LDAP authentication bug: incorrect blank passwords handling.

I use Ejabberd 1.1.2 in Windows 2003 domain.
I've found that when you using module ejabberd_auth_ldap for authentication you can login under any user account whith blank password while incorrect passwords handled correctly. It is the serious security issue I think.
Since I dumb in Erlang I could just add a couple of lines in ejabberd_auth_ldap.erl - function check_password at line 121 now lookes so:

check_password(User, Server, Password) ->
    if Password == "" ->
        false;
    true ->
        Proc = gen_mod:get_module_proc(Server, ?MODULE),
        case catch gen_server:call(Proc,{check_pass, User, Password}, ?REPLY_TIMEOUT) of
            {'EXIT', _} ->
                false;
            Result ->
                Result
        end
    end.

After module was compiled it works fine.
May be it helps anybody.