[PR #20159] [CLOSED] fix(ldap): enable placeholder substitution in LDAP search filters #48532

New Issue

GiteaMirror · 2026-04-30T00:32:57-05:00

GiteaMirror commented

2026-04-30 00:32:57 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/20159
Author: @polaz
Created: 12/24/2025
Status: ❌ Closed

Base: main ← Head: fix/ldap-search-filter-placeholder

📝 Commits (1)

9192b34 fix(ldap): enable placeholder substitution in LDAP search filters

📊 Changes

1 file changed (+13 additions, -1 deletions)

View changed files

📝 backend/open_webui/routers/auths.py (+13 -1)

📄 Description

Summary

This PR fixes the LDAP search filter placeholder substitution issue discussed in #16760.

The LDAP search filter configuration now properly supports placeholder variables that get substituted with the actual username during authentication:

%s - replaced with the escaped username
%(user)s - replaced with the escaped username

Problem

Previously, if a user configured the LDAP search filter to use placeholders like (uid=%s), these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors.

Solution

Added placeholder substitution logic before constructing the LDAP search filter:

Extract and escape the username using escape_filter_chars() (already done but now reused)
Replace %(user)s placeholders with the escaped username
Replace %s placeholders with the escaped username
Use the processed filter in the LDAP search

Examples

Now users can create complex LDAP filters like:

(uid=%s) - simple user lookup
(&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s)) - lookup with group membership restriction

Security

The username is properly escaped using escape_filter_chars() before substitution to prevent LDAP injection attacks.

Testing

Tested with %s placeholder
Tested with %(user)s placeholder
Tested without any placeholders (backward compatibility)
Verified LDAP injection prevention with special characters

Fixes #16760

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/20159 **Author:** [@polaz](https://github.com/polaz) **Created:** 12/24/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/ldap-search-filter-placeholder` --- ### 📝 Commits (1) - [`9192b34`](https://github.com/open-webui/open-webui/commit/9192b34659ed3d92208bca96b8548ba3933162a7) fix(ldap): enable placeholder substitution in LDAP search filters ### 📊 Changes **1 file changed** (+13 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/auths.py` (+13 -1) </details> ### 📄 Description ## Summary This PR fixes the LDAP search filter placeholder substitution issue discussed in #16760. The LDAP search filter configuration now properly supports placeholder variables that get substituted with the actual username during authentication: - `%s` - replaced with the escaped username - `%(user)s` - replaced with the escaped username ## Problem Previously, if a user configured the LDAP search filter to use placeholders like `(uid=%s)`, these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors. ## Solution Added placeholder substitution logic before constructing the LDAP search filter: 1. Extract and escape the username using `escape_filter_chars()` (already done but now reused) 2. Replace `%(user)s` placeholders with the escaped username 3. Replace `%s` placeholders with the escaped username 4. Use the processed filter in the LDAP search ## Examples Now users can create complex LDAP filters like: - `(uid=%s)` - simple user lookup - `(&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s))` - lookup with group membership restriction ## Security The username is properly escaped using `escape_filter_chars()` before substitution to prevent LDAP injection attacks. ## Testing - [ ] Tested with `%s` placeholder - [ ] Tested with `%(user)s` placeholder - [ ] Tested without any placeholders (backward compatibility) - [ ] Verified LDAP injection prevention with special characters Fixes #16760 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-30 00:32:57 -05:00

GiteaMirror closed this issue

2026-04-30 00:32:58 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#48532