fix(security): prevent username enumeration via timing attack

Perform a dummy LDAP bind when SearchDN fails so that the response time
is indistinguishable between unknown users and wrong passwords.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

change.go

@@ -81,6 +81,8 @@ func changePassword(w http.ResponseWriter, r *http.Request) {
 			renderError(http.StatusInternalServerError, "Unable to process your request. Please try again later.")
 		} else if dn, err := conn.SearchDN(r.PostFormValue("login"), true); err != nil {
 			log.Println(err)
+			// User not found: perform a dummy bind to prevent username enumeration via timing.
+			conn.Bind("cn=dummy,"+myLDAP.BaseDN, r.PostFormValue("password"))
 			renderError(http.StatusUnauthorized, "Invalid login or password.")
 		} else if err := conn.Bind(dn, r.PostFormValue("password")); err != nil {
 			log.Println(err)

login.go

@@ -88,6 +88,8 @@ func login(login string, password string) ([]*ldap.EntryAttribute, error) {
 	if err != nil {
 		dn, err = conn.SearchDN(login, false)
 		if err != nil {
+			// User not found: perform a dummy bind to prevent username enumeration via timing.
+			conn.Bind("cn=dummy,"+myLDAP.BaseDN, password)
 			return nil, err
 		}
 	}