|
 |
5bd817 |
From 394277fdcef70078b54a280de88ab06dd289cc7a Mon Sep 17 00:00:00 2001
|
|
|
5bd817 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
5bd817 |
Date: Mon, 28 Jul 2014 09:42:43 -0700
|
|
|
5bd817 |
Subject: [PATCH] Bug 1123477 - unauthenticated information disclosure
|
|
|
5bd817 |
|
|
|
5bd817 |
Fix Description: nscpentrywsi is returned only authenticated as root.
|
|
|
5bd817 |
The bug was fixed by lkrispen@redhat.com (Ludwig Krispenz).
|
|
|
5bd817 |
His patch was modified based upon this review comment.
|
|
|
5bd817 |
https://bugzilla.redhat.com/show_bug.cgi?id=1123477#c2
|
|
|
5bd817 |
|
|
|
5bd817 |
https://bugzilla.redhat.com/show_bug.cgi?id=1123864
|
|
|
5bd817 |
|
|
|
5bd817 |
(cherry picked from commit aa90e26d5c4ea47b2a4a22f99cf0742cf48b3fae)
|
|
|
5bd817 |
---
|
|
|
5bd817 |
ldap/servers/slapd/computed.c | 17 +++++++++++++++--
|
|
|
5bd817 |
ldap/servers/slapd/entrywsi.c | 2 +-
|
|
|
5bd817 |
ldap/servers/slapd/slapi-plugin.h | 1 +
|
|
|
5bd817 |
3 files changed, 17 insertions(+), 3 deletions(-)
|
|
|
5bd817 |
|
|
|
5bd817 |
diff --git a/ldap/servers/slapd/computed.c b/ldap/servers/slapd/computed.c
|
|
|
5bd817 |
index 7c99b45..7a80c96 100644
|
|
|
5bd817 |
--- a/ldap/servers/slapd/computed.c
|
|
|
5bd817 |
+++ b/ldap/servers/slapd/computed.c
|
|
|
5bd817 |
@@ -59,6 +59,7 @@ struct _computed_attr_context {
|
|
|
5bd817 |
struct _compute_evaluator {
|
|
|
5bd817 |
struct _compute_evaluator *next;
|
|
|
5bd817 |
slapi_compute_callback_t function;
|
|
|
5bd817 |
+ int rootonly;
|
|
|
5bd817 |
};
|
|
|
5bd817 |
typedef struct _compute_evaluator compute_evaluator;
|
|
|
5bd817 |
|
|
|
5bd817 |
@@ -95,6 +96,13 @@ int compute_call_evaluators_nolock(computed_attr_context *c,slapi_compute_output
|
|
|
5bd817 |
compute_evaluator *current = NULL;
|
|
|
5bd817 |
|
|
|
5bd817 |
for (current = compute_evaluators; (current != NULL) && (-1 == rc); current = current->next) {
|
|
|
5bd817 |
+ if (current->rootonly) {
|
|
|
5bd817 |
+ int isroot;
|
|
|
5bd817 |
+ slapi_pblock_get(c->pb, SLAPI_REQUESTOR_ISROOT, &isroot);
|
|
|
5bd817 |
+ if (!isroot) {
|
|
|
5bd817 |
+ continue;
|
|
|
5bd817 |
+ }
|
|
|
5bd817 |
+ }
|
|
|
5bd817 |
rc = (*(current->function))(c,type,e,outfn);
|
|
|
5bd817 |
}
|
|
|
5bd817 |
return rc;
|
|
|
5bd817 |
@@ -157,14 +165,19 @@ compute_stock_evaluator(computed_attr_context *c,char* type,Slapi_Entry *e,slapi
|
|
|
5bd817 |
}
|
|
|
5bd817 |
|
|
|
5bd817 |
static void
|
|
|
5bd817 |
-compute_add_evaluator_nolock(slapi_compute_callback_t function, compute_evaluator *new_eval)
|
|
|
5bd817 |
+compute_add_evaluator_nolock(slapi_compute_callback_t function, compute_evaluator *new_eval, int rootonly)
|
|
|
5bd817 |
{
|
|
|
