Add some basic filter validation to permissions and disallow empty filters

Try a query with a filter to see if it is at least legal. This doesn't
guarantee that the filter is at all otherwise sane.

ticket 808

ipaserver/plugins/ldap2.py

@@ -108,6 +108,8 @@ def _handle_errors(e, **kw):
         raise errors.LimitsExceeded()
     except _ldap.NOT_ALLOWED_ON_RDN:
         raise errors.NotAllowedOnRDN(attr=info)
+    except _ldap.FILTER_ERROR:
+        raise errors.BadSearchFilter(info=info)
     except _ldap.SUCCESS:
         pass
     except _ldap.LDAPError, e: