upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2026-01-04 22:20:28 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

ITS#9897 fix dynlist to ignore entries with wrong objectclass

Browse source
This commit is contained in:
Howard Chu 2022-08-08 18:03:59 +01:00 committed by Quanah Gibson-Mount
parent 3f2abd0b2e
commit 3ef90929ee
1 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
servers/slapd/overlays/dynlist.c
View file

@ -846,15 +846,24 @@ dynlist_compare( Operation *op, SlapReply *rs )
*/
BerVarray id = NULL, authz = NULL;
if ( e == NULL && ( overlay_entry_get_ov( &o, &o.o_req_ndn, NULL, NULL, 0, &e, on ) !=
LDAP_SUCCESS || e == NULL ))
{
return SLAP_CB_CONTINUE;
}
if ( !is_entry_objectclass_or_sub( e, dli->dli_oc )) {
continue;
}
o.o_do_not_cache = 1;
if ( ad_dgIdentity && backend_attribute( &o, NULL, &o.o_req_ndn,
if ( ad_dgIdentity && backend_attribute( &o, e, &o.o_req_ndn,
ad_dgIdentity, &id, ACL_READ ) == LDAP_SUCCESS )
{
/* if not rootdn and dgAuthz is present,
* check if user can be authorized as dgIdentity */
if ( ad_dgAuthz && !BER_BVISEMPTY( id ) && !be_isroot( op )
&& backend_attribute( &o, NULL, &o.o_req_ndn,
&& backend_attribute( &o, e, &o.o_req_ndn,
ad_dgAuthz, &authz, ACL_READ ) == LDAP_SUCCESS )
{
@ -871,7 +880,7 @@ dynlist_compare( Operation *op, SlapReply *rs )
o.o_groups = NULL; /* authz changed, invalidate cached groups */
}
rs->sr_err = backend_group( &o, NULL, &o.o_req_ndn,
rs->sr_err = backend_group( &o, e, &o.o_req_ndn,
&o.oq_compare.rs_ava->aa_value, dli->dli_oc, dli->dli_ad );
switch ( rs->sr_err ) {
case LDAP_SUCCESS:
@ -899,6 +908,7 @@ dynlist_compare( Operation *op, SlapReply *rs )
done:;
if ( id ) ber_bvarray_free_x( id, o.o_tmpmemctx );
overlay_entry_release_ov( &o, e, 0, on );
send_ldap_result( op, rs );
return rs->sr_err;
@ -910,8 +920,8 @@ done:;
return SLAP_CB_CONTINUE;
}
if ( overlay_entry_get_ov( &o, &o.o_req_ndn, NULL, NULL, 0, &e, on ) !=
LDAP_SUCCESS || e == NULL )
if ( e == NULL && ( overlay_entry_get_ov( &o, &o.o_req_ndn, NULL, NULL, 0, &e, on ) !=
LDAP_SUCCESS || e == NULL ))
{
return SLAP_CB_CONTINUE;
}