From: Mark Valence <mrv@openldap.org>
Date: Sat, 17 Jun 2000 18:23:27 +0000 (+0000)
Subject: Fixed paren nesting bug, separated convoluted conditionals, added comm
X-Git-Tag: LDBM_PRE_GIANT_RWLOCK~2597
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=3a31fead5e3fd7672df4703ef11445d162038f0e;p=openldap

Fixed paren nesting bug, separated convoluted conditionals, added comm
ents about the logic.
---

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index cc5882a58a..c942737821 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -532,7 +532,7 @@ acl_mask(
 		if ( b->a_dn_at != NULL && op->o_ndn != NULL ) {
 			Attribute	*at;
 			struct berval	bv;
-			int match = 0;
+			int rc, match = 0;
 			const char *text;
 			const char *desc = b->a_dn_at->ad_cname->bv_val;
 
@@ -555,21 +555,41 @@ acl_mask(
 			}
 
 			if( match ) {
-				if ( b->a_dn_self && (val == NULL
-					|| value_match( &match, b->a_dn_at,
-						b->a_dn_at->ad_type->sat_equality, val, &bv, &text ) )
-						!= LDAP_SUCCESS
-					|| match )
-				{
-					continue;
+				/* have a dnattr match. if this is a self clause then
+				 * the target must also match the op dn.
+				 */
+				if ( b->a_dn_self ) {
+					/* check if the target is an attribute. */
+					if ( val == NULL )
+						continue;
+					/* target is attribute, check if the attribute value
+					 * is the op dn.
+					 */
+					rc = value_match(	&match, b->a_dn_at,
+										b->a_dn_at->ad_type->sat_equality,
+										val, &bv, &text );
+					/* on match error or no match, fail the ACL clause */
+					if (rc != LDAP_SUCCESS || match != 0 )
+						continue;
 				}
-			} else if ( ! b->a_dn_self || val == NULL
-				|| value_match( &match, b->a_dn_at,
-					b->a_dn_at->ad_type->sat_equality, val, &bv, &text )
-					!= LDAP_SUCCESS
-				|| match )
-			{
-				continue;
+			} else {
+				/* no dnattr match, check if this is a self clause */
+				if ( ! b->a_dn_self )
+					continue;
+				/* this is a self clause, check if the target is an
+				 * attribute.
+				 */
+				if ( val == NULL )
+					continue;
+				/* target is attribute, check if the attribute value
+				 * is the op dn.
+				 */
+				rc = value_match(	&match, b->a_dn_at,
+									b->a_dn_at->ad_type->sat_equality,
+									val, &bv, &text );
+				/* on match error or no match, fail the ACL clause */
+				if (rc != LDAP_SUCCESS || match != 0 )
+					continue;
 			}
 		}