ldap/servers/plugins/memberof/memberof.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
New commits:
commit 738eef1c76ac086256c48139495fa0eddda17e50
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Fri Oct 29 14:33:42 2010 -0700
Bug 647932 - multiple memberOf configuration adding memberOf where there is no member
There is a bug in the way we construct the filter in memberof_call_foreach_dn()
when multiple grouping attribtues are set. We should be constructing a filter
using the passed in types and dn that looks like this:
(|(type1=dn)(type2=dn))
Instead, we have hard-coded wildcards in the place of the dn when multiple
types are passed in. The result is a filter that looks like this:
(|(type1=*)(type2=*))
When this function is used to find groups who have dn as a member, we end up
finding all groups that have any grouping attribute present and treat dn as if
it is a member.
This issue does not occur when a single type is used.
diff --git a/ldap/servers/plugins/memberof/memberof.c
b/ldap/servers/plugins/memberof/memberof.c
index 50da09a..b21f880 100644
--- a/ldap/servers/plugins/memberof/memberof.c
+++ b/ldap/servers/plugins/memberof/memberof.c
@@ -448,6 +448,7 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, char *dn,
char *filter_str = 0;
int num_types = 0;
int types_name_len = 0;
+ int dn_len = 0;
int i = 0;
/* get the base dn for the backend we are in
@@ -463,6 +464,9 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, char *dn,
if(base_sdn)
{
+ /* Find the length of the dn */
+ dn_len = strlen(dn);
+
/* Count the number of types. */
for (num_types = 0; types && types[num_types]; num_types++)
{
@@ -475,7 +479,7 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, char *dn,
if (num_types > 1)
{
int bytes_out = 0;
- int filter_str_len = types_name_len + (num_types * 4) + 4;
+ int filter_str_len = types_name_len + (num_types * (3 + dn_len)) + 4;
/* Allocate enough space for the filter */
filter_str = slapi_ch_malloc(filter_str_len);
@@ -486,7 +490,8 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, char *dn,
/* Add filter section for each type. */
for (i = 0; types[i]; i++)
{
- bytes_out += snprintf(filter_str + bytes_out, filter_str_len - bytes_out,
"(%s=*)", types[i]);
+ bytes_out += snprintf(filter_str + bytes_out, filter_str_len - bytes_out,
+ "(%s=%s)", types[i], dn);
}
/* Add end of filter. */
Show replies by thread