ITS#6045: Use copy of db when testing filter in matchops.

[openldap] / servers / slapd / controls.c

diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index ee2a36742f91aca599ebb4f9e732a257f23d11c5..d5dd764f83f64615cf7999d81d35e74364160d7c 100644 (file)
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2008 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -123,8 +123,7 @@ static char *session_tracking_extops[] = {
 static struct slap_control control_defs[] = {
        {  LDAP_CONTROL_ASSERT,
                (int)offsetof(struct slap_control_ids, sc_assert),
-               SLAP_CTRL_DELETE|SLAP_CTRL_MODIFY|SLAP_CTRL_RENAME|
-                       SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH,
+               SLAP_CTRL_UPDATE|SLAP_CTRL_COMPARE|SLAP_CTRL_SEARCH,
                NULL, NULL,
                parseAssert, LDAP_SLIST_ENTRY_INITIALIZER(next) },
        { LDAP_CONTROL_PRE_READ,
@@ -863,7 +862,9 @@ return_results:
                                }
 
                                if ( get_whatFailed( op ) ) {
-                                       char *oids[ 2 ] = { failed_oid, NULL };
+                                       char *oids[ 2 ];
+                                       oids[ 0 ] = failed_oid;
+                                       oids[ 1 ] = NULL;
                                        slap_ctrl_whatFailed_add( op, rs, oids );
                                }
                        }
@@ -960,6 +961,13 @@ static int parseDontUseCopy (
                return LDAP_PROTOCOL_ERROR;
        }
 
+       if ( ( global_disallows & SLAP_DISALLOW_DONTUSECOPY_N_CRIT )
+               && !ctrl->ldctl_iscritical )
+       {
+               rs->sr_text = "dontUseCopy criticality of FALSE not allowed";
+               return LDAP_PROTOCOL_ERROR;
+       }
+
        op->o_dontUseCopy = ctrl->ldctl_iscritical
                ? SLAP_CONTROL_CRITICAL
                : SLAP_CONTROL_NONCRITICAL;
@@ -1029,6 +1037,13 @@ static int parseProxyAuthz (
                return LDAP_PROTOCOL_ERROR;
        }
 
+       if ( ( global_disallows & SLAP_DISALLOW_PROXY_AUTHZ_N_CRIT )
+               && !ctrl->ldctl_iscritical )
+       {
+               rs->sr_text = "proxied authorization criticality of FALSE not allowed";
+               return LDAP_PROTOCOL_ERROR;
+       }
+
        if ( !( global_allows & SLAP_ALLOW_PROXY_AUTHZ_ANON )
                && BER_BVISEMPTY( &op->o_ndn ) )
        {