IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Prevent changing protected group's name using --setattr

Browse Source 
The name of any protected group now cannot be changed by modifing
the cn attribute using --setattr. Unit tests have been added to
make sure there is no regression.

https://fedorahosted.org/freeipa/ticket/3354
This commit is contained in:
Tomas Babej 2013-02-11 10:19:53 +01:00 committed by Rob Crittenden
parent 462beacc9d
commit 5b64cde92a
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ipalib/plugins/group.py
View File

@ -265,7 +265,7 @@ class group_mod(LDAPUpdate):
is_protected_group = keys[-1] in PROTECTED_GROUPS
if 'rename' in options:
if 'rename' in options or 'cn' in entry_attrs:
if is_protected_group:
raise errors.ProtectedEntryError(label=u'group', key=keys[-1],
reason=u'Cannot be renamed')

15
tests/test_xmlrpc/test_group_plugin.py
View File

@ -878,6 +878,13 @@ class test_group(Declarative):
key='admins', reason='Cannot be renamed'),
),
dict(
desc='Try to rename the admins group via setattr',
command=('group_mod', [u'admins'], {'setattr': u'cn=loosers'}),
expected=errors.ProtectedEntryError(label=u'group',
key='admins', reason='Cannot be renamed'),
),
dict(
desc='Try to modify the admins group to support external membership',
command=('group_mod', [u'admins'], dict(external=True)),
@ -899,6 +906,14 @@ class test_group(Declarative):
key='trust admins', reason='Cannot be renamed'),
),
dict(
desc='Try to rename the trust admins group via setattr',
command=('group_mod', [u'trust admins'], {'setattr': u'cn=loosers'}),
expected=errors.ProtectedEntryError(label=u'group',
key='trust admins', reason='Cannot be renamed'),
),
dict(
desc='Try to modify the trust admins group to support external membership',
command=('group_mod', [u'trust admins'], dict(external=True)),