LDAP (via BindDN): Filter no longer replace %s

User who authenticate against AD via LDAP can no longer log in since the update to 0.11.34-1525806056.7ecf5f71.jessie. Judging from the gogs.log this is due to a failure to replace the %s placeholder with the account name.

• Gogs version (or commit ref): 0.11.48.0426 (apt reports 0.11.34-1525806056.7ecf5f71.jessie)
• Git version: 1:2.1.4-2.1+deb8u5
• Operating system: Debian Jessie
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gogs.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist (usually found in log/gogs.log): see below

Description

This is what's happening now:

2018/05/09 18:10:27 [TRACE] LDAP will use BindDN
2018/05/09 18:10:27 [TRACE] Search for LDAP user: John.Doe
2018/05/09 18:10:27 [TRACE] LDAP: Bound as BindDN: CN=Browsing.User,CN=Users,DC=mydomain,DC=de
2018/05/09 18:10:27 [TRACE] LDAP: Searching for DN using filter '(&(objectClass=Person)(memberOf=CN=Webdev,OU=Gruppen,OU=OU-Root,DC=mydomain,DC=de)(|(sAMAccountName=%[1]s)(mail=%[1]s)))' and base 'DC=mydomain,DC=de'
2018/05/09 18:10:27 [TRACE] LDAP: Failed search using filter '(&(objectClass=Person)(memberOf=CN=Webdev,OU=Gruppen,OU=OU-Root,DC=mydomain,DC=de)(|(sAMAccountName=%[1]s)(mail=%[1]s)))': <nil>

This is what's supposed to happen and did before the update:

2017/03/31 11:59:07 [TRACE] LDAP will use BindDN
2017/03/31 11:59:07 [TRACE] Search for LDAP user: john.doe
2017/03/31 11:59:07 [TRACE] Bound as BindDN: CN=Browsing.User,CN=Users,DC=mydomain,DC=de
2017/03/31 11:59:07 [TRACE] Searching for DN using filter '(&(objectClass=Person)(memberOf=CN=Webdev,OU=Gruppen,OU=OU-Root,DC=mydomain,DC=de)(|(sAMAccountName=john.doe)(mail=john.doe)))' and base 'DC=mydomain,DC=de'
2017/03/31 11:59:08 [TRACE] Binding with userDN: CN=John Doe,OU=Benutzer,OU=OU-Root,DC=mydomain,DC=de
2017/03/31 11:59:08 [TRACE] Bound successfully with userDN: CN=John Doe,OU=Benutzer,OU=OU-Root,DC=mydomain,DC=de
2017/03/31 11:59:08 [TRACE] Fetching attributes 'sAMAccountName', 'givenName', 'sn', 'mail' with filter '(&(objectClass=Person)(memberOf=CN=Webdev,OU=Gruppen,OU=OU-Root,DC=mydomain,DC=de)(|(sAMAccountName=john.doe)(mail=john.doe)))' and base 'CN=John Doe,OU=Benutzer,OU=OU-Root,DC=mydomain,DC=de'

There have been no changes in the configuration of either gogs or the AD. If you check the filter string in the log file, you'll find the %1 is not replaced with john.doe as was the case before. This might affect the admin filter, too.

Start with the LDAP BindDN authentication path and the filter formatting shown in gogs.log; compare the failing %[1]s filter with the expected john.doe filter. Reproduce the reported login flow and consider the issue done when the account name replaces the placeholder and LDAP login succeeds.