Additional fix for ITS#4522. The "dn=" ist not optional.

[openldap] / servers / slapd / bconfig.c

diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index 1aa00d42e190e2049811887f0f6079ea16749da2..2f4528645074d32f1169648bda14ca298587098f 100644 (file)
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -2631,6 +2631,10 @@ config_replica(ConfigArgs *c) {
                                /* dealt with separately; don't let it get to bindconf */
                                ;
 
+                       } else if(!strncasecmp(c->argv[i], "host=", STRLENOF("host="))) {
+                               /* dealt with separately; don't let it get to bindconf */
+                               ;
+
                        } else if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) {
                                switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) {
                                        case 1:
@@ -3120,6 +3124,7 @@ read_config(const char *fname, const char *dir) {
                return 1;
 
        cfb = be->be_private;
+       be->be_dfltaccess = ACL_NONE;
 
        /* If no .conf, or a dir was specified, setup the dir */
        if ( !fname || dir ) {
@@ -3615,8 +3620,8 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
                /* No parent, must be root. This will never happen... */
                if ( !last && !be_isroot( op ) && !be_shadow_update( op ))
                        return LDAP_NO_SUCH_OBJECT;
-               if ( !access_allowed( op, last->ce_entry, slap_schema.si_ad_children,
-                       NULL, ACL_WADD, NULL ))
+               if ( last && !access_allowed( op, last->ce_entry,
+                       slap_schema.si_ad_children, NULL, ACL_WADD, NULL ))
                        return LDAP_INSUFFICIENT_ACCESS;
        }
 
@@ -4524,6 +4529,10 @@ config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent,
 }
 #endif
 
+static const char *defacl[] = {
+       NULL, "to", "*", "by", "*", "none", NULL
+};
+
 static int
 config_back_db_open( BackendDB *be )
 {
@@ -4542,6 +4551,14 @@ config_back_db_open( BackendDB *be )
        void *thrctx = NULL;
 
        Debug( LDAP_DEBUG_TRACE, "config_back_db_open\n", 0, 0, 0);
+
+       /* If we have no explicitly configured ACLs, don't just use
+        * the global ACLs. Explicitly deny access to everything.
+        */
+       if ( frontendDB->be_acl && be->be_acl == frontendDB->be_acl ) {
+               parse_acl(be, "config_back_db_open", 0, 6, (char **)defacl, 0 );
+       }
+
        /* If we read the config from back-ldif, nothing to do here */
        if ( cfb->cb_got_ldif )
                return 0;