5bd817 |
new_eval->next = compute_evaluators;
|
|
|
5bd817 |
new_eval->function = function;
|
|
|
5bd817 |
+ new_eval->rootonly = rootonly;
|
|
|
5bd817 |
compute_evaluators = new_eval;
|
|
|
5bd817 |
}
|
|
|
5bd817 |
int slapi_compute_add_evaluator(slapi_compute_callback_t function)
|
|
|
5bd817 |
{
|
|
|
5bd817 |
+ return slapi_compute_add_evaluator_ext(function, 0);
|
|
|
5bd817 |
+}
|
|
|
5bd817 |
+int slapi_compute_add_evaluator_ext(slapi_compute_callback_t function, int rootonly)
|
|
|
5bd817 |
+{
|
|
|
5bd817 |
int rc = 0;
|
|
|
5bd817 |
compute_evaluator *new_eval = NULL;
|
|
|
5bd817 |
PR_ASSERT(NULL != function);
|
|
|
5bd817 |
@@ -187,7 +200,7 @@ int slapi_compute_add_evaluator(slapi_compute_callback_t function)
|
|
|
5bd817 |
slapi_rwlock_wrlock(compute_evaluators_lock);
|
|
|
5bd817 |
}
|
|
|
5bd817 |
|
|
|
5bd817 |
- compute_add_evaluator_nolock(function, new_eval);
|
|
|
5bd817 |
+ compute_add_evaluator_nolock(function, new_eval, rootonly);
|
|
|
5bd817 |
|
|
|
5bd817 |
if (need_lock) {
|
|
|
5bd817 |
slapi_rwlock_unlock(compute_evaluators_lock);
|
|
|
5bd817 |
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
|
|
|
5bd817 |
index 248a41f..0c01681 100644
|
|
|
5bd817 |
--- a/ldap/servers/slapd/entrywsi.c
|
|
|
5bd817 |
+++ b/ldap/servers/slapd/entrywsi.c
|
|
|
5bd817 |
@@ -898,7 +898,7 @@ entry_compute_nscpentrywsi(computed_attr_context *c,char* type,Slapi_Entry *e,sl
|
|
|
5bd817 |
int
|
|
|
5bd817 |
entry_computed_attr_init()
|
|
|
5bd817 |
{
|
|
|
5bd817 |
- slapi_compute_add_evaluator(entry_compute_nscpentrywsi);
|
|
|
5bd817 |
+ slapi_compute_add_evaluator_ext(entry_compute_nscpentrywsi, 1 /* root only */);
|
|
|
5bd817 |
return 0;
|
|
|
5bd817 |
}
|
|
|
5bd817 |
|
|
|
5bd817 |
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
|
|
|
5bd817 |
index d8cfe33..e1cadbc 100644
|
|
|
5bd817 |
--- a/ldap/servers/slapd/slapi-plugin.h
|
|
|
5bd817 |
+++ b/ldap/servers/slapd/slapi-plugin.h
|
|
|
5bd817 |
@@ -6038,6 +6038,7 @@ typedef int (*slapi_compute_output_t)(computed_attr_context *c,Slapi_Attr *a , S
|
|
|
5bd817 |
typedef int (*slapi_compute_callback_t)(computed_attr_context *c,char* type,Slapi_Entry *e,slapi_compute_output_t outputfn);
|
|
|
5bd817 |
typedef int (*slapi_search_rewrite_callback_t)(Slapi_PBlock *pb);
|
|
|
5bd817 |
int slapi_compute_add_evaluator(slapi_compute_callback_t function);
|
|
|
5bd817 |
+int slapi_compute_add_evaluator_ext(slapi_compute_callback_t function, int rootonly);
|
|
|
5bd817 |
int slapi_compute_add_search_rewriter(slapi_search_rewrite_callback_t function);
|
|
|
5bd817 |
int compute_rewrite_search_filter(Slapi_PBlock *pb);
|
|
|
5bd817 |
|
|
|
5bd817 |
--
|
|
|
5bd817 |
1.8.1.4
|
|
|
5bd817 |
|