aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTim Beale <timbeale@catalyst.net.nz>2018-07-30 16:00:15 +1200
committerKarolin Seeger <kseeger@samba.org>2018-08-13 09:13:36 +0200
commit9605ecc7e1a79fa1b7cdf9f53048595ee00008b2 (patch)
tree11578d6092acfee2bf8a867792b1a28678f5efe8
parent533106ae9c210a3d7c501f239e7de9d0966f27b9 (diff)
downloadsamba-9605ecc7e1a79fa1b7cdf9f53048595ee00008b2.tar.gz
samba-9605ecc7e1a79fa1b7cdf9f53048595ee00008b2.tar.xz
samba-9605ecc7e1a79fa1b7cdf9f53048595ee00008b2.zip
CVE-2018-10919 acl_read: Flip the logic in the dirsync check
This better reflects the special case we're making for dirsync, and gets rid of a 'if-else' clause. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
-rw-r--r--source4/dsdb/samdb/ldb_modules/acl_read.c17
1 files changed, 7 insertions, 10 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/acl_read.c b/source4/dsdb/samdb/ldb_modules/acl_read.c
index 75642b305c5..00203f21dae 100644
--- a/source4/dsdb/samdb/ldb_modules/acl_read.c
+++ b/source4/dsdb/samdb/ldb_modules/acl_read.c
@@ -241,10 +241,12 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
bool in_search_filter;
+ /* check if attr is part of the search filter */
in_search_filter = dsdb_attr_in_parse_tree(ac->req->op.search.tree,
msg->elements[i].name);
- if (ac->indirsync) {
+ if (in_search_filter) {
+
/*
* We are doing dirysnc answers
* and the object shouldn't be returned (normally)
@@ -253,21 +255,16 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
* (remove the object if it is not deleted, or return
* just the objectGUID if it's deleted).
*/
- if (in_search_filter) {
+ if (ac->indirsync) {
ldb_msg_remove_attr(msg, "replPropertyMetaData");
break;
} else {
- aclread_mark_inaccesslible(&msg->elements[i]);
- }
- } else {
- /*
- * do not return this entry if attribute is
- * part of the search filter
- */
- if (in_search_filter) {
+
+ /* do not return this entry */
talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
+ } else {
aclread_mark_inaccesslible(&msg->elements[i]);
}
} else if (ret != LDB_SUCCESS) {