python-ldap fails gloriously if the search time limit is 0. Don't allow it.

Don't allow the time limit to be set in the API. Also add a failsafe
in the ldap driver because such bad things happen if this value is 0.
I think it literally spends 0 time on the request and just returns
immediately.

ticket 752

ipalib/plugins/config.py

@@ -68,8 +68,14 @@ from ipalib import api
 from ipalib import Bool, Int, Str, IA5Str
 from ipalib.plugins.baseldap import *
 from ipalib import _
+from ipalib.errors import ValidationError
 
 
+def validate_searchtimelimit(ugettext, limit):
+    if limit == 0:
+        raise ValidationError(name='ipasearchtimelimit', error=_('searchtimelimit must be -1 or > 1.'))
+    return None
+
 class config(LDAPObject):
     """
     IPA configuration object
@@ -110,7 +116,7 @@ class config(LDAPObject):
             label=_('Default e-mail domain'),
             doc=_('Default e-mail domain new users'),
         ),
-        Int('ipasearchtimelimit?',
+        Int('ipasearchtimelimit?', validate_searchtimelimit,
             cli_name='searchtimelimit',
             label=_('Search time limit'),
             doc=_('Max. amount of time (sec.) for a search (-1 is unlimited)'),