diff options
| author | Stefan Metzmacher <metze@samba.org> | 2020-10-06 15:10:33 +0200 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2020-10-21 07:25:37 +0000 |
| commit | faff8e6c89777c38443e561235073c336cfb2e9c (patch) | |
| tree | 6e5e500eef09cf322b3b88e52808653486f0ee1c /source4 | |
| parent | c4a3028de726d6708f57d02f9162a4d62d1b6ae7 (diff) | |
| download | samba-faff8e6c89777c38443e561235073c336cfb2e9c.tar.gz | |
s4:dsdb:acl_read: make use of aclread_check_object_visible() for the search base
We should only have one place to do access checks.
Use 'git show -w' to see the minimal diff.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/acl_read.c | 22 |
1 files changed, 5 insertions, 17 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/acl_read.c b/source4/dsdb/samdb/ldb_modules/acl_read.c index 7a2fcb2e833..921658ff415 100644 --- a/source4/dsdb/samdb/ldb_modules/acl_read.c +++ b/source4/dsdb/samdb/ldb_modules/acl_read.c @@ -744,7 +744,6 @@ static int aclread_search(struct ldb_module *module, struct ldb_request *req) static const char * const _all_attrs[] = { "*", NULL }; bool all_attrs = false; const char * const *attrs = NULL; - uint32_t instanceType; static const char *acl_attrs[] = { "instanceType", NULL @@ -850,22 +849,11 @@ static int aclread_search(struct ldb_module *module, struct ldb_request *req) return ldb_error(ldb, ret, "acl_read: Error retrieving instanceType for base."); } - instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], - "instanceType", 0); - if (instanceType != 0 && !(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) - { - /* the object has a parent, so we have to check for visibility */ - struct ldb_dn *parent_dn = ldb_dn_get_parent(req, req->op.search.base); - ret = dsdb_module_check_access_on_dn(module, - req, - parent_dn, - SEC_ADS_LIST, - NULL, req); - if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) { - return ldb_module_done(req, NULL, NULL, LDB_ERR_NO_SUCH_OBJECT); - } else if (ret != LDB_SUCCESS) { - return ldb_module_done(req, NULL, NULL, ret); - } + ret = aclread_check_object_visible(ac, res->msgs[0], req); + if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) { + return ldb_module_done(req, NULL, NULL, LDB_ERR_NO_SUCH_OBJECT); + } else if (ret != LDB_SUCCESS) { + return ldb_module_done(req, NULL, NULL, ret); } } |