From fc784ad8fd44747e482df6be8355746702f8cfba Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Sat, 10 Sep 2005 01:49:46 +0000 Subject: [PATCH] ITS#2757 remove isroot checks, simplify --- servers/slapd/back-ldbm/modrdn.c | 150 +++++++++++-------------------- 1 file changed, 51 insertions(+), 99 deletions(-) diff --git a/servers/slapd/back-ldbm/modrdn.c b/servers/slapd/back-ldbm/modrdn.c index c8ef1e5446..5f4478d5da 100644 --- a/servers/slapd/back-ldbm/modrdn.c +++ b/servers/slapd/back-ldbm/modrdn.c @@ -49,7 +49,6 @@ ldbm_back_modrdn( /* LDAP v2 supporting correct attribute handling. */ LDAPRDN new_rdn = NULL; LDAPRDN old_rdn = NULL; - int isroot = -1; int rc_id = 0; ID id = NOID; char textbuf[SLAP_TEXT_BUFLEN]; @@ -159,79 +158,40 @@ ldbm_back_modrdn( goto return_results; } + } else { + p = (Entry *)&slap_entry_root; + } - /* check parent for "children" acl */ - if ( ! access_allowed( op, p, children, NULL, - op->oq_modrdn.rs_newSup != NULL ? - ACL_WDEL : ACL_WRITE, - NULL ) ) - { - Debug( LDAP_DEBUG_TRACE, "no access to parent\n", 0, - 0, 0 ); - - send_ldap_error( op, rs, LDAP_INSUFFICIENT_ACCESS, - NULL ); - goto return_results; - } + /* check parent for "children" acl */ + if ( ! access_allowed( op, p, children, NULL, + op->oq_modrdn.rs_newSup != NULL ? + ACL_WDEL : ACL_WRITE, + NULL ) ) + { + Debug( LDAP_DEBUG_TRACE, "no access to parent\n", 0, + 0, 0 ); - Debug( LDAP_DEBUG_TRACE, - "ldbm_back_modrdn: wr to children of entry %s OK\n", - p_ndn.bv_val, 0, 0 ); + send_ldap_error( op, rs, LDAP_INSUFFICIENT_ACCESS, + NULL ); + goto return_results; + } - if ( p_ndn.bv_val == slap_empty_bv.bv_val ) { - p_dn = slap_empty_bv; - } else { - dnParent( &e->e_name, &p_dn ); - } + if ( BER_BVISEMPTY( &p_ndn )) + p = NULL; - Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: parent dn=%s\n", - p_dn.bv_val, 0, 0 ); + Debug( LDAP_DEBUG_TRACE, + "ldbm_back_modrdn: wr to children of entry %s OK\n", + p_ndn.bv_val, 0, 0 ); + if ( p_ndn.bv_val == slap_empty_bv.bv_val ) { + p_dn = slap_empty_bv; } else { - /* no parent, must be root to modify rdn */ - isroot = be_isroot( op ); - if ( ! isroot ) { - if ( be_issuffix( op->o_bd, (struct berval *)&slap_empty_bv ) - || be_shadow_update( op ) ) { - int can_access; - p = (Entry *)&slap_entry_root; - - can_access = access_allowed( op, p, - children, NULL, - op->oq_modrdn.rs_newSup ? - ACL_WDEL : ACL_WRITE, - NULL ); - p = NULL; - - /* check parent for "children" acl */ - if ( ! can_access ) { - Debug( LDAP_DEBUG_TRACE, - "<=- ldbm_back_modrdn: no " - "access to parent\n", 0, 0, 0 ); - - send_ldap_error( op, rs, - LDAP_INSUFFICIENT_ACCESS, - NULL ); - goto return_results; - } - - } else { - Debug( LDAP_DEBUG_TRACE, - "<=- ldbm_back_modrdn: no parent & " - "not root\n", 0, 0, 0); - - send_ldap_error( op, rs, - LDAP_INSUFFICIENT_ACCESS, - NULL ); - goto return_results; - } - } - - Debug( LDAP_DEBUG_TRACE, - "ldbm_back_modrdn: no parent, locked root\n", - 0, 0, 0 ); + dnParent( &e->e_name, &p_dn ); } + Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: parent dn=%s\n", + p_dn.bv_val, 0, 0 ); + new_parent_dn = &p_dn; /* New Parent unless newSuperior given */ if ( op->oq_modrdn.rs_newSup != NULL ) { @@ -262,7 +222,7 @@ ldbm_back_modrdn( "ldbm_back_modrdn: newSup(ndn=%s) not here!\n", np_ndn->bv_val, 0, 0); - send_ldap_error( op, rs, LDAP_OTHER, + send_ldap_error( op, rs, LDAP_NO_SUCH_OBJECT, "newSuperior not found" ); goto return_results; } @@ -306,27 +266,20 @@ ldbm_back_modrdn( } } else { - - /* no parent, must be root to modify newSuperior */ - if ( isroot == -1 ) { - isroot = be_isroot( op ); - } - - if ( ! isroot ) { - if ( be_issuffix( op->o_bd, (struct berval *)&slap_empty_bv ) - || be_shadow_update( op ) ) { - int can_access; - np = (Entry *)&slap_entry_root; - - can_access = access_allowed( op, np, - children, NULL, ACL_WADD, NULL ); - np = NULL; - - /* check parent for "children" acl */ - if ( ! can_access ) { - Debug( LDAP_DEBUG_TRACE, - "<=- ldbm_back_modrdn: no " - "access to new superior\n", 0, 0, 0 ); + if ( be_issuffix( op->o_bd, (struct berval *)&slap_empty_bv ) + || be_shadow_update( op ) ) { + int can_access; + np = (Entry *)&slap_entry_root; + + can_access = access_allowed( op, np, + children, NULL, ACL_WADD, NULL ); + np = NULL; + + /* check parent for "children" acl */ + if ( ! can_access ) { + Debug( LDAP_DEBUG_TRACE, + "<=- ldbm_back_modrdn: no " + "access to new superior\n", 0, 0, 0 ); send_ldap_error( op, rs, LDAP_INSUFFICIENT_ACCESS, @@ -334,17 +287,16 @@ ldbm_back_modrdn( goto return_results; } - } else { - Debug( LDAP_DEBUG_TRACE, - "<=- ldbm_back_modrdn: \"\" " - "not allowed as new superior\n", - 0, 0, 0); - - send_ldap_error( op, rs, - LDAP_INSUFFICIENT_ACCESS, - NULL ); - goto return_results; - } + } else { + Debug( LDAP_DEBUG_TRACE, + "<=- ldbm_back_modrdn: \"\" " + "not allowed as new superior\n", + 0, 0, 0); + + send_ldap_error( op, rs, + LDAP_INSUFFICIENT_ACCESS, + NULL ); + goto return_results; } } -- 2.39.5