allow 'sub' and 'subtree' in acl (fix ITS#2300)

diff --git a/doc/man/man5/slapd.access.5 b/doc/man/man5/slapd.access.5
index 2ab4a3c4e3586ae9d5dcce93fa308ca2f47ca15d..f124f940d5afc12cf17fcefd0d5b4cf4cf99110a 100644 (file)
--- a/doc/man/man5/slapd.access.5
+++ b/doc/man/man5/slapd.access.5
@@ -95,6 +95,8 @@ for an exact match of the entry,
 to indicate all the entries immediately below the
 .BR pattern ,
 .B sub
+or
+.B subtree
 to indicate all the subentries of an entry including the entry itself,
 .B children
 to indicate all the subentries of an entry not including the entry itself.
@@ -258,6 +260,8 @@ case apply.
 The
 .BR domain 
 clause also allows the
+.B sub
+or
 .B subtree
 style, which succeeds when a fully qualified name exactly matches the
 .BR domain

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index f0a05a77ca3915c5c2354e104cb4c6ba6750c884..bcf96a8a273e5e719f641ee08c615e36947b8311 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -185,7 +185,7 @@ parse_acl(
                                        } else if ( strcasecmp( style, "one" ) == 0 ) {
                                                a->acl_dn_style = ACL_STYLE_ONE;
                                                ber_str2bv( right, 0, 1, &a->acl_dn_pat );
-                                       } else if ( strcasecmp( style, "subtree" ) == 0 ) {
+                                       } else if ( strcasecmp( style, "subtree" ) == 0 || strcasecmp( style, "sub" ) == 0 ) {
                                                a->acl_dn_style = ACL_STYLE_SUBTREE;
                                                ber_str2bv( right, 0, 1, &a->acl_dn_pat );
                                        } else if ( strcasecmp( style, "children" ) == 0 ) {
@@ -307,7 +307,7 @@ parse_acl(
                                        sty = ACL_STYLE_BASE;
                                } else if ( strcasecmp( style, "one" ) == 0 ) {
                                        sty = ACL_STYLE_ONE;
-                               } else if ( strcasecmp( style, "subtree" ) == 0 ) {
+                               } else if ( strcasecmp( style, "subtree" ) == 0 || strcasecmp( style, "sub" ) == 0 ) {
                                        sty = ACL_STYLE_SUBTREE;
                                } else if ( strcasecmp( style, "children" ) == 0 ) {
                                        sty = ACL_STYLE_CHILDREN;
@@ -1282,7 +1282,7 @@ acl_usage( void )
                        "\t[aci=<attrname>]\n"
 #endif
                        "\t[ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]\n"
-               "<dnstyle> ::= regex | base | exact (alias of base) | one | sub | children\n"
+               "<dnstyle> ::= regex | base | exact (alias of base) | one | sub[tree] | children\n"
                "<style> ::= regex | base | exact (alias of base)\n"
                "<groupflags> ::= R\n"
                "<access> ::= [self]{<level>|<priv>}\n"