-2845] password is made required
b2c4a63b5 is described below
commit b2c4a63b5c2c2b1d61edda69e5c0856b1a60b249
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Mon Oct 19 15:17:25 2026 +0700
[OPENMEETINGS-2845] password is made required
---
.../openmeetings/core/ldap/LdapLoginManager.java | 6 ++-
.../openmeetings/web/pages/auth/SignInDialog.java | 2 +-
.../org/apache/openmeetings/ldap/TestLdap.java | 54 +++++++++++++++++-----
3 files changed, 49 insertions(+), 13 deletions(-)
diff --git
a/openmeetings-core/src/main/java/org/apache/openmeetings/core/ldap/LdapLoginManager.java
b/openmeetings-core/src/main/java/org/apache/openmeetings/core/ldap/LdapLoginManager.java
index 0fa4847c2..8131d8082 100644
---
a/openmeetings-core/src/main/java/org/apache/openmeetings/core/ldap/LdapLoginManager.java
+++
b/openmeetings-core/src/main/java/org/apache/openmeetings/core/ldap/LdapLoginManager.java
@@ -184,7 +184,7 @@ public class LdapLoginManager {
entry = search.getValue();
break;
case SIMPLEBIND:
- userDn = new Dn(String.format(w.options.userDn,
FilterEncoder.encodeFilterValue(login)));
+ userDn = new Dn(String.format(w.options.userDn,
Rdn.escapeValue(login)));
w.conn.bind(userDn, passwd);
break;
case NONE:
@@ -236,6 +236,10 @@ public class LdapLoginManager {
log.error("Invalid login provided");
return null;
}
+ if (passwd == null || passwd.isEmpty()) {
+ log.error("Password is required");
+ throw BAD_CREDENTIALS;
+ }
User u = null;
try (LdapWorker w = new LdapWorker(domainId)) {
diff --git
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInDialog.java
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInDialog.java
index d469d08c3..2e3b4db9c 100644
---
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInDialog.java
+++
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInDialog.java
@@ -137,7 +137,7 @@ public class SignInDialog extends Modal<String> {
@Override
protected void onInitialize() {
loginField.setLabel(new ResourceModel("114"));
- passField.setLabel(new ResourceModel("110"));
+ passField.setLabel(new
ResourceModel("110")).setRequired(true);
super.onInitialize();
if (WebSession.get().isSignedIn()) {
alreadyLoggedIn();
diff --git
a/openmeetings-web/src/test/java/org/apache/openmeetings/ldap/TestLdap.java
b/openmeetings-web/src/test/java/org/apache/openmeetings/ldap/TestLdap.java
index 92b9329c9..0a543e96c 100644
--- a/openmeetings-web/src/test/java/org/apache/openmeetings/ldap/TestLdap.java
+++ b/openmeetings-web/src/test/java/org/apache/openmeetings/ldap/TestLdap.java
@@ -66,6 +66,8 @@ import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
import jakarta.inject.Inject;
@@ -78,6 +80,7 @@ import jakarta.inject.Inject;
@ApplyLdifFiles({"schema/users.ldif"})
public class TestLdap extends AbstractWicketTesterTest {
private static final String CFG_SEARCH_BIND =
UUID.randomUUID().toString();
+ private static final String CFG_SIMPLE_BIND =
UUID.randomUUID().toString();
private static final String BAD_PASSWORD = "bad password";
private static final String USER1 = "ldaptest1";
private static final String USER2 = "ldaptest2";
@@ -117,18 +120,34 @@ public class TestLdap extends AbstractWicketTesterTest {
}
private void createSbnd() throws FileNotFoundException, IOException {
- Properties pp = new Properties();
- pp.putAll(PROPS);
- pp.put(CONFIGKEY_LDAP_AUTH_TYPE,
LdapLoginManager.AuthType.SEARCHANDBIND.name());
- try (OutputStream out = new
FileOutputStream(getLdapConf(CFG_SEARCH_BIND))) {
- pp.store(out, "");
+ { // scope
+ Properties pp = new Properties();
+ pp.putAll(PROPS);
+ pp.put(CONFIGKEY_LDAP_AUTH_TYPE,
LdapLoginManager.AuthType.SEARCHANDBIND.name());
+ try (OutputStream out = new
FileOutputStream(getLdapConf(CFG_SEARCH_BIND))) {
+ pp.store(out, "");
+ }
+ LdapConfig cfg = new LdapConfig();
+ cfg.setName(CFG_SEARCH_BIND);
+ cfg.setActive(true);
+ cfg.setConfigFileName(CFG_SEARCH_BIND);
+ ldapDao.update(cfg, null);
+ CFG_MAP.put(CFG_SEARCH_BIND, cfg);
+ }
+ { // scope
+ Properties pp = new Properties();
+ pp.putAll(PROPS);
+ pp.put(CONFIGKEY_LDAP_AUTH_TYPE,
LdapLoginManager.AuthType.SIMPLEBIND.name());
+ try (OutputStream out = new
FileOutputStream(getLdapConf(CFG_SIMPLE_BIND))) {
+ pp.store(out, "");
+ }
+ LdapConfig cfg = new LdapConfig();
+ cfg.setName(CFG_SIMPLE_BIND);
+ cfg.setActive(true);
+ cfg.setConfigFileName(CFG_SIMPLE_BIND);
+ ldapDao.update(cfg, null);
+ CFG_MAP.put(CFG_SIMPLE_BIND, cfg);
}
- LdapConfig cfg = new LdapConfig();
- cfg.setName(CFG_SEARCH_BIND);
- cfg.setActive(true);
- cfg.setConfigFileName(CFG_SEARCH_BIND);
- ldapDao.update(cfg, null);
- CFG_MAP.put(CFG_SEARCH_BIND, cfg);
}
@BeforeEach
@@ -186,4 +205,17 @@ public class TestLdap extends AbstractWicketTesterTest {
LdapConfig cfg = CFG_MAP.get(CFG_SEARCH_BIND);
assertThrows(OmException.class, () ->
WebSession.get().signIn("admin)(|(uid=*", BAD_PASSWORD, User.Type.LDAP,
cfg.getId()));
}
+
+ @Test
+ void testSimpleBndHijack() {
+ LdapConfig cfg = CFG_MAP.get(CFG_SIMPLE_BIND);
+ assertThrows(OmException.class, () ->
WebSession.get().signIn("admin)(|(uid=*", BAD_PASSWORD, User.Type.LDAP,
cfg.getId()));
+ }
+
+ @ParameterizedTest
+ @NullAndEmptySource
+ void testSimpleBndNoPaswd(String passwd) {
+ LdapConfig cfg = CFG_MAP.get(CFG_SIMPLE_BIND);
+ assertThrows(OmException.class, () ->
WebSession.get().signIn(USER2, passwd, User.Type.LDAP, cfg.getId()));
+ }
}
