coheigea opened a new pull request, #382:
URL: https://github.com/apache/directory-server/pull/382
Apply search authorization to persistent search notifications
Entries sent to a persistent search client were taken straight from the
operation context, bypassing the authentication and ACI checks applied
to a normal search, as well as the userPassword hiding. With changesOnly
set, no check at all was done on the client before registering it.
- PersistentSearchListener now reads every changed entry again through
the client's own session, with a base level search, and only sends it
if it is visible, with the attributes the client is allowed to read.
userPassword is removed when the server hides passwords.
- As a deleted entry can't be read anymore, DirectoryListener gets a
beforeEntryDeleted() callback, called by the EventInterceptor before
the entry is deleted.
- A changesOnly persistent search now does a base level search through
the client's session before the listener is registered, so that an
unauthenticated client is rejected when anonymous access is disabled.
- The EventInterceptor executor queue is now unbounded: the listeners
wait for the end of the operation which notifies them, and a rejected
notification made that operation fail.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
