Merge jcrygier's LDAP injection defense and displayname/email retrieval

Add LDAP logic to retrieve display name & email address
Add code / test to defend against LDAP injection attacks.

diff --cc distrib/gitblit.properties
Simple merge

diff --cc src/com/gitblit/LdapUserService.java
index ec84c9566ab479d6ef2dacb89f4fc3c7948b36b1,674e2a0d05634d07bd011237ef737de654a49046..80a966ddb3adc44dbca1ae18da59618ec78e9fc6
--- 1/src/com/gitblit/LdapUserService.java
--- 2/src/com/gitblit/LdapUserService.java
+++ b/src/com/gitblit/LdapUserService.java
@@@ -135,9 -135,9 +135,9 @@@ public class LdapUserService extends Gi
                LDAPConnection ldapConnection = getLdapConnection();            \r
                if (ldapConnection != null) {\r
                        // Find the logging in user's DN\r
 -                      String accountBase = settings.getString(Keys.realm.ldap_accountBase, "");\r
 -                      String accountPattern = settings.getString(Keys.realm.ldap_accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");\r
 +                      String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");\r
 +                      String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");\r
-                       accountPattern = StringUtils.replace(accountPattern, "${username}", simpleUsername);\r
+                       accountPattern = StringUtils.replace(accountPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));\r
  \r
                        SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);\r
                        if (result != null && result.getEntryCount() == 1) {\r
@@@ -186,16 -186,47 +186,47 @@@
                        user.canAdmin = true;\r
            }\r
        }\r
 -              String displayName = settings.getString(Keys.realm.ldap_displayName, "displayName");\r
 -              String email = settings.getString(Keys.realm.ldap_email, "email");\r
+       \r
+       private void setUserAttributes(UserModel user, SearchResultEntry userEntry) {\r
+               // Is this user an admin?\r
+               setAdminAttribute(user);\r
+               \r
+               // Don't want visibility into the real password, make up a dummy\r
+               user.password = "StoredInLDAP";\r
+               \r
+               // Get Attributes for full name / email\r
++              String displayName = settings.getString(Keys.realm.ldap.displayName, "displayName");\r
++              String email = settings.getString(Keys.realm.ldap.email, "email");\r
+ \r
+               // Replace embedded ${} with attributes\r
+               if (displayName.contains("${")) {\r
+                       for (Attribute userAttribute : userEntry.getAttributes())\r
+                               displayName = StringUtils.replace(displayName, "${" + userAttribute.getName() + "}", userAttribute.getValue());\r
+                       \r
+                       user.displayName = displayName;\r
+               } else {\r
+                       user.displayName = userEntry.getAttribute(displayName).getValue();\r
+               }\r
+               \r
+               if (email.contains("${")) {\r
+                       for (Attribute userAttribute : userEntry.getAttributes())\r
+                               email = StringUtils.replace(email, "${" + userAttribute.getName() + "}", userAttribute.getValue());\r
+                       \r
+                       user.emailAddress = email;\r
+               } else {\r
+                       user.emailAddress = userEntry.getAttribute(email).getValue();\r
+               }\r
+       }\r
  \r
        private void getTeamsFromLdap(LDAPConnection ldapConnection, String simpleUsername, SearchResultEntry loggingInUser, UserModel user) {\r
                String loggingInUserDN = loggingInUser.getDN();\r
                \r
                user.teams.clear();             // Clear the users team memberships - we're going to get them from LDAP\r
 -              String groupBase = settings.getString(Keys.realm.ldap_groupBase, "");\r
 -              String groupMemberPattern = settings.getString(Keys.realm.ldap_groupMemberPattern, "(&(objectClass=group)(member=${dn}))");\r
 +              String groupBase = settings.getString(Keys.realm.ldap.groupBase, "");\r
 +              String groupMemberPattern = settings.getString(Keys.realm.ldap.groupMemberPattern, "(&(objectClass=group)(member=${dn}))");\r
                \r
-               groupMemberPattern = StringUtils.replace(groupMemberPattern, "${dn}", loggingInUserDN);\r
-               groupMemberPattern = StringUtils.replace(groupMemberPattern, "${username}", simpleUsername);\r
+               groupMemberPattern = StringUtils.replace(groupMemberPattern, "${dn}", escapeLDAPSearchFilter(loggingInUserDN));\r
+               groupMemberPattern = StringUtils.replace(groupMemberPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));\r
                \r
                // Fill in attributes into groupMemberPattern\r
                for (Attribute userAttribute : loggingInUser.getAttributes())\r

diff --cc src/com/gitblit/models/UserModel.java
index ecb97cfca706a1ed0c0ac2402e10ff93f275c266,925edf91ee83013bf24150e0126f0467b6c9c6c6..b0e57fd296e3fd0173222e6fef4ddddfa54ec2cd
--- 1/src/com/gitblit/models/UserModel.java
--- 2/src/com/gitblit/models/UserModel.java
+++ b/src/com/gitblit/models/UserModel.java
@@@ -112,6 -114,6 +114,13 @@@ public class UserModel implements Princ
        public String getName() {\r
                return username;\r
        }\r
++      \r
++      public String getDisplayName() {\r
++              if (StringUtils.isEmpty(displayName)) {\r
++                      return username;\r
++              }\r
++              return displayName;\r
++      }\r
  \r
        @Override\r
        public String toString() {\r

diff --cc tests/com/gitblit/tests/LdapUserServiceTest.java
index 48c974163f258b90e083ad0c9c3f63d8008ea5f4,c7e95c369a4b5159fc18c6562756353a520e514c..390fa00118a1d94e3196cb830cdf922bfda9eb5a
--- 1/tests/com/gitblit/tests/LdapUserServiceTest.java
--- 2/tests/com/gitblit/tests/LdapUserServiceTest.java
+++ b/tests/com/gitblit/tests/LdapUserServiceTest.java
@@@ -45,13 -47,11 +47,13 @@@ public class LdapUserServiceTest 
        
        private LdapUserService ldapUserService;
        
-       int ldapPort = 1389;
++      static int ldapPort = 1389;
 +      
-       @Before
-       public void createInMemoryLdapServer() throws Exception {
+       @BeforeClass
+       public static void createInMemoryLdapServer() throws Exception {
                InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=MyDomain");
                config.addAdditionalBindCredentials("cn=Directory Manager", "password");
 -              config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("default", 389));
 +              config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("default", ldapPort));
                config.setSchema(null);
                
                InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
@@@ -61,8 -61,13 +63,13 @@@
        
        @Before
        public void createLdapUserService() {
+               ldapUserService = new LdapUserService();
+               ldapUserService.setup(getSettings());
+       }
+       
+       private MemorySettings getSettings() {
                Map<Object, Object> backingMap = new HashMap<Object, Object>();
 -              backingMap.put("realm.ldap.server", "ldap://localhost:389");
 +              backingMap.put("realm.ldap.server", "ldap://localhost:" + ldapPort);
                backingMap.put("realm.ldap.domain", "");
                backingMap.put("realm.ldap.username", "cn=Directory Manager");
                backingMap.put("realm.ldap.password", "password");