Merge r24366 from trunk to 6.0-stable (#43692).

git-svn-id: https://svn.redmine.org/redmine/branches/6.0-stable@24371 e93f8b46-1217-0410-a6f0-8f06a7374b81

test/unit/auth_source_ldap_test.rb

@@ -161,6 +161,13 @@ class AuthSourceLdapTest < ActiveSupport::TestCase
       assert_nil auth.authenticate('edavis', '123456')
     end
 
+    test '#authenticate with special characters in login should not allow filter manipulation' do
+      auth = AuthSourceLdap.find(1)
+
+      result = auth.authenticate("*", "123456")
+      assert_nil result
+    end
+
     def test_authenticate_should_timeout
       auth_source = AuthSourceLdap.find(1)
       auth_source.timeout = 1