Don't apply the group filter when listing LDAP group membership if it is empty (go-gitea#23745)

zeripath · GiteaBot · commit 2e067393425c · 2023-03-29T09:55:21.000Z
When running listLdapGroupMemberships check if the groupFilter is empty before using it to list memberships. Fix go-gitea#23615 Signed-off-by: Andrew Thornton <art27@cantab.net>
diff --git a/services/auth/source/ldap/source_search.go b/services/auth/source/ldap/source_search.go
@@ -208,7 +208,7 @@ func (source *Source) listLdapGroupMemberships(l *ldap.Conn, uid string, applyGr
 	}
 
 	var searchFilter string
-	if applyGroupFilter {
+	if applyGroupFilter && groupFilter != "" {
 		searchFilter = fmt.Sprintf("(&(%s)(%s=%s))", groupFilter, source.GroupMemberUID, ldap.EscapeFilter(uid))
 	} else {
 		searchFilter = fmt.Sprintf("(%s=%s)", source.GroupMemberUID, ldap.EscapeFilter(uid))

Original file line number	Diff line number	Diff line change
`@@ -208,7 +208,7 @@ func (source Source) listLdapGroupMemberships(l ldap.Conn, uid string, applyGr`
`208`	`208`	`}`
`209`	`209`
`210`	`210`	`var searchFilter string`
`211`		`- if applyGroupFilter {`
	`211`	`+ if applyGroupFilter && groupFilter != "" {`
`212`	`212`	`searchFilter = fmt.Sprintf("(&(%s)(%s=%s))", groupFilter, source.GroupMemberUID, ldap.EscapeFilter(uid))`
`213`	`213`	`} else {`
`214`	`214`	`searchFilter = fmt.Sprintf("(%s=%s)", source.GroupMemberUID, ldap.EscapeFilter(uid))`