|
 |
590d18 |
From 9fedf58eb1282560957edc1f36356602b55a736d Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: Tomas Babej <tbabej@redhat.com>
|
|
|
590d18 |
Date: Thu, 23 Jul 2015 14:00:06 +0200
|
|
|
590d18 |
Subject: [PATCH] idviews: Enforce objectclass check in idoverride*-del
|
|
|
590d18 |
|
|
|
590d18 |
Even with anchor to sid type checking, it would be still
|
|
|
590d18 |
possible to delete a user ID override by specifying a group
|
|
|
590d18 |
raw anchor and vice versa.
|
|
|
590d18 |
|
|
|
590d18 |
This patch introduces a objectclass check in idoverride*-del
|
|
|
590d18 |
commands to prevent that.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5029
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
ipalib/plugins/idviews.py | 19 +++++++++++++++++++
|
|
|
590d18 |
1 file changed, 19 insertions(+)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py
|
|
|
590d18 |
index c4f748132642f8702dcd12d38367dc36f4bc4a3c..2e6e84510d3caa3636d3f0c08c56403866ff54f9 100644
|
|
|
590d18 |
--- a/ipalib/plugins/idviews.py
|
|
|
590d18 |
+++ b/ipalib/plugins/idviews.py
|
|
|
590d18 |
@@ -716,6 +716,25 @@ class baseidoverride_del(LDAPDelete):
|
|
|
590d18 |
|
|
|
590d18 |
takes_options = LDAPDelete.takes_options + (fallback_to_ldap_option,)
|
|
|
590d18 |
|
|
|
590d18 |
+ def pre_callback(self, ldap, dn, *keys, **options):
|
|
|
590d18 |
+ assert isinstance(dn, DN)
|
|
|
590d18 |
+
|
|
|
590d18 |
+ # Make sure the entry we're deleting has all the objectclasses
|
|
|
590d18 |
+ # this object requires
|
|
|
590d18 |
+ try:
|
|
|
590d18 |
+ entry = ldap.get_entry(dn, ['objectclass'])
|
|
|
590d18 |
+ except errors.NotFound:
|
|
|
590d18 |
+ self.obj.handle_not_found(*keys)
|
|
|
590d18 |
+
|
|
|
590d18 |
+ required_object_classes = set(self.obj.object_class)
|
|
|
590d18 |
+ actual_object_classes = set(entry['objectclass'])
|
|
|
590d18 |
+
|
|
|
590d18 |
+ # If not, treat it as a failed search
|
|
|
590d18 |
+ if not required_object_classes.issubset(actual_object_classes):
|
|
|
590d18 |
+ self.obj.handle_not_found(*keys)
|
|
|
590d18 |
+
|
|
|
590d18 |
+ return dn
|
|
|
590d18 |
+
|
|
|
590d18 |
|
|
|
590d18 |
class baseidoverride_mod(LDAPUpdate):
|
|
|
590d18 |
__doc__ = _('Modify an ID override.')
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|