ITS#4255: ACL "exact" attrval clause needs normalized value

diff --git a/CHANGES b/CHANGES
index 135ce657777e32fac0604cdfd60e81b9d8fd88b4..f5c4e898487be08700937807e0d3d989652f0873 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,9 +2,9 @@ OpenLDAP 2.3 Change Log
 
 OpenLDAP 2.3.14 Engineering
        Fixed slapd sc_prev update after free bug (ITS#4237)
-       Fixed slapd-meta sizelimit disclose issue (ITS#4213)
        Fixed slapo-rwm static DN free bug (ITS#4248)
        Fixed slapd assertion control restrictions
+       Fixed slapd ACL exact attrval clause needs normalization (ITS#4255)
 
 OpenLDAP 2.3.13 Release
        Fixed libldap/liblutil MSG_ACCRIGHTSLEN bug (ITS#4206)

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 48d5eb7f142b1bcecf431d563c3e3bba54be496a..e4a2b8f1696006df0521ed4caf9c9fa9c3a025d0 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -885,7 +885,7 @@ slap_acl_get(
        
                                if ( a->acl_attrs[0].an_desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) {
                                        if (value_match( &match, desc,
-                                               /* desc->ad_type->sat_equality */ a->acl_attrval_mr, 0,
+                                               a->acl_attrval_mr, 0,
                                                val, &a->acl_attrval, &text ) != LDAP_SUCCESS ||
                                                        match )
                                                continue;
@@ -925,7 +925,7 @@ slap_acl_get(
                                                        continue;
                                        }
        
-                                       if ( strcmp( a->acl_attrval.bv_val, val->bv_val + vdnlen - patlen ))
+                                       if ( strcmp( a->acl_attrval.bv_val, val->bv_val + vdnlen - patlen ) )
                                                continue;
                                }
                        }