VERSION.sh | 2 +-
ldap/servers/slapd/computed.c | 17 +++++++++++++++--
ldap/servers/slapd/entrywsi.c | 2 +-
ldap/servers/slapd/pblock.c | 2 +-
ldap/servers/slapd/slapi-plugin.h | 1 +
5 files changed, 19 insertions(+), 5 deletions(-)
New commits:
commit 56d8a5bacc07c7772eb30e346b0d15cb1d6c2661
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Aug 7 10:39:41 2014 -0700
Bump version to 1.3.2.21
diff --git a/VERSION.sh b/VERSION.sh
index fe6c49e..a47f8b0 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=3
-VERSION_MAINT=2.20
+VERSION_MAINT=2.21
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
commit f04df5bb050f96a871aecb28312861626272ad55
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Aug 7 10:17:52 2014 -0700
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target
entry's DN must be adjusted.
Description: commit 708a56b8d524131362e2d71b7fbc2eb257075e14 for
Ticket #47834 ingroduced the flood of "Connection is NULL and hence
cannot access SLAPI_CONN_ID" in the error log. This patch changes
the log level of the message to LDAP_DEBUG_TRACE to suppress it.
(cherry picked from commit cfb2cacfb94e511068a7c9ceed4e9ae1dfdfd45a)
diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c
index d3cc55c..c1fac14 100644
--- a/ldap/servers/slapd/pblock.c
+++ b/ldap/servers/slapd/pblock.c
@@ -186,7 +186,7 @@ slapi_pblock_get( Slapi_PBlock *pblock, int arg, void *value )
break;
case SLAPI_CONN_ID:
if (pblock->pb_conn == NULL) {
- LDAPDebug( LDAP_DEBUG_ANY,
+ LDAPDebug( LDAP_DEBUG_TRACE,
"Connection is NULL and hence cannot access SLAPI_CONN_ID \n", 0,
0, 0 );
return (-1);
}
commit 67f9130d419076bfc21935e1e008091b3237f660
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Jul 28 09:42:43 2014 -0700
Ticket #47869 - unauthenticated information disclosure (Bug 1123477)
Fix Description: nscpentrywsi is returned only authenticated as root.
The bug was fixed by lkrispen(a)redhat.com (Ludwig Krispenz).
His patch was modified based upon this review comment.
https://bugzilla.redhat.com/show_bug.cgi?id=1123477#c2
https://bugzilla.redhat.com/show_bug.cgi?id=1127833
(cherry picked from commit aa90e26d5c4ea47b2a4a22f99cf0742cf48b3fae)
(cherry picked from commit 394277fdcef70078b54a280de88ab06dd289cc7a)
(cherry picked from commit 79c07013ff3f67da8888661ad2fcd9e32062e50a)
diff --git a/ldap/servers/slapd/computed.c b/ldap/servers/slapd/computed.c
index 7c99b45..7a80c96 100644
--- a/ldap/servers/slapd/computed.c
+++ b/ldap/servers/slapd/computed.c
@@ -59,6 +59,7 @@ struct _computed_attr_context {
struct _compute_evaluator {
struct _compute_evaluator *next;
slapi_compute_callback_t function;
+ int rootonly;
};
typedef struct _compute_evaluator compute_evaluator;
@@ -95,6 +96,13 @@ int compute_call_evaluators_nolock(computed_attr_context
*c,slapi_compute_output
compute_evaluator *current = NULL;
for (current = compute_evaluators; (current != NULL) && (-1 == rc);
current = current->next) {
+ if (current->rootonly) {
+ int isroot;
+ slapi_pblock_get(c->pb, SLAPI_REQUESTOR_ISROOT, &isroot);
+ if (!isroot) {
+ continue;
+ }
+ }
rc = (*(current->function))(c,type,e,outfn);
}
return rc;
@@ -157,14 +165,19 @@ compute_stock_evaluator(computed_attr_context *c,char*
type,Slapi_Entry *e,slapi
}
static void
-compute_add_evaluator_nolock(slapi_compute_callback_t function, compute_evaluator
*new_eval)
+compute_add_evaluator_nolock(slapi_compute_callback_t function, compute_evaluator
*new_eval, int rootonly)
{
new_eval->next = compute_evaluators;
new_eval->function = function;
+ new_eval->rootonly = rootonly;
compute_evaluators = new_eval;
}
int slapi_compute_add_evaluator(slapi_compute_callback_t function)
{
+ return slapi_compute_add_evaluator_ext(function, 0);
+}
+int slapi_compute_add_evaluator_ext(slapi_compute_callback_t function, int rootonly)
+{
int rc = 0;
compute_evaluator *new_eval = NULL;
PR_ASSERT(NULL != function);
@@ -187,7 +200,7 @@ int slapi_compute_add_evaluator(slapi_compute_callback_t function)
slapi_rwlock_wrlock(compute_evaluators_lock);
}
- compute_add_evaluator_nolock(function, new_eval);
+ compute_add_evaluator_nolock(function, new_eval, rootonly);
if (need_lock) {
slapi_rwlock_unlock(compute_evaluators_lock);
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 5512b5b..bd9196f 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -1086,7 +1086,7 @@ entry_compute_nscpentrywsi(computed_attr_context *c,char*
type,Slapi_Entry *e,sl
int
entry_computed_attr_init()
{
- slapi_compute_add_evaluator(entry_compute_nscpentrywsi);
+ slapi_compute_add_evaluator_ext(entry_compute_nscpentrywsi, 1 /* root only */);
return 0;
}
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index d482dff..52a77ff 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -6281,6 +6281,7 @@ typedef int (*slapi_compute_output_t)(computed_attr_context
*c,Slapi_Attr *a , S
typedef int (*slapi_compute_callback_t)(computed_attr_context *c,char* type,Slapi_Entry
*e,slapi_compute_output_t outputfn);
typedef int (*slapi_search_rewrite_callback_t)(Slapi_PBlock *pb);
int slapi_compute_add_evaluator(slapi_compute_callback_t function);
+int slapi_compute_add_evaluator_ext(slapi_compute_callback_t function, int rootonly);
int slapi_compute_add_search_rewriter(slapi_search_rewrite_callback_t function);
int compute_rewrite_search_filter(Slapi_PBlock *pb);