summaryrefslogtreecommitdiff
path: root/source4/dsdb/samdb
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2007-07-19 07:48:26 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 15:01:13 -0500
commit3a1b90ec755d89d9d7a358c0f477e51b217218ea (patch)
treedfc3c9e1d42ef68d30bfd67a1b6dda11fa9953b7 /source4/dsdb/samdb
parentbb681188407055a7ea77cdaa76600dac37ae3096 (diff)
downloadsamba-3a1b90ec755d89d9d7a358c0f477e51b217218ea.tar.gz
samba-3a1b90ec755d89d9d7a358c0f477e51b217218ea.tar.bz2
samba-3a1b90ec755d89d9d7a358c0f477e51b217218ea.zip
r23966: It isn't great, but at least now we have some access control in SWAT
This patch prevents non-root and non-administrator users from running the provision, upgrade and vampire pages. *I think* the rest of SWAT is LDB operations, or otherwise authenticated, so we should now be secure. I wish I had a better way to 'prove' we got this right, but this is better than nothing, and moves us closer to an alpha. Andrew Bartlett (This used to be commit d61061052dc4711f886199e49bc303002c8f9b11)
Diffstat (limited to 'source4/dsdb/samdb')
-rw-r--r--source4/dsdb/samdb/samdb_privilege.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/source4/dsdb/samdb/samdb_privilege.c b/source4/dsdb/samdb/samdb_privilege.c
index 16d34938c6..2313385604 100644
--- a/source4/dsdb/samdb/samdb_privilege.c
+++ b/source4/dsdb/samdb/samdb_privilege.c
@@ -80,6 +80,11 @@ _PUBLIC_ NTSTATUS samdb_privilege_setup(struct security_token *token)
NTSTATUS status;
/* Shortcuts to prevent recursion and avoid lookups */
+ if (token->user_sid == NULL) {
+ token->privilege_mask = 0;
+ return NT_STATUS_OK;
+ }
+
if (security_token_is_system(token)) {
token->privilege_mask = ~0;
return NT_STATUS_OK;