diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2007-07-19 07:48:26 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 15:01:13 -0500 |
| commit | 3a1b90ec755d89d9d7a358c0f477e51b217218ea (patch) | |
| tree | dfc3c9e1d42ef68d30bfd67a1b6dda11fa9953b7 /source4/dsdb/samdb | |
| parent | bb681188407055a7ea77cdaa76600dac37ae3096 (diff) | |
| download | samba-3a1b90ec755d89d9d7a358c0f477e51b217218ea.tar.gz samba-3a1b90ec755d89d9d7a358c0f477e51b217218ea.tar.bz2 samba-3a1b90ec755d89d9d7a358c0f477e51b217218ea.zip | |
r23966: It isn't great, but at least now we have some access control in SWAT
This patch prevents non-root and non-administrator users from running
the provision, upgrade and vampire pages. *I think* the rest of SWAT
is LDB operations, or otherwise authenticated, so we should now be
secure.
I wish I had a better way to 'prove' we got this right, but this is better than nothing, and moves us closer to an alpha.
Andrew Bartlett
(This used to be commit d61061052dc4711f886199e49bc303002c8f9b11)
Diffstat (limited to 'source4/dsdb/samdb')
| -rw-r--r-- | source4/dsdb/samdb/samdb_privilege.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/source4/dsdb/samdb/samdb_privilege.c b/source4/dsdb/samdb/samdb_privilege.c index 16d34938c6..2313385604 100644 --- a/source4/dsdb/samdb/samdb_privilege.c +++ b/source4/dsdb/samdb/samdb_privilege.c @@ -80,6 +80,11 @@ _PUBLIC_ NTSTATUS samdb_privilege_setup(struct security_token *token) NTSTATUS status; /* Shortcuts to prevent recursion and avoid lookups */ + if (token->user_sid == NULL) { + token->privilege_mask = 0; + return NT_STATUS_OK; + } + if (security_token_is_system(token)) { token->privilege_mask = ~0; return NT_STATUS_OK; |