Apply ACL to lastmod attributes.

diff --git a/CHANGES b/CHANGES
index bf1e162ccc5b896cbb28dc1f870b8a8184613311..d4ac3080c37cab5dd12d5afc50f934d34feee150 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ Changes included in OpenLDAP 1.2 Release Engineering
        Fixed ldbm db_appinit to use u_int32_t instead of int (ITS#295)
        Fixed lber/io.c Cray T90 specific pointer arithmetic problem (ITS#325)
        Added TCP_NODELAY support
+       Change slapd to apply ACL to lastmod attributes
        Change slapd.conf default referral
        Documentation
                Reference Quick Start Guide in README and INSTALL

diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index f7320bdf8be29a9c2909b82df40bc02984e36c83..03651002fc6d77f0928db055c743304389c55c95 100644 (file)
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -250,19 +250,8 @@ send_search_entry(
                        continue;
                }
 
-               /* the lastmod attributes are ignored by ACL checking */
-               if ( strcasecmp( a->a_type, "modifiersname" ) == 0 ||
-                       strcasecmp( a->a_type, "modifytimestamp" ) == 0 ||
-                       strcasecmp( a->a_type, "creatorsname" ) == 0 ||
-                       strcasecmp( a->a_type, "createtimestamp" ) == 0 ) 
-               {
-                       Debug( LDAP_DEBUG_ACL, "LASTMOD attribute: %s access DEFAULT\n",
-                               a->a_type, 0, 0 );
-                       acl = NULL;
-               } else {
-                       acl = acl_get_applicable( be, op, e, a->a_type,
-                               MAXREMATCHES, matches );
-               }
+               acl = acl_get_applicable( be, op, e, a->a_type,
+                       MAXREMATCHES, matches );
 
                if ( ! acl_access_allowed( acl, be, conn, e,
                        NULL, op, ACL_READ, edn, matches ) ) 

diff --git a/tests/data/slapd-acl.conf b/tests/data/slapd-acl.conf
index 80dd2b65940aa7c3d1699a1e3d49a8b8fd4ea756..16f3bd7a27a833683977cba6450f1c516d8515fe 100644 (file)
--- a/tests/data/slapd-acl.conf
+++ b/tests/data/slapd-acl.conf
@@ -20,19 +20,29 @@ index               cn,sn,uid       pres,eq,approx
 index          default         none
 lastmod                on
 defaultaccess  none
-access         to attr=objectclass
+
+access to attr=createtimestamp,creatorsname,modifytimestamp,modifiersname
+       by * none
+
+access to attr=objectclass
                by * read
+
 access         to attr=userpassword
                by self write
+               by dn="^$$" none
                by * compare
-access         to dn=".*,ou=Alumni Association,ou=People,o=University of Michigan,c=US"
-               by dn=".*,o=University of Michigan,c=US"
-               read
+
+access         to dn=".*,ou=Alumni Association,ou=People,o=University of Michigan,c=US$$"
+               by dn="^$$" none
+               by dn=".*,o=University of Michigan,c=US$$" read
                by * none
+
 access         to attr=member
                by dnattr=member selfwrite
                by * read
+
 access         to filter="objectclass=rfc822mailgroup"
-               by dn="Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US" write
+               by dn="^cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=University of Michigan,c=US$$" write
                by * read
+
 access         to * by * read