mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-01-06 10:46:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

backend_compute_output_attr() should use actual computed attribute type

Browse Source 
returned by the plugin, rather than that requested by backend_attribute(),
for ACL checking.

They should of course be the same but this is the "correct" approach from
both a security and readability perspective
This commit is contained in:
Luke Howard 2004-08-26 05:18:33 +00:00
parent 815efedff5
commit 563f73b81d
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
servers/slapd/backend.c
View File

@ -1512,7 +1512,7 @@ static int backend_compute_output_attr(computed_attr_context *c, Slapi_Attr *a,
} }
if ( op->o_conn && access_allowed( op, if ( op->o_conn && access_allowed( op,
e, c->cac_attrs->an_desc, NULL, ACL_AUTH, e, a->a_desc, NULL, ACL_AUTH,
&c->cac_acl_state ) == 0 ) { &c->cac_acl_state ) == 0 ) {
return 1; return 1;
} }
@ -1523,7 +1523,7 @@ static int backend_compute_output_attr(computed_attr_context *c, Slapi_Attr *a,
op->o_tmpmemctx ); op->o_tmpmemctx );
for ( i=0,j=0; a->a_vals[i].bv_val; i++ ) { for ( i=0,j=0; a->a_vals[i].bv_val; i++ ) {
if ( op->o_conn && access_allowed( op, if ( op->o_conn && access_allowed( op,
e, c->cac_attrs->an_desc, e, a->a_desc,
&a->a_nvals[i], &a->a_nvals[i],
ACL_AUTH, &c->cac_acl_state ) == 0 ) { ACL_AUTH, &c->cac_acl_state ) == 0 ) {
continue; continue;
@ -1615,16 +1615,10 @@ backend_attribute(
computed_attr_context ctx; computed_attr_context ctx;
AttributeName aname; AttributeName aname;
/* only an_desc is needed by backend_compute_output_attr() */
aname.an_name = entry_at->ad_cname;
aname.an_desc = entry_at;
aname.an_oc_exclude = 0;
aname.an_oc = NULL;
slapi_int_pblock_set_operation( op->o_pb, op ); slapi_int_pblock_set_operation( op->o_pb, op );
ctx.cac_pb = op->o_pb; ctx.cac_pb = op->o_pb;
ctx.cac_attrs = &aname; ctx.cac_attrs = NULL;
ctx.cac_userattrs = 0; ctx.cac_userattrs = 0;
ctx.cac_opattrs = 0; ctx.cac_opattrs = 0;
ctx.cac_acl_state = acl_state; ctx.cac_acl_state = acl_state;