Reject LDAP authentication requests with blank password. Per RFC4513 these should be treated as anonymous binds. See the Security Considerations (Section 6.3.1) for more details on this issue.

rhodecode/lib/auth_ldap.py

@@ -87,6 +87,9 b' class AuthLdap(object):'
 
         uid = chop_at(username, "@%s" % self.LDAP_SERVER_ADDRESS)
 
+        if not password:
+            log.debug("Attempt to authenticate LDAP user with blank password rejected.")
+            raise LdapPasswordError()
         if "," in username:
             raise LdapUsernameError("invalid character in username: ,")
         try: