#
# Security fix for LDAP anonymous bind bypassing authentication (#1293)
# Licensed under the GPLv2
# Olivier Bilodeau <obilodeau@inverse.ca>
#
# old_revision [54c13c3b3b2d4c2f4035d84fe8f3ced73bb882e0]
#
# patch "pf/html/admin/login.php"
#  from [437daaaf2a52b935008754acd28d6b71d1d33220]
#    to [3091155d3aee619c63b0ac5aa32708fbd5c8903d]
#
============================================================
--- pf/html/admin/login.php	437daaaf2a52b935008754acd28d6b71d1d33220
+++ pf/html/admin/login.php	3091155d3aee619c63b0ac5aa32708fbd5c8903d
@@ -39,9 +39,9 @@ function check_input($input){
   }
 } 
 
-# rejecting NULLs because they end-up doing an anonymous LDAP bind
+# rejecting NULLs or empty strings because they end-up doing an anonymous LDAP bind
 function check_password($input){
-  if (isset($input)) {
+  if (isset($input) && !is_null($input) && !empty($input)) {
     return true;
   } else {
     print "Invalid password<br>";

#
# Security fix for LDAP injection (#1293)
# Licensed under the GPLv2
# Olivier Bilodeau <obilodeau@inverse.ca>
#
# old_revision [d0aba756a3e8ff9002c0dd9be1885ea6d38ea0ff]
#
# patch "pf/html/admin/login.php"
#  from [5a1ccaad2d60f3ff17308787bc48e58b5b7fc161]
#    to [52a09fcc6fa308e31f25088f3fa1e283b7a18b77]
#
============================================================
--- pf/html/admin/login.php	5a1ccaad2d60f3ff17308787bc48e58b5b7fc161
+++ pf/html/admin/login.php	52a09fcc6fa308e31f25088f3fa1e283b7a18b77
@@ -30,7 +30,7 @@ function check_input($input){
 }
 
 function check_input($input){
-  if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]/", $input) && strlen($input) <= 15){
+  if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]+$/", $input) && strlen($input) <= 15){
     return true; 
   }        
   else{

*** login.php	2011-10-21 09:25:39.000000000 -0400
--- login_1.php	2011-10-21 09:22:25.000000000 -0400
***************
*** 8,14 ****
  }
  
  function check_input($input){
!   if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]/", $input) && strlen($input) <= 15){
      return true; 
    }        
    else{
--- 29,35 ----
  }
  
  function check_input($input){
!   if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]+$/", $input) && strlen($input) <= 15){  
      return true; 
    }        
    else{
***************
*** 17,22 ****
--- 38,54 ----
    }
  } 
  
+ # rejecting NULLs or empty strings because they end-up doing an anonymous LDAP bind
+ function legal_password($input){
+   global $logger;
+   if (isset($input) && !is_null($input) && !empty($input)) {
+     return true;
+   } else {
+     $logger->info("Empty passwords are explicitly rejected");
+     return false;
+   }
+ }
+ 
  //TODO are we being too difficult on what we accept as a password? ie: pass starting with ; is invalid
  function check_sensitive_input($input){
    if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]/", $input) && strlen($input) <= 15){
***************
*** 165,171 ****
      }
    }
  
!   if (isset($_POST['username'], $_POST['password']) && check_input($_POST['username']) && check_sensitive_input($_POST['password'])) {
      $hash = validate_user($_POST['username'], $_POST['password']);
      if(!$hash || !isset($_COOKIE['test'])){
        $failed = true;
--- 227,233 ----
      }
    }
  
!    if (isset($_POST['username'], $_POST['password']) && check_input($_POST['username']) && legal_password($_POST['password']) && check_sensitive_input($_POST['password'])) {  
      $hash = validate_user($_POST['username'], $_POST['password']);
      if(!$hash || !isset($_COOKIE['test'])){
        $failed = true;