upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2026-01-01 12:39:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

expose oc_check_operational from schema.c

Browse source 
Use everywhere.
Apply search ACLs to operational attributes.
Only provide operational attributes when explicitly requested.
This commit is contained in:
Kurt Zeilenga 1999-06-29 04:52:55 +00:00
parent a7dfc2aada
commit fe00263875
7 changed files with 26 additions and 47 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
servers/slapd/acl.c
View file

@ -55,12 +55,8 @@ access_allowed(
e->e_dn, attr, 0 );
/* the lastmod attributes are ignored by ACL checking */
if ( strcasecmp( attr, "modifiersname" ) == 0 ||
strcasecmp( attr, "modifytimestamp" ) == 0 ||
strcasecmp( attr, "creatorsname" ) == 0 ||
strcasecmp( attr, "createtimestamp" ) == 0 )
{
Debug( LDAP_DEBUG_ACL, "LASTMOD attribute: %s access allowed\n",
if ( oc_check_operational( attr ) ) {
Debug( LDAP_DEBUG_ACL, "Operational attribute: %s access allowed\n",
attr, 0, 0 );
return(1);
}
@ -403,12 +399,8 @@ acl_check_modlist(
regmatch_t matches[MAXREMATCHES];
/* the lastmod attributes are ignored by ACL checking */
if ( strcasecmp( mlist->ml_type, "modifiersname" ) == 0 ||
strcasecmp( mlist->ml_type, "modifytimestamp" ) == 0 ||
strcasecmp( mlist->ml_type, "creatorsname" ) == 0 ||
strcasecmp( mlist->ml_type, "createtimestamp" ) == 0 )
{
Debug( LDAP_DEBUG_ACL, "LASTMOD attribute: %s access allowed\n",
if ( oc_check_operational( mlist->ml_type ) ) {
Debug( LDAP_DEBUG_ACL, "Operational attribute: %s access allowed\n",
mlist->ml_type, 0, 0 );
continue;
}

5
servers/slapd/add.c
View file

@ -162,10 +162,7 @@ add_created_attrs( Operation *op, Entry *e )
/* remove any attempts by the user to add these attrs */
for ( a = &e->e_attrs; *a != NULL; a = next ) {
if ( strcasecmp( (*a)->a_type, "modifiersname" ) == 0 ||
strcasecmp( (*a)->a_type, "modifytimestamp" ) == 0 ||
strcasecmp( (*a)->a_type, "creatorsname" ) == 0 ||
strcasecmp( (*a)->a_type, "createtimestamp" ) == 0 ) {
if ( oc_check_operational( (*a)->a_type ) ) {
tmp = *a;
*a = (*a)->a_next;
attr_free( tmp );

8
servers/slapd/back-bdb2/modify.c
View file

@ -33,13 +33,9 @@ add_lastmods( Operation *op, LDAPModList **modlist )
/* remove any attempts by the user to modify these attrs */
for ( m = modlist; *m != NULL; m = &(*m)->ml_next ) {
if ( strcasecmp( (*m)->ml_type, "modifytimestamp" ) == 0 ||
strcasecmp( (*m)->ml_type, "modifiersname" ) == 0 ||
strcasecmp( (*m)->ml_type, "createtimestamp" ) == 0 ||
strcasecmp( (*m)->ml_type, "creatorsname" ) == 0 ) {
if ( oc_check_operational( (*m)->ml_type ) ) {
Debug( LDAP_DEBUG_TRACE,
"add_lastmods: found lastmod attr: %s\n",
"add_lastmods: found operational attr: %s\n",
(*m)->ml_type, 0, 0 );
tmp = *m;
*m = (*m)->ml_next;

8
servers/slapd/back-ldbm/modify.c
View file

@ -33,13 +33,9 @@ add_lastmods( Operation *op, LDAPModList **modlist )
/* remove any attempts by the user to modify these attrs */
for ( m = modlist; *m != NULL; m = &(*m)->ml_next ) {
if ( strcasecmp( (*m)->ml_type, "modifytimestamp" ) == 0 ||
strcasecmp( (*m)->ml_type, "modifiersname" ) == 0 ||
strcasecmp( (*m)->ml_type, "createtimestamp" ) == 0 ||
strcasecmp( (*m)->ml_type, "creatorsname" ) == 0 ) {
if ( oc_check_operational( (*m)->ml_type ) ) {
Debug( LDAP_DEBUG_TRACE,
"add_lastmods: found lastmod attr: %s\n",
"add_lastmods: found operational attr: %s\n",
(*m)->ml_type, 0, 0 );
tmp = *m;
*m = (*m)->ml_next;

1
servers/slapd/proto-slap.h
View file

@ -255,6 +255,7 @@ void send_ldap_search_result LDAP_P(( Connection *conn, Operation *op, int err,
*/
int oc_schema_check LDAP_P(( Entry *e ));
int oc_check_operational LDAP_P(( char *type ));
ObjectClass *oc_find LDAP_P((const char *ocname));
int oc_add LDAP_P((LDAP_OBJECT_CLASS *oc, const char **err));
Syntax *syn_find LDAP_P((const char *synname));

27
servers/slapd/result.c
View file

@ -231,23 +231,20 @@ send_search_entry(
for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
regmatch_t matches[MAXREMATCHES];
if ( attrs != NULL && ! charray_inlist( attrs, a->a_type ) ) {
continue;
if ( attrs == NULL ) {
/* all addrs request, skip operational attributes */
if( oc_check_operational( a->a_type )) {
continue;
}
} else {
/* specific addrs requested */
if ( !charray_inlist( attrs, a->a_type )) {
continue;
}
}
/* the lastmod attributes are ignored by ACL checking */
if ( strcasecmp( a->a_type, "modifiersname" ) == 0 ||
strcasecmp( a->a_type, "modifytimestamp" ) == 0 ||
strcasecmp( a->a_type, "creatorsname" ) == 0 ||
strcasecmp( a->a_type, "createtimestamp" ) == 0 )
{
Debug( LDAP_DEBUG_ACL, "LASTMOD attribute: %s access DEFAULT\n",
a->a_type, 0, 0 );
acl = NULL;
} else {
acl = acl_get_applicable( be, op, e, a->a_type,
MAXREMATCHES, matches );
}
acl = acl_get_applicable( be, op, e, a->a_type,
MAXREMATCHES, matches );
if ( ! acl_access_allowed( acl, be, conn, e,
NULL, op, ACL_READ, edn, matches ) )

8
servers/slapd/schema.c
View file

@ -125,9 +125,9 @@ oc_check_required( Entry *e, char *ocname )
/*
* check to see if attribute is 'operational' or not.
* this function should be externalized...
* this list should be extensible...
*/
static int
int
oc_check_operational( char *type )
{
return ( strcasecmp( type, "modifiersname" ) == 0 ||
@ -1051,12 +1051,12 @@ schema_info( Connection *conn, Operation *op, char **attrs, int attrsonly )
val.bv_val = ch_strdup( "top" );
val.bv_len = strlen( val.bv_val );
attr_merge( e, "objectclass", vals );
attr_merge( e, "objectClass", vals );
ldap_memfree( val.bv_val );
val.bv_val = ch_strdup( "subschema" );
val.bv_len = strlen( val.bv_val );
attr_merge( e, "objectclass", vals );
attr_merge( e, "objectClass", vals );
ldap_memfree( val.bv_val );
if ( syn_schema_info( e ) ) {