|
 |
f92ce9 |
From 0a1e9e51568d5caea0b97d79773dbc9f5a900ab3 Mon Sep 17 00:00:00 2001
|
|
|
f92ce9 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
f92ce9 |
Date: Fri, 10 Oct 2014 11:50:13 -0700
|
|
|
f92ce9 |
Subject: [PATCH 21/21] Ticket #47922 - dynamically added macro aci is not
|
|
|
f92ce9 |
evaluated on the fly
|
|
|
f92ce9 |
|
|
|
f92ce9 |
Bug Description: When macro aci is dynamically added and if the aci's
|
|
|
f92ce9 |
macro target dn is not normalized, the following operation that requires
|
|
|
f92ce9 |
the aci could fail with Insufficient access since matching the target dn
|
|
|
f92ce9 |
and the macro target dn fails since the code expects normalized macro
|
|
|
f92ce9 |
target dn.
|
|
|
f92ce9 |
|
|
|
f92ce9 |
Fix Description: Before setting the macro target dn, process the dn by
|
|
|
f92ce9 |
slapi_create_dn_string_case.
|
|
|
f92ce9 |
|
|
|
f92ce9 |
https://fedorahosted.org/389/ticket/47922
|
|
|
f92ce9 |
|
|
|
f92ce9 |
Reviewed by lkrispen@redhat.com and rmeggins@redhat.com (Thank you, Ludwig and Rich!!)
|
|
|
f92ce9 |
|
|
|
f92ce9 |
(cherry picked from commit 07c1bc25508a9c1e71dd8e717fd4ce455ddfeff0)
|
|
|
f92ce9 |
(cherry picked from commit c6b397c8466fd0859c5404c946a82f240564076e)
|
|
|
f92ce9 |
---
|
|
|
f92ce9 |
ldap/servers/plugins/acl/aclparse.c | 19 +++++++++++++------
|
|
|
f92ce9 |
ldap/servers/plugins/acl/aclutil.c | 2 +-
|
|
|
f92ce9 |
2 files changed, 14 insertions(+), 7 deletions(-)
|
|
|
f92ce9 |
|
|
|
f92ce9 |
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
|
|
|
f92ce9 |
index ea64fa7..be86c8b 100644
|
|
|
f92ce9 |
--- a/ldap/servers/plugins/acl/aclparse.c
|
|
|
f92ce9 |
+++ b/ldap/servers/plugins/acl/aclparse.c
|
|
|
f92ce9 |
@@ -1849,9 +1849,9 @@ static int
|
|
|
f92ce9 |
acl_check_for_target_macro( aci_t *aci_item, char *value)
|
|
|
f92ce9 |
{
|
|
|
f92ce9 |
|
|
|
f92ce9 |
- char *str = NULL;
|
|
|
f92ce9 |
+ char *str = NULL;
|
|
|
f92ce9 |
|
|
|
f92ce9 |
- str = strstr(value, ACL_TARGET_MACRO_DN_KEY /* ($dn) */);
|
|
|
f92ce9 |
+ str = PL_strcasestr(value, ACL_TARGET_MACRO_DN_KEY /* ($dn) */);
|
|
|
f92ce9 |
|
|
|
f92ce9 |
if (str != NULL) {
|
|
|
f92ce9 |
char *p0 = NULL, *p1 = NULL;
|
|
|
f92ce9 |
@@ -1871,10 +1871,17 @@ acl_check_for_target_macro( aci_t *aci_item, char *value)
|
|
|
f92ce9 |
aci_item->aci_type &= ~ACI_TARGET_DN;
|
|
|
f92ce9 |
aci_item->aci_type |= ACI_TARGET_MACRO_DN;
|
|
|
f92ce9 |
aci_item->aci_macro = (aciMacro *)slapi_ch_malloc(sizeof(aciMacro));
|
|
|
f92ce9 |
- aci_item->aci_macro->match_this = slapi_ch_strdup(value);
|
|
|
f92ce9 |
- aci_item->aci_macro->macro_ptr = strstr( aci_item->aci_macro->match_this,
|
|
|
f92ce9 |
- ACL_TARGET_MACRO_DN_KEY);
|
|
|
f92ce9 |
- return(1);
|
|
|
f92ce9 |
+ /* Macro dn needs to normalize. E.g., "ou=Groups, ($dN), dn=example,dn=com" */
|
|
|
f92ce9 |
+ aci_item->aci_macro->match_this = slapi_create_dn_string_case("%s", value);
|
|
|
f92ce9 |
+ if (NULL == aci_item->aci_macro->match_this) {
|
|
|
f92ce9 |
+ slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
|
|
|
f92ce9 |
+ "acl_check_for_target_macro: Error: Invalid macro target dn: \"%s\"\n", value);
|
|
|
f92ce9 |
+ aci_item->aci_type &= ~ACI_TARGET_MACRO_DN;
|
|
|
f92ce9 |
+ slapi_ch_free((void **)&aci_item->aci_macro);
|
|
|
f92ce9 |
+ return -1;
|
|
|
f92ce9 |
+ }
|
|
|
f92ce9 |
+ aci_item->aci_macro->macro_ptr = PL_strcasestr(aci_item->aci_macro->match_this, ACL_TARGET_MACRO_DN_KEY);
|
|
|
f92ce9 |
+ return(1);
|
|
|
f92ce9 |
}
|
|
|
f92ce9 |
|
|
|
f92ce9 |
return(0);
|
|
|
f92ce9 |
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
|
|
|
f92ce9 |
index e865a95..0720dae 100644
|
|
|
f92ce9 |
--- a/ldap/servers/plugins/acl/aclutil.c
|
|
|
f92ce9 |
+++ b/ldap/servers/plugins/acl/aclutil.c
|
|
|
f92ce9 |
@@ -785,7 +785,7 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
|
|
|
f92ce9 |
macro_prefix = slapi_ch_strdup(match_this);
|
|
|
f92ce9 |
|
|
|
f92ce9 |
/* we know it's got a $(dn) */
|
|
|
f92ce9 |
- tmp_ptr = strstr(macro_prefix, ACL_TARGET_MACRO_DN_KEY);
|
|
|
f92ce9 |
+ tmp_ptr = PL_strcasestr(macro_prefix, ACL_TARGET_MACRO_DN_KEY);
|
|
|
f92ce9 |
if (!tmp_ptr) {
|
|
|
f92ce9 |
LDAPDebug(LDAP_DEBUG_ACL,"acl_match_macro_in_target: "
|
|
|
f92ce9 |
"Target macro DN key \"%s\" not found in \"%s\".\n",
|
|
|
f92ce9 |
--
|
|
|
f92ce9 |
1.9.3
|
|
|
f92ce9 |
|