IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

permission plugin: Do not assume attribute-level rights for new attributes are present

Browse Source 
With the --all --raw options, the code assumed attribute-level rights
were set on ipaPermissionV2 attributes, even on permissions that did not
have the objectclass.
Add a check that the data is present before using it.

https://fedorahosted.org/freeipa/ticket/4121

Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Petr Viktorin
2014-02-21 14:33:49 +01:00
committed by Martin Kosek
parent eef5acd9d7
commit 773e006ddd
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipalib/plugins/permission.py
+9 -6
View File
@@ -342,13 +342,16 @@ class permission(baseldap.LDAPObject):
rights = entry.get('attributelevelrights')
if rights:
rights['memberof'] = rights['ipapermtargetfilter']
rights['targetgroup'] = rights['ipapermtarget']
if 'ipapermtarget' in rights:
rights['targetgroup'] = rights['ipapermtarget']
if 'ipapermtargetfilter' in rights:
rights['memberof'] = rights['ipapermtargetfilter']
type_rights = set(rights['ipapermtargetfilter'])
type_rights.intersection_update(rights['ipapermlocation'])
rights['type'] = ''.join(sorted(
type_rights, key=rights['ipapermtargetfilter'].index))
type_rights = set(rights['ipapermtargetfilter'])
location_rights = set(rights.get('ipapermlocation', ''))
type_rights.intersection_update(location_rights)
rights['type'] = ''.join(sorted(
type_rights, key=rights['ipapermtargetfilter'].index))
if 'ipapermincludedattr' in rights:
rights['attrs'] = ''.join(sorted(