ITS#5572 retrieve main DB's ACL before relevant operations

[openldap] / servers / slapd / overlays / deref.c

diff --git a/servers/slapd/overlays/deref.c b/servers/slapd/overlays/deref.c
index 0ac82b5cbe417805954b5699d8396835996ebe38..c3d4e7d8ed7f06eb559c43b451e3bbe7346ecf41 100644 (file)
--- a/servers/slapd/overlays/deref.c
+++ b/servers/slapd/overlays/deref.c
@@ -192,7 +192,7 @@ deref_parseCtrl (
                ds = (DerefSpec *)op->o_tmpcalloc( 1,
                        sizeof(DerefSpec) + sizeof(AttributeDescription *)*(cnt + 1),
                        op->o_tmpmemctx );
-               ds->ds_attributes = (AttributeDescription **)&ds[1];
+               ds->ds_attributes = (AttributeDescription **)&ds[ 1 ];
                ds->ds_nattrs = cnt;
 
                rc = slap_bv2ad( &derefAttr, &ds->ds_derefAttr, &text );
@@ -262,6 +262,20 @@ justcleanup:;
        return rs->sr_err;
 }
 
+static int
+deref_cleanup( Operation *op, SlapReply *rs )
+{
+       if ( rs->sr_type == REP_RESULT || rs->sr_err == SLAPD_ABANDON ) {
+               op->o_tmpfree( op->o_callback, op->o_tmpmemctx );
+               op->o_callback = NULL;
+
+               op->o_tmpfree( op->o_ctrlderef, op->o_tmpmemctx );
+               op->o_ctrlderef = NULL;
+       }
+
+       return SLAP_CB_CONTINUE;
+}
+
 static int
 deref_response( Operation *op, SlapReply *rs )
 {
@@ -273,23 +287,33 @@ deref_response( Operation *op, SlapReply *rs )
                deref_cb_t *dc = (deref_cb_t *)op->o_callback->sc_private;
                DerefSpec *ds;
                DerefRes *dr, *drhead = NULL, **drp = &drhead;
-               BackendInfo *bi = op->o_bd->bd_info;
                struct berval bv = BER_BVNULL;
                int nDerefRes = 0, nDerefVals = 0, nAttrs = 0, nVals = 0;
                struct berval ctrlval;
                LDAPControl *ctrl, **ctrlsp;
                AccessControlState acl_state = ACL_STATE_INIT;
                static char dummy = '\0';
+               Entry *ebase;
                int i;
 
-               op->o_bd->bd_info = (BackendInfo *)dc->dc_on->on_info;
+               rc = overlay_entry_get_ov( op, &rs->sr_entry->e_nname, NULL, NULL, 0, &ebase, dc->dc_on );
+               if ( rc != LDAP_SUCCESS || ebase == NULL ) {
+                       return SLAP_CB_CONTINUE;
+               }
+
                for ( ds = dc->dc_ds; ds; ds = ds->ds_next ) {
-                       Attribute *a = attr_find( rs->sr_entry->e_attrs, ds->ds_derefAttr );
+                       Attribute *a = attr_find( ebase->e_attrs, ds->ds_derefAttr );
 
                        if ( a != NULL ) {
                                DerefVal *dv;
                                BerVarray *bva;
 
+                               if ( !access_allowed( op, rs->sr_entry, a->a_desc,
+                                               NULL, ACL_READ, &acl_state ) )
+                               {
+                                       continue;
+                               }
+
                                dr = op->o_tmpcalloc( 1,
                                        sizeof( DerefRes ) + ( sizeof( DerefVal ) + sizeof( BerVarray * ) * ds->ds_nattrs ) * ( a->a_numvals + 1 ),
                                        op->o_tmpmemctx );
@@ -315,8 +339,8 @@ deref_response( Operation *op, SlapReply *rs )
                                                continue;
                                        }
 
-                                       dv[i].dv_derefSpecVal = a->a_vals[ i ];
-                                       bv.bv_len += dv[i].dv_derefSpecVal.bv_len;
+                                       ber_dupbv_x( &dv[ i ].dv_derefSpecVal, &a->a_vals[ i ], op->o_tmpmemctx );
+                                       bv.bv_len += dv[ i ].dv_derefSpecVal.bv_len;
                                        nVals++;
                                        nDerefVals++;
 
@@ -374,7 +398,7 @@ deref_response( Operation *op, SlapReply *rs )
                                drp = &dr->dr_next;
                        }
                }
-               op->o_bd->bd_info = bi;
+               overlay_entry_release_ov( op, ebase, 0, dc->dc_on );
 
                if ( drhead == NULL ) {
                        return SLAP_CB_CONTINUE;
@@ -402,6 +426,7 @@ deref_response( Operation *op, SlapReply *rs )
                                rc = ber_printf( ber, "{OO" /*}*/,
                                        &dr->dr_spec.ds_derefAttr->ad_cname,
                                        &dr->dr_vals[ i ].dv_derefSpecVal );
+                               op->o_tmpfree( dr->dr_vals[ i ].dv_derefSpecVal.bv_val, op->o_tmpmemctx );
                                for ( j = 0; j < dr->dr_spec.ds_nattrs; j++ ) {
                                        if ( dr->dr_vals[ i ].dv_attrVals[ j ] != NULL ) {
                                                if ( first ) {
@@ -476,23 +501,12 @@ cleanup:;
                        op->o_tmpfree( drhead, op->o_tmpmemctx );
                        drhead = drnext;
                }
-       }
 
-       return rc;
-}
-
-static int
-deref_cleanup( Operation *op, SlapReply *rs )
-{
-       if ( rs->sr_type == REP_RESULT || rs->sr_err == SLAPD_ABANDON ) {
-               op->o_tmpfree( op->o_callback, op->o_tmpmemctx );
-               op->o_callback = NULL;
-
-               op->o_tmpfree( op->o_ctrlderef, op->o_tmpmemctx );
-               op->o_ctrlderef = NULL;
+       } else if ( rs->sr_type == REP_RESULT ) {
+               rc = deref_cleanup( op, rs );
        }
 
-       return SLAP_CB_CONTINUE;
+       return rc;
 }
 
 static int
@@ -530,7 +544,7 @@ deref_initialize(void)
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
                        "deref_init: Failed to register control (%d)\n",
-               rc, 0, 0 );
+                       rc, 0, 0 );
                return -1;
        }