From 5c6fde8eb1779cf2baf9b4eb90e09841b72bdb1f Mon Sep 17 00:00:00 2001
From: Shirish Kalele <kalele@samba.org>
Date: Thu, 10 Apr 2003 19:54:17 +0000
Subject: Handle deep referrals: check whether each component in the requested
 path of a dfs referral is a dfs link, and redirect. Thanks to John Janosik
 <jpjanosi@us.ibm.com> for the patch. (This used to be commit
 2c4e59cf26b7169fda824ca86e437a99a02345d2)

---
 source3/msdfs/msdfs.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/source3/msdfs/msdfs.c b/source3/msdfs/msdfs.c
index bf3b3cc213..fa6617cb52 100644
--- a/source3/msdfs/msdfs.c
+++ b/source3/msdfs/msdfs.c
@@ -215,6 +215,7 @@ static BOOL resolve_dfs_path(char* dfspath, struct dfs_path* dp,
 
 	char *p;
 	fstring reqpath;
+	pstring consumedbuf;
 
 	if (!dp || !conn) {
 		DEBUG(1,("resolve_dfs_path: NULL dfs_path* or NULL connection_struct*!\n"));
@@ -247,10 +248,13 @@ static BOOL resolve_dfs_path(char* dfspath, struct dfs_path* dp,
 		}
 	} 
 
-	/* also redirect if the parent directory is a dfs link */
+	pstrcpy(consumedbuf, dfspath);
+	trim_string(consumedbuf, NULL, "\\");
+
+	/* redirect if any component in the path is a link */
 	fstrcpy(reqpath, dp->reqpath);
 	p = strrchr(reqpath, '/');
-	if (p) {
+	while (p) {
 		*p = '\0';
 		fstrcpy(localpath, conn->connectpath);
 		fstrcat(localpath, "/");
@@ -265,18 +269,16 @@ static BOOL resolve_dfs_path(char* dfspath, struct dfs_path* dp,
 			*/
 			if (consumedcntp) {
 				char *q;
-				pstring buf;
-				pstrcpy(buf, dfspath);
-				trim_string(buf, NULL, "\\");
-				q = strrchr(buf, '\\');
+				q = strrchr(consumedbuf, '\\');
 				if (q) 
 					*q = '\0';
-				*consumedcntp = strlen(buf);
+				*consumedcntp = strlen(consumedbuf);
 				DEBUG(10, ("resolve_dfs_path: Path consumed: %d\n", *consumedcntp));
 			}
 			
 			return True;
 		}
+		p = strrchr(reqpath, '/');
 	}
 	
 	return False;
@@ -629,8 +631,7 @@ int setup_dfs_referral(char* pathname, int max_referral_level, char** ppdata)
 	/* Trim pathname sent by client so it begins with only one backslash.
 	   Two backslashes confuse some dfs clients
 	 */
-	while (strlen(pathnamep) > 1 && pathnamep[0] == '\\'
-	       && pathnamep[1] == '\\')
+	while (pathnamep[0] == '\\' && pathnamep[1] == '\\')
 		pathnamep++;
 
 	pstrcpy(buf, pathnamep);
-- 
cgit