Add reference to slapd.conf(5) and recommendation to avoid cleartext passwords.

[openldap] / servers / slapd / acl.c

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 72a89e2751086049b139b853a50a8d096ce366af..e94bfe3cd1f6ee356ba03b9c1afa8a016780d12c 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -50,7 +50,7 @@ access_allowed(
                return( 0 );
        }
 
-       edn = dn_normalize_case( strdup( e->e_dn ) );
+       edn = dn_normalize_case( ch_strdup( e->e_dn ) );
        Debug( LDAP_DEBUG_ACL, "\n=> access_allowed: entry (%s) attr (%s)\n",
                e->e_dn, attr, 0 );
 
@@ -250,7 +250,7 @@ acl_access_allowed(
 
        odn = NULL;
        if ( op->o_dn != NULL ) {
-               odn = dn_normalize_case( strdup( op->o_dn ) );
+               odn = dn_normalize_case( ch_strdup( op->o_dn ) );
                bv.bv_val = odn;
                bv.bv_len = strlen( odn );
        }
@@ -360,7 +360,9 @@ acl_access_allowed(
                        /* see if asker is listed in dnattr */
                        string_expand(buf, sizeof(buf), b->a_group, edn, matches);
 
-                       if (be_group(be, buf, odn, b->a_objectclassvalue, b->a_groupattrname) == 0) {
+                       if (be_group(be, e, buf, odn,
+                               b->a_objectclassvalue, b->a_groupattrname) == 0)
+                       {
                                Debug( LDAP_DEBUG_ACL,
                                        "<= acl_access_allowed: matched by clause #%d (group) access granted\n",
                                        i, 0, 0 );
@@ -380,7 +382,7 @@ acl_access_allowed(
 }
 
 /*
- * acl_check_mods - check access control on the given entry to see if
+ * acl_check_modlist - check access control on the given entry to see if
  * it allows the given modifications by the user associated with op.
  * returns     LDAP_SUCCESS    mods allowed ok
  *             anything else   mods not allowed - return is an error
@@ -388,45 +390,45 @@ acl_access_allowed(
  */
 
 int
-acl_check_mods(
+acl_check_modlist(
     Backend    *be,
     Connection *conn,
     Operation  *op,
     Entry      *e,
-    LDAPMod    *mods
+    LDAPModList        *mlist
 )
 {
        int             i;
        struct acl      *a;
        char            *edn;
 
-       edn = dn_normalize_case( strdup( e->e_dn ) );
+       edn = dn_normalize_case( ch_strdup( e->e_dn ) );
 
-       for ( ; mods != NULL; mods = mods->mod_next ) {
+       for ( ; mlist != NULL; mlist = mlist->ml_next ) {
                regmatch_t       matches[MAXREMATCHES];
 
                /* the lastmod attributes are ignored by ACL checking */
-               if ( strcasecmp( mods->mod_type, "modifiersname" ) == 0 ||
-                       strcasecmp( mods->mod_type, "modifytimestamp" ) == 0 ||
-                       strcasecmp( mods->mod_type, "creatorsname" ) == 0 ||
-                       strcasecmp( mods->mod_type, "createtimestamp" ) == 0 ) 
+               if ( strcasecmp( mlist->ml_type, "modifiersname" ) == 0 ||
+                       strcasecmp( mlist->ml_type, "modifytimestamp" ) == 0 ||
+                       strcasecmp( mlist->ml_type, "creatorsname" ) == 0 ||
+                       strcasecmp( mlist->ml_type, "createtimestamp" ) == 0 ) 
                {
                        Debug( LDAP_DEBUG_ACL, "LASTMOD attribute: %s access allowed\n",
-                               mods->mod_type, 0, 0 );
+                               mlist->ml_type, 0, 0 );
                        continue;
                }
 
-               a = acl_get_applicable( be, op, e, mods->mod_type, edn,
+               a = acl_get_applicable( be, op, e, mlist->ml_type, edn,
                        MAXREMATCHES, matches );
 
-               switch ( mods->mod_op & ~LDAP_MOD_BVALUES ) {
+               switch ( mlist->ml_op & ~LDAP_MOD_BVALUES ) {
                case LDAP_MOD_REPLACE:
                case LDAP_MOD_ADD:
-                       if ( mods->mod_bvalues == NULL ) {
+                       if ( mlist->ml_bvalues == NULL ) {
                                break;
                        }
-                       for ( i = 0; mods->mod_bvalues[i] != NULL; i++ ) {
-                               if ( ! acl_access_allowed( a, be, conn, e, mods->mod_bvalues[i], 
+                       for ( i = 0; mlist->ml_bvalues[i] != NULL; i++ ) {
+                               if ( ! acl_access_allowed( a, be, conn, e, mlist->ml_bvalues[i], 
                                        op, ACL_WRITE, edn, matches) ) 
                                {
                                        free(edn);
@@ -436,7 +438,7 @@ acl_check_mods(
                        break;
 
                case LDAP_MOD_DELETE:
-                       if ( mods->mod_bvalues == NULL ) {
+                       if ( mlist->ml_bvalues == NULL ) {
                                if ( ! acl_access_allowed( a, be, conn, e,
                                        NULL, op, ACL_WRITE, edn, matches) ) 
                                {
@@ -445,8 +447,8 @@ acl_check_mods(
                                }
                                break;
                        }
-                       for ( i = 0; mods->mod_bvalues[i] != NULL; i++ ) {
-                               if ( ! acl_access_allowed( a, be, conn, e, mods->mod_bvalues[i], 
+                       for ( i = 0; mlist->ml_bvalues[i] != NULL; i++ ) {
+                               if ( ! acl_access_allowed( a, be, conn, e, mlist->ml_bvalues[i], 
                                        op, ACL_WRITE, edn, matches) ) 
                                {
                                        free(edn);
@@ -478,7 +480,7 @@ string_expand(
        newbuf[0] = '\0';
 
        flag = 0;
-       for ( dp = newbuf, sp = pat; size < 512 && *sp ; sp++) {
+       for ( dp = newbuf, sp = pat; size < bufsiz && *sp ; sp++) {
                /* did we previously see a $ */
                if (flag) {
                        if (*sp == '$') {