don't return entry if requested attr is not present (ITS#5650)

[openldap] / servers / slapd / bconfig.c

diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index bd93b5c7b4797855ac12e30dd9e907376df1c4ec..a27299e4e82a92a5335cf515693b0084f7bf50ae 100644 (file)
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -501,6 +501,7 @@ static ConfigTable config_back_cf_table[] = {
                        "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
        { "rootdn", "dn", 2, 2, 0, ARG_DB|ARG_DN|ARG_QUOTE|ARG_MAGIC,
                &config_rootdn, "( OLcfgDbAt:0.8 NAME 'olcRootDN' "
+                       "EQUALITY distinguishedNameMatch "
                        "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
        { "rootDSE", "file", 2, 2, 0, ARG_MAGIC|CFG_ROOTDSE,
                &config_generic, "( OLcfgGlAt:51 NAME 'olcRootDSE' "
@@ -541,6 +542,7 @@ static ConfigTable config_back_cf_table[] = {
                &config_generic, NULL, NULL, NULL },
        { "schemadn", "dn", 2, 2, 0, ARG_MAY_DB|ARG_DN|ARG_QUOTE|ARG_MAGIC,
                &config_schema_dn, "( OLcfgGlAt:58 NAME 'olcSchemaDN' "
+                       "EQUALITY distinguishedNameMatch "
                        "SYNTAX OMsDN SINGLE-VALUE )", NULL, NULL },
        { "security", "factors", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
                &config_security, "( OLcfgGlAt:59 NAME 'olcSecurity' "
@@ -3990,6 +3992,11 @@ cfAddDatabase( CfEntryInfo *p, Entry *e, struct config_args_s *ca )
        if ( p->ce_type != Cft_Global ) {
                return LDAP_CONSTRAINT_VIOLATION;
        }
+       /* config must be {0}, nothing else allowed */
+       if ( !strncmp( e->e_nname.bv_val, "olcDatabase={0}", STRLENOF("olcDatabase={0}")) &&
+               strncmp( e->e_nname.bv_val + STRLENOF("olcDatabase={0}"), "config,", STRLENOF("config,") )) {
+               return LDAP_CONSTRAINT_VIOLATION;
+       }
        ca->be = frontendDB;    /* just to get past check_vals */
        return LDAP_SUCCESS;
 }
@@ -5455,7 +5462,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent,
        ce->ce_parent = parent;
        if ( parent ) {
                pdn = parent->ce_entry->e_nname;
-               if ( parent->ce_kids )
+               if ( parent->ce_kids && parent->ce_kids->ce_type <= ce->ce_type )
                        for ( ceprev = parent->ce_kids; ceprev->ce_sibs &&
                                ceprev->ce_type <= ce->ce_type;
                                ceprev = ceprev->ce_sibs );