|
 |
246821 |
From 0fa9e46da9f56221b579a7729deebaed73364c27 Mon Sep 17 00:00:00 2001
|
|
|
246821 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
246821 |
Date: Tue, 10 Nov 2015 15:35:41 -0800
|
|
|
246821 |
Subject: [PATCH 74/75] Ticket #48344 - acl - regression - trailing ', (comma)'
|
|
|
246821 |
in macro matched value is not removed.
|
|
|
246821 |
|
|
|
246821 |
Description: acl_match_macro_in_target in acl plug-in returns matched value
|
|
|
246821 |
with a trailing comma, e.g., "o=kaki.com,". It's used to create a group DN,
|
|
|
246821 |
e.g., "cn=Domain Administrators,ou=Groups,o=kaki.como=ace industry,c=us".
|
|
|
246821 |
|
|
|
246821 |
Due to the duplicated commas, the bind unexpectedly fails with 50 (insufficient
|
|
|
246821 |
access).
|
|
|
246821 |
|
|
|
246821 |
In getting the matched value from target DN, it checks if a character at the
|
|
|
246821 |
end position is a comma or not. If it is, '\0' is set there. The position
|
|
|
246821 |
was one byte ahead. It was introduced by #48141 - aci with wildcard and macro
|
|
|
246821 |
not correctly evaluated.
|
|
|
246821 |
|
|
|
246821 |
https://fedorahosted.org/389/ticket/48344
|
|
|
246821 |
|
|
|
246821 |
Reviewed by mreynolds@redhat.com (Thank you, Mark!!)
|
|
|
246821 |
|
|
|
246821 |
(cherry picked from commit 8e421fb9af2752144cc93e62090fd873524c5633)
|
|
|
246821 |
(cherry picked from commit 1a6390d6ffa743f38be206f7ed7bb0ac3bcfe26b)
|
|
|
246821 |
---
|
|
|
246821 |
ldap/servers/plugins/acl/aclutil.c | 2 +-
|
|
|
246821 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
246821 |
|
|
|
246821 |
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
|
|
|
246821 |
index 2f37107..308cf8b 100644
|
|
|
246821 |
--- a/ldap/servers/plugins/acl/aclutil.c
|
|
|
246821 |
+++ b/ldap/servers/plugins/acl/aclutil.c
|
|
|
246821 |
@@ -935,7 +935,7 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
|
|
|
246821 |
|
|
|
246821 |
matched_val_len = ndn_len-macro_suffix_len-
|
|
|
246821 |
ndn_prefix_end;
|
|
|
246821 |
- if (ndn[ndn_len - macro_suffix_len] == ',')
|
|
|
246821 |
+ if (ndn[ndn_len - macro_suffix_len - 1] == ',')
|
|
|
246821 |
matched_val_len -= 1;
|
|
|
246821 |
|
|
|
246821 |
matched_val = (char *)slapi_ch_malloc(matched_val_len + 1);
|
|
|
246821 |
--
|
|
|
246821 |
2.4.3
|
|
|
246821 |
|