[PR #20160] [CLOSED] fix: enable placeholder substitution in LDAP search filters #112796

New Issue

GiteaMirror · 2026-05-18T13:00:13-05:00

GiteaMirror commented

2026-05-18 13:00:13 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/20160
Author: @polaz
Created: 12/24/2025
Status: ❌ Closed

Base: dev ← Head: fix/ldap-search-filter-placeholder-v2

📝 Commits (1)

cd8e2c2 fix(ldap): enable placeholder substitution in LDAP search filters

📊 Changes

1 file changed (+13 additions, -1 deletions)

View changed files

📝 backend/open_webui/routers/auths.py (+13 -1)

📄 Description

Pull Request Checklist

Target branch: Verify that the pull request targets the dev branch.
Description: Provided below.
Changelog: Provided below.
Documentation: No documentation changes needed (feature was already documented but not working).
Dependencies: No new dependencies.
Testing: Manually verified the fix logic.
Agentic AI Code: This PR was reviewed and the fix is straightforward - it adds placeholder substitution that was missing.
Code review: Self-reviewed.
Title Prefix: Using fix: prefix.

Changelog Entry

Description

This PR fixes the LDAP search filter placeholder substitution issue discussed in https://github.com/open-webui/open-webui/discussions/16760

Previously, if a user configured the LDAP search filter to use placeholders like (uid=%s), these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors.

Added

N/A

Changed

N/A

Deprecated

N/A

Removed

N/A

Fixed

LDAP search filter now properly substitutes %s and %(user)s placeholders with the escaped username
Users can now create complex LDAP filters like:
- (uid=%s) - simple user lookup
- (&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s)) - lookup with group membership restriction

Security

Username is properly escaped using escape_filter_chars() before substitution to prevent LDAP injection attacks

Breaking Changes

N/A

Additional Information

Related discussion: https://github.com/open-webui/open-webui/discussions/16760
The fix adds placeholder substitution logic before constructing the LDAP search filter

Screenshots or Videos

N/A - Backend fix only

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/20160 **Author:** [@polaz](https://github.com/polaz) **Created:** 12/24/2025 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/ldap-search-filter-placeholder-v2` --- ### 📝 Commits (1) - [`cd8e2c2`](https://github.com/open-webui/open-webui/commit/cd8e2c2d30084eb644762f6c224c92f814054859) fix(ldap): enable placeholder substitution in LDAP search filters ### 📊 Changes **1 file changed** (+13 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/auths.py` (+13 -1) </details> ### 📄 Description # Pull Request Checklist - [x] **Target branch:** Verify that the pull request targets the `dev` branch. - [x] **Description:** Provided below. - [x] **Changelog:** Provided below. - [x] **Documentation:** No documentation changes needed (feature was already documented but not working). - [x] **Dependencies:** No new dependencies. - [x] **Testing:** Manually verified the fix logic. - [x] **Agentic AI Code:** This PR was reviewed and the fix is straightforward - it adds placeholder substitution that was missing. - [x] **Code review:** Self-reviewed. - [x] **Title Prefix:** Using `fix:` prefix. # Changelog Entry ### Description This PR fixes the LDAP search filter placeholder substitution issue discussed in https://github.com/open-webui/open-webui/discussions/16760 Previously, if a user configured the LDAP search filter to use placeholders like `(uid=%s)`, these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors. ### Added - N/A ### Changed - N/A ### Deprecated - N/A ### Removed - N/A ### Fixed - LDAP search filter now properly substitutes `%s` and `%(user)s` placeholders with the escaped username - Users can now create complex LDAP filters like: - `(uid=%s)` - simple user lookup - `(&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s))` - lookup with group membership restriction ### Security - Username is properly escaped using `escape_filter_chars()` before substitution to prevent LDAP injection attacks ### Breaking Changes - N/A --- ### Additional Information - Related discussion: https://github.com/open-webui/open-webui/discussions/16760 - The fix adds placeholder substitution logic before constructing the LDAP search filter ### Screenshots or Videos N/A - Backend fix only ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-18 13:00:13 -05:00

GiteaMirror closed this issue

2026-05-18 13:00:15 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#112796