upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2026-01-07 07:30:57 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Make sur attribute ACL are evaluated on ADD operations (see ITS#4556)

Browse source
This commit is contained in:
Emmanuel Dreyfus 2008-09-29 22:08:29 +00:00
parent 93fe70d6c7
commit 7a5b406cf1
3 changed files with 40 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
servers/slapd/back-bdb/add.c
View file

@ -299,6 +299,24 @@ retry: /* transaction retry */
goto return_results;;
}
/*
* Check ACL for attribute write access
*/
if (!acl_check_modlist(op, oe, op->ora_modlist)) {
switch( opinfo.boi_err ) {
case DB_LOCK_DEADLOCK:
case DB_LOCK_NOTGRANTED:
goto retry;
}
Debug( LDAP_DEBUG_TRACE,
LDAP_XSTRING(bdb_add) ": no write access to attribute\n",
0, 0, 0 );
rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
rs->sr_text = "no write access to attribute";
goto return_results;;
}
if ( eid == NOID ) {
rs->sr_err = bdb_next_id( op->o_bd, &eid );
if( rs->sr_err != 0 ) {

13
servers/slapd/back-ndb/add.cpp
View file

@ -223,6 +223,19 @@ is_ref: p.e_attrs = NULL;
goto return_results;;
}
/*
* Check ACL for attribute write access
*/
if (!acl_check_modlist(op, op->ora_e, op->ora_modlist)) {
Debug( LDAP_DEBUG_TRACE,
LDAP_XSTRING(bdb_add) ": no write access to attribute\n",
0, 0, 0 );
rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
rs->sr_text = "no write access to attribute";
goto return_results;;
}
/* acquire entry ID */
if ( op->ora_e->e_id == NOID ) {
rs->sr_err = ndb_next_id( op->o_bd, NA.ndb, &op->ora_e->e_id );

9
servers/slapd/bconfig.c
View file

@ -4633,6 +4633,15 @@ config_back_add( Operation *op, SlapReply *rs )
goto out;
}
/*
* Check for attribute ACL
*/
if ( !acl_check_modlist( op, op->ora_e, op->orm_modlist )) {
rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
rs->sr_text = "no write access to attribute";
goto out;
}
cfb = (CfBackInfo *)op->o_bd->be_private;
/* add opattrs for syncprov */