check consistency of referrals and result code (ITS#4861)

[openldap] / servers / slapd / aclparse.c

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index 051e4a6fb4ace6f12a3614915d89552ae188d208..37db9afd7f80fbdbaf8fed5496b23ed83f823ab0 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2007 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1110,6 +1110,7 @@ parse_acl(
                                if ( strncasecmp( left, "group", STRLENOF( "group" ) ) == 0 ) {
                                        char *name = NULL;
                                        char *value = NULL;
+                                       char *attr_name = SLAPD_GROUP_ATTR;
 
                                        switch ( sty ) {
                                        case ACL_STYLE_REGEX:
@@ -1227,49 +1228,41 @@ parse_acl(
                                        }
 
                                        if ( name && *name ) {
-                                               rc = slap_str2ad( name, &b->a_group_at, &text );
-
-                                               if( rc != LDAP_SUCCESS ) {
-                                                       char    buf[ SLAP_TEXT_BUFLEN ];
-
-                                                       snprintf( buf, sizeof( buf ),
-                                                               "group \"%s\": %s.",
-                                                               right, text );
-                                                       Debug( LDAP_DEBUG_ANY,
-                                                               "%s: line %d: %s\n",
-                                                               fname, lineno, buf );
-                                                       goto fail;
-                                               }
+                                               attr_name = name;
                                                *--name = '/';
 
-                                       } else {
-                                               rc = slap_str2ad( SLAPD_GROUP_ATTR, &b->a_group_at, &text );
+                                       }
 
-                                               if ( rc != LDAP_SUCCESS ) {
-                                                       char    buf[ SLAP_TEXT_BUFLEN ];
+                                       rc = slap_str2ad( attr_name, &b->a_group_at, &text );
+                                       if ( rc != LDAP_SUCCESS ) {
+                                               char    buf[ SLAP_TEXT_BUFLEN ];
 
-                                                       snprintf( buf, sizeof( buf ),
-                                                               "group \"%s\": %s.",
-                                                               SLAPD_GROUP_ATTR, text );
-                                                       Debug( LDAP_DEBUG_ANY,
-                                                               "%s: line %d: %s\n",
-                                                               fname, lineno, buf );
-                                                       goto fail;
-                                               }
+                                               snprintf( buf, sizeof( buf ),
+                                                       "group \"%s\": %s.",
+                                                       right, text );
+                                               Debug( LDAP_DEBUG_ANY,
+                                                       "%s: line %d: %s\n",
+                                                       fname, lineno, buf );
+                                               goto fail;
                                        }
 
                                        if ( !is_at_syntax( b->a_group_at->ad_type,
-                                               SLAPD_DN_SYNTAX ) &&
-                                               !is_at_syntax( b->a_group_at->ad_type,
-                                               SLAPD_NAMEUID_SYNTAX ) &&
-                                               !is_at_subtype( b->a_group_at->ad_type, slap_schema.si_ad_labeledURI->ad_type ) )
+                                                       SLAPD_DN_SYNTAX ) /* e.g. "member" */
+                                               && !is_at_syntax( b->a_group_at->ad_type,
+                                                       SLAPD_NAMEUID_SYNTAX ) /* e.g. memberUID */
+                                               && !is_at_subtype( b->a_group_at->ad_type,
+                                                       slap_schema.si_ad_labeledURI->ad_type ) /* e.g. memberURL */ )
                                        {
                                                char    buf[ SLAP_TEXT_BUFLEN ];
 
                                                snprintf( buf, sizeof( buf ),
-                                                       "group \"%s\": inappropriate syntax: %s.",
+                                                       "group \"%s\" attr \"%s\": inappropriate syntax: %s; "
+                                                       "must be " SLAPD_DN_SYNTAX " (DN), "
+                                                       SLAPD_NAMEUID_SYNTAX " (NameUID) "
+                                                       "or a subtype of labeledURI.",
                                                        right,
-                                                       b->a_group_at->ad_type->sat_syntax_oid );
+                                                       attr_name,
+                                                       at_syntax( b->a_group_at->ad_type ) );
                                                Debug( LDAP_DEBUG_ANY,
                                                        "%s: line %d: %s\n",
                                                        fname, lineno, buf );