FedeRez/webldap — pull request #2 by gpichot (2014-03-07 16:10:11+00:00)
Title: Delete the ability to steal accounts

It may depends on the LDAP server, but we can eventually steal accounts using an LDAP Injection.

As the filter is '(&(uid=%s)(mail=%s))' in some servers using the following data :
* uid = username))\0 or uid = username)(1=1))(
* mail = hacker@email.me
Implies the plain filter : (&(uid=username))\0(mail=hacker@email.me))

A token will be create to change the password but the url will be sent to the hacker and to the owner of the account.

This pull request ensures that the user who will receive the email also possess the account.