Classic298 b78dabb442 fix: reject empty passwords in LDAP authentication to prevent unauthenticated binds (#23633) ...

Per RFC 4513, a Simple Bind with a non-empty DN but empty password is unauthenticated simple authentication. Many LDAP servers (OpenLDAP default, some AD configs) accept these binds, allowing account takeover without valid credentials.

Rejects empty and whitespace-only passwords before attempting the LDAP bind.

2026-04-12 16:33:57 -05:00

..

data

refac: mv backend files to /open_webui dir

2024-09-04 16:54:48 +02:00

internal

refac: async db

2026-04-12 14:22:11 -05:00

migrations

refac

2026-04-01 18:26:46 -05:00

models

refac: async db

2026-04-12 14:22:11 -05:00

retrieval

refac: async db

2026-04-12 14:22:11 -05:00

routers

fix: reject empty passwords in LDAP authentication to prevent unauthenticated binds (#23633)

2026-04-12 16:33:57 -05:00

socket

fix: invalidate stale Socket.IO sessions on role change and user deletion (#23642)

2026-04-12 16:19:38 -05:00

static

refac

2026-03-23 23:39:52 -05:00

storage

refac

2026-04-12 12:36:21 -05:00

test

refac

2026-03-17 17:58:01 -05:00

tools

refac

2026-04-12 14:39:23 -05:00

utils

fix: enforce API key endpoint restrictions at the auth layer, not middleware (#23637)

2026-04-12 16:33:41 -05:00

__init__.py

refac (#22987)

2026-03-24 15:41:26 -05:00

alembic.ini

fix: Alembic CLI commands from failing

2025-08-15 04:17:47 -04:00

config.py

enh: automation

2026-04-11 17:06:58 -06:00

constants.py

refac

2026-03-25 17:29:57 -05:00

env.py

refac

2026-04-12 16:25:01 -05:00

functions.py

refac: async db

2026-04-12 14:22:11 -05:00

main.py

fix: enforce API key endpoint restrictions at the auth layer, not middleware (#23637)

2026-04-12 16:33:41 -05:00

tasks.py

refac

2026-03-17 17:58:01 -05:00