gitblit/gitblit — pull request #13 by jcrygier (2012-04-25 12:46:11+00:00)
Title: Display Name / Email for LDAP (PlaceHolders)

Hi-

I've added some additional code to get the display name / email from LDAP in a nice, flexible manner (see documentation in gitblit.properties).

Also, I've added some code to escape the user name - as it was allowing for LDAP injection attacks. Please see the test case for an example of what the user could type to bypass authentication (only if passwords are stored in LDAP as clear text - unlikely, but possible).