From ad061af4edaea8023fa84a9c5406c4a14bbd4614 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <andrew@morphoss.com>
Date: Sun, 13 Mar 2011 04:28:14 +1300
Subject: [PATCH] Apparently an attempt to bind with an empty password will
 return TRUE!

Signed-off-by: Andrew McMillan <andrew@morphoss.com>
---
 inc/drivers_ldap.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/inc/drivers_ldap.php b/inc/drivers_ldap.php
index 6aa16f45..0e459014 100644
--- a/inc/drivers_ldap.php
+++ b/inc/drivers_ldap.php
@@ -209,7 +209,12 @@ class ldapDrivers
       if ($username != $_SERVER["REMOTE_USER"]) {
         return false;
       }
-    } else {
+    }
+    else if ( empty($passwd) ) {
+      dbg_error_log( 'LDAP', 'drivers_ldap : user %s did not supply a password: login rejected', $dnUser );
+      return false;
+    }
+    else {
       if ( !@ldap_bind($this->connect, $dnUser, $passwd) ) {
         dbg_error_log( "LDAP", "drivers_ldap : Failed to bind to user %s using password %s", $dnUser, $passwd );
         return false;