Fine changes to previous fix for bug #7104 - "wide links" and "unix extensions" are incompatible.

Make sure we match the previous allow widelinks behavior, in that
non-root preexec scripts can create share directories for a share
definition.

Jeremy

1 files changed, 18 insertions, 20 deletions

diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 9d3da8352a..1e8c15bfde 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -916,26 +916,6 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
 		}
 	}
 
-	/*
-	 * If widelinks are disallowed we need to canonicalise the connect
-	 * path here to ensure we don't have any symlinks in the
-	 * connectpath. We will be checking all paths on this connection are
-	 * below this directory. We must do this after the VFS init as we
-	 * depend on the realpath() pointer in the vfs table. JRA.
-	 */
-	if (!lp_widelinks(snum)) {
-		if (!canonicalize_connect_path(conn)) {
-			DEBUG(0, ("canonicalize_connect_path failed "
-			"for service %s, path %s\n",
-				lp_servicename(snum),
-				conn->connectpath));
-			yield_connection(conn, lp_servicename(snum));
-			conn_free(conn);
-			*pstatus = NT_STATUS_BAD_NETWORK_NAME;
-			return NULL;
-		}
-	}
-
 /* USER Activites: */
 	if (!change_to_user(conn, conn->vuid)) {
 		/* No point continuing if they fail the basic checks */
@@ -972,6 +952,24 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
 		}
 	}
 
+	/*
+	 * If widelinks are disallowed we need to canonicalise the connect
+	 * path here to ensure we don't have any symlinks in the
+	 * connectpath. We will be checking all paths on this connection are
+	 * below this directory. We must do this after the VFS init as we
+	 * depend on the realpath() pointer in the vfs table. JRA.
+	 */
+	if (!lp_widelinks(snum)) {
+		if (!canonicalize_connect_path(conn)) {
+			DEBUG(0, ("canonicalize_connect_path failed "
+			"for service %s, path %s\n",
+				lp_servicename(snum),
+				conn->connectpath));
+			*pstatus = NT_STATUS_BAD_NETWORK_NAME;
+			goto err_root_exit;
+		}
+	}
+
 #ifdef WITH_FAKE_KASERVER
 	if (lp_afs_share(snum)) {
 		afs_login(conn);