diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2008-09-08 11:09:02 +1000 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2008-09-08 11:09:02 +1000 |
| commit | 4c386ce366cfa08e670f58e5560bf1253b8b6c29 (patch) | |
| tree | 11f8c5d301d595792ff5cb261e1800934a86cba2 /source4/dsdb/samdb | |
| parent | b3cee235f53acea1d7f1e1f25ac7f1634dbabbf6 (diff) | |
| download | samba-4c386ce366cfa08e670f58e5560bf1253b8b6c29.tar.gz samba-4c386ce366cfa08e670f58e5560bf1253b8b6c29.tar.bz2 samba-4c386ce366cfa08e670f58e5560bf1253b8b6c29.zip | |
Don't expose passwords, even to the administrator.
This ensures they don't leak over LDAP, but does not prevent access,
as ldbsearch locally still bypasses these controls.
Andrew Bartlett
(This used to be commit fa3f3bab33001770a9d7e33875bf212636f6c128)
Diffstat (limited to 'source4/dsdb/samdb')
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/kludge_acl.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c b/source4/dsdb/samdb/ldb_modules/kludge_acl.c index 2c01594722..bc998a835a 100644 --- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c +++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c @@ -238,7 +238,6 @@ static int kludge_acl_callback(struct ldb_context *ldb, void *context, struct ld { switch (ac->user_type) { case SECURITY_SYSTEM: - case SECURITY_ADMINISTRATOR: if (ac->allowedAttributesEffective) { ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributesEffective"); if (ret != LDB_SUCCESS) { @@ -252,6 +251,20 @@ static int kludge_acl_callback(struct ldb_context *ldb, void *context, struct ld } } break; + case SECURITY_ADMINISTRATOR: + if (ac->allowedAttributesEffective) { + ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributesEffective"); + if (ret != LDB_SUCCESS) { + return ret; + } + } + if (ac->allowedChildClassesEffective) { + ret = kludge_acl_childClasses(ldb, ares->message, "allowedChildClassesEffective"); + if (ret != LDB_SUCCESS) { + return ret; + } + } + /* fall though */ default: /* remove password attributes */ for (i = 0; data->password_attrs[i]; i++) { |