From c30c2b332cf498efef9a01609ff4aa5bd7f8cc14 Mon Sep 17 00:00:00 2001 From: Jani Averbach Date: Mon, 31 Mar 2014 00:55:43 +0300 Subject: LDAP: Escape username in case we are using userbased bind. --- src/main/java/com/gitblit/auth/LdapAuthProvider.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/main/java/com/gitblit/auth/LdapAuthProvider.java b/src/main/java/com/gitblit/auth/LdapAuthProvider.java index 892f30ba..83f24669 100644 --- a/src/main/java/com/gitblit/auth/LdapAuthProvider.java +++ b/src/main/java/com/gitblit/auth/LdapAuthProvider.java @@ -299,7 +299,7 @@ public class LdapAuthProvider extends UsernamePasswordAuthenticationProvider { String bindPattern = settings.getString(Keys.realm.ldap.bindpattern, ""); if (!StringUtils.isEmpty(bindPattern)) { try { - String bindUser = StringUtils.replace(bindPattern, "${username}", simpleUsername); + String bindUser = StringUtils.replace(bindPattern, "${username}", escapeLDAPSearchFilter(simpleUsername)); ldapConnection.bind(bindUser, new String(password)); alreadyAuthenticated = true; -- cgit v1.2.3