sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-07-30 19:42:05 +03:00
Code Activity

s4:objectclass LDB module - introduce allowed system flags restriction

Browse Source 
Let us do the distinction by real use and provision by the RELAX flag

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Matthias Dieter Wallnöfer
2010-09-29 18:18:55 +02:00
committed by Matthias Dieter Wallnöfer
parent 4e8206eb4c
commit ca08cde150
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
source4/dsdb/samdb/ldb_modules/objectclass.c
View File

@ -696,13 +696,18 @@ static int objectclass_do_add(struct oc_context *ac)
ldb_msg_remove_attr(msg, "systemFlags");
/* Only these flags may be set by a client, but we can't tell
* between a client and our provision at this point
* systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_MOVE | SYSTEM_FLAG_CONFIG_LIMITED_MOVE);
*/
/* Only the following flags may be set by a client */
if (ldb_request_get_control(ac->req,
LDB_CONTROL_RELAX_OID) == NULL) {
systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
| SYSTEM_FLAG_CONFIG_ALLOW_MOVE
| SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
| SYSTEM_FLAG_ATTR_IS_RDN );
}
/* This flag is only allowed on attributeSchema objects */
if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") == 0) {
/* But the last one ("ATTR_IS_RDN") is only allowed on
* "attributeSchema" objects. So truncate if it does not fit. */
if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
}