ITS#4049,4051 - verify oldPassword when provided.

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 41ff3671345567a639680987e31965d98a0223a5..c8f8ce75b510b2e3350c61250f5857221eacf7b6 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -209,11 +209,27 @@ int passwd_extop(
        }
 
        if ( qpw->rs_old.bv_val != NULL ) {
+               Entry *e = NULL;
+
+               rc = be_entry_get_rw( op, &op->o_req_ndn, NULL,
+                       slap_schema.si_ad_userPassword, 0, &e );
+               if ( rc == LDAP_SUCCESS && e ) {
+                       Attribute *a = attr_find( e->e_attrs,
+                               slap_schema.si_ad_userPassword );
+                       if ( a )
+                               rc = slap_passwd_check( op, e, a, &qpw->rs_old, &rs->sr_text );
+                       else
+                               rc = 1;
+                       be_entry_release_r( op, e );
+                       if ( rc == LDAP_SUCCESS )
+                               goto old_good;
+               }
                rs->sr_text = "unwilling to verify old password";
                rc = LDAP_UNWILLING_TO_PERFORM;
                goto error_return;
        }
 
+old_good:
        ml = ch_malloc( sizeof(Modifications) );
        if ( !qpw->rs_modtail ) qpw->rs_modtail = &ml->sml_next;