Do not allow to set empty bind passwords to be set via AuthLDAPBindPassword
Binds with empty passwords always succeed, but in case the password of the
user was not empty subsequent LDAP operations fail.
@@ -1719,6 +1719,10 @@ static const char *set_bind_password(cmd_parms *cmd, void *_cfg, const char *arg
sec->bindpw = (char *)arg;
}
+ if (!(*sec->bindpw)) {
+ return "Empty passwords are invalid for AuthLDAPBindPassword";
+ }
+
return NULL;
}
