fix ITS#3753

[openldap] / servers / slapd / backend.c

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index 9a348f44bf00e220fd5c692b4f1afbb7d82b08b5..4552a6ac1c6d4ff3a7397c5725e211e229e29153 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -98,8 +98,7 @@ int backend_init(void)
                return -1;
        }
 
-       for( bi=slap_binfo; bi->bi_type != NULL; bi++,nBackendInfo++ )
-       {
+       for( bi=slap_binfo; bi->bi_type != NULL; bi++,nBackendInfo++ ) {
                assert( bi->bi_init );
 
                rc = bi->bi_init( bi );
@@ -821,18 +820,18 @@ backend_check_controls(
                                break;
 
                        case LDAP_COMPARE_FALSE:
-                               if ( !op->o_bd->be_ctrls[ cid ] )
-                               {
+                               if ( !op->o_bd->be_ctrls[cid] && (*ctrls)->ldctl_iscritical ) {
                                        /* Per RFC 2251 (and LDAPBIS discussions), if the control
                                         * is recognized and appropriate for the operation (which
                                         * we've already verified), then the server should make
                                         * use of the control when performing the operation.
                                         * 
                                         * Here we find that operation extended by the control
-                                        * is not unavailable in a particular context, hence the
-                                        * return of unwillingToPerform.
+                                        * is unavailable in a particular context, and the control
+                                        * is marked Critical, hence the return of
+                                        * unwillingToPerform.
                                         */
-                                       rs->sr_text = "control unavailable in context";
+                                       rs->sr_text = "critical control unavailable in context";
                                        rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                                        goto done;
                                }
@@ -843,6 +842,11 @@ backend_check_controls(
 
                        default:
                                /* unreachable */
+                               Debug( LDAP_DEBUG_ANY,
+                                       "backend_check_controls: unable to check control: %s\n",
+                                       (*ctrls)->ldctl_oid, 0, 0 );
+                               assert( 0 );
+
                                rs->sr_text = "unable to check control";
                                rs->sr_err = LDAP_OTHER;
                                goto done;
@@ -850,6 +854,12 @@ backend_check_controls(
                }
        }
 
+       /* check should be generalized */
+       if( get_manageDIT(op) && !be_isroot(op)) {
+               rs->sr_text = "requires manager authorization";
+               rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+       }
+
 done:;
        return rs->sr_err;
 }
@@ -1281,7 +1291,7 @@ backend_group(
                                }
                                
                                if ( rc == 0 ) {
-                                       rc = 1;
+                                       rc = LDAP_COMPARE_FALSE;
                                        for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) {
                                                if ( ldap_url_parse( a->a_vals[i].bv_val, &ludp ) !=
                                                        LDAP_URL_SUCCESS )
@@ -1354,6 +1364,8 @@ loopit:
                                SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
                                SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
                                a->a_nvals, op_ndn, op->o_tmpmemctx );
+                               if ( rc == LDAP_NO_SUCH_ATTRIBUTE )
+                                       rc = LDAP_COMPARE_FALSE;
                        }
                } else {
                        rc = LDAP_NO_SUCH_ATTRIBUTE;