ITS#2707: fix 'access to dn.subtree="" by ...' directives

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index 195b5c88f5a55575855eb1477e47e65371c486de..581d447f112d9f6b2fb5bf5eb7265c644e4cd285 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -169,8 +169,14 @@ parse_acl(
                                        } else if ( strcasecmp( style, "subtree" ) == 0
                                                || strcasecmp( style, "sub" ) == 0 )
                                        {
-                                               a->acl_dn_style = ACL_STYLE_SUBTREE;
-                                               ber_str2bv( right, 0, 1, &a->acl_dn_pat );
+                                               if( *right == '\0' ) {
+                                                       a->acl_dn_pat.bv_val = ch_strdup( "*" );
+                                                       a->acl_dn_pat.bv_len = 1;
+
+                                               } else {
+                                                       a->acl_dn_style = ACL_STYLE_SUBTREE;
+                                                       ber_str2bv( right, 0, 1, &a->acl_dn_pat );
+                                               }
 
                                        } else if ( strcasecmp( style, "children" ) == 0 ) {
                                                a->acl_dn_style = ACL_STYLE_CHILDREN;