[Date Prev][Date Next]
(ITS#5344) Wrong check for bad Modify DN
Full_Name: Hallvard B Furuseth
Submission from: (NULL) (18.104.22.168)
Submitted by: hallvard
The slapd/modrdn.c check for affectsMultipleDSAs is insufficient, it
requires newSuperior to be in the same backend. That does not catch
moving "cn=x,cn=y" to another database's suffix "cn=z,cn=y". Also
if a database has multiple suffixes it prevents moving an entry
to one of the suffixes.
slapd/modrdn.c can catch attempts to place an entry above/below itself.
It doesn't need to send those to the database and hope that catches it.
This patch puts it in the frontend (fe_op_modrdn); that needed to
generate the destination DN anyway for the affectsMultipleDSAs check.
Not sure if that's right or if it should go in do_modrdn() instead.
(I'm thinking of DN rewriting in rwm, vs. global overlays.)
In test005-modrdn, the "modrdn with newSuperior as child of target" check
would not catch anything: It expects failure, but the newSuperior did
not exist and would fail with noSuchObject in any case. This patch uses
newSuperior=target instead, and expects unwillingToPerform.
I'll apply the patch later, unless someone thinks it should be done