mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-04-24 15:32:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

ITS#10139 back-config: Honour disclose in matchedDN handling

Browse Source
This commit is contained in:
Ondřej Kuzník 2024-01-25 12:50:34 +00:00 committed by Quanah Gibson-Mount
parent a70cd7497e
commit 131a42c4f8
1 changed files with 22 additions and 14 deletions

36
servers/slapd/bconfig.c

@ -4146,7 +4146,8 @@ config_tls_config(ConfigArgs *c) {
#endif
static CfEntryInfo *
config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last,
Operation *op )
{
struct berval cdn;
char *c;
@ -4163,7 +4164,14 @@ config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
for (;*c != ',';c--);
while(root) {
*last = root;
if ( !op || access_allowed( op, root->ce_entry,
slap_schema.si_ad_entry, NULL, ACL_DISCLOSE, NULL ) ) {
/*
* ITS#10139: Only record the lowermost entry that the user has
* disclose access to
*/
*last = root;
}
for (--c;c>dn->bv_val && *c != ',';c--);
cdn.bv_val = c;
if ( *c == ',' )
@ -5284,7 +5292,7 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
* Databases and Overlays to be inserted. Don't do any
* auto-renumbering if manageDSAit control is present.
*/
ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
ce = config_find_base( cfb->cb_root, &e->e_nname, &last, op );
if ( ce ) {
if ( ( op && op->o_managedsait ) ||
( ce->ce_type != Cft_Database && ce->ce_type != Cft_Overlay &&
@ -5305,14 +5313,14 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
/* If last is NULL, the new entry is the root/suffix entry,
* otherwise last should be the parent.
*/
if ( last && !dn_match( &last->ce_entry->e_nname, &pdn ) ) {
if ( rs ) {
if ( cfb->cb_root && ( !last || !dn_match( &last->ce_entry->e_nname, &pdn ) ) ) {
if ( last && rs ) {
rs->sr_matched = last->ce_entry->e_name.bv_val;
}
Debug( LDAP_DEBUG_TRACE, "%s: config_add_internal: "
"DN=\"%s\" not child of DN=\"%s\"\n",
log_prefix, e->e_name.bv_val,
last->ce_entry->e_name.bv_val );
last ? last->ce_entry->e_name.bv_val : "" );
return LDAP_NO_SUCH_OBJECT;
}
@ -6283,7 +6291,7 @@ config_back_modify( Operation *op, SlapReply *rs )
cfb = (CfBackInfo *)op->o_bd->be_private;
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
if ( !ce ) {
if ( last )
rs->sr_matched = last->ce_entry->e_name.bv_val;
@ -6431,7 +6439,7 @@ config_back_modrdn( Operation *op, SlapReply *rs )
cfb = (CfBackInfo *)op->o_bd->be_private;
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
if ( !ce ) {
if ( last )
rs->sr_matched = last->ce_entry->e_name.bv_val;
@ -6689,7 +6697,7 @@ config_back_delete( Operation *op, SlapReply *rs )
cfb = (CfBackInfo *)op->o_bd->be_private;
/* If we have a backend, it will handle the control */
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
if ( ce && !cfb->cb_use_ldif && op->o_preread ) {
if ( preread_ctrl == NULL ) {
preread_ctrl = &ctrls[num_ctrls++];
@ -6862,7 +6870,7 @@ config_back_search( Operation *op, SlapReply *rs )
cfb = (CfBackInfo *)op->o_bd->be_private;
ldap_pvt_thread_rdwr_rlock( &cfb->cb_rwlock );
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
if ( !ce ) {
if ( last )
rs->sr_matched = last->ce_entry->e_name.bv_val;
@ -6950,7 +6958,7 @@ int config_back_entry_get(
if ( !paused ) {
ldap_pvt_thread_rdwr_rlock( &cfb->cb_rwlock );
}
ce = config_find_base( cfb->cb_root, ndn, &last );
ce = config_find_base( cfb->cb_root, ndn, &last, op );
if ( ce ) {
e = ce->ce_entry;
if ( e ) {
@ -7257,7 +7265,7 @@ config_check_schema(Operation *op, CfBackInfo *cfb)
return 0;
/* Make sure the main schema entry exists */
ce = config_find_base( cfb->cb_root, &schema_dn, &last );
ce = config_find_base( cfb->cb_root, &schema_dn, &last, op );
if ( ce ) {
Attribute *a;
struct berval *bv;
@ -7959,7 +7967,7 @@ config_tool_entry_modify( BackendDB *be, Entry *e, struct berval *text )
BackendInfo *bi = cfb->cb_db.bd_info;
CfEntryInfo *ce, *last;
ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
ce = config_find_base( cfb->cb_root, &e->e_nname, &last, NULL );
if ( ce && bi && bi->bi_tool_entry_modify )
return bi->bi_tool_entry_modify( &cfb->cb_db, e, text );
@ -7974,7 +7982,7 @@ config_tool_entry_delete( BackendDB *be, struct berval *ndn, struct berval *text
BackendInfo *bi = cfb->cb_db.bd_info;
CfEntryInfo *ce, *last;
ce = config_find_base( cfb->cb_root, ndn, &last );
ce = config_find_base( cfb->cb_root, ndn, &last, NULL );
if ( ce && bi && bi->bi_tool_entry_delete )
return bi->bi_tool_entry_delete( &cfb->cb_db, ndn, text );