Hi, The usage of lowercased varsion of 'Default Trust View' can no longer be used to bypass the validation.
https://fedorahosted.org/freeipa/ticket/4915 Tomas
>From 549bb9a93c07ecf7ffdb913c094700129828017d Mon Sep 17 00:00:00 2001 From: Tomas Babej <[email protected]> Date: Mon, 23 Feb 2015 16:16:01 +0100 Subject: [PATCH] idviews: Use case-insensitive detection of Default Trust View The usage of lowercased varsion of 'Default Trust View' can no longer be used to bypass the validation. https://fedorahosted.org/freeipa/ticket/4915 --- ipalib/plugins/idviews.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py index df403b1193fe18dfadf437a18a3e0b6ffb7575b4..f59dd06e8afc1da7efce321efaa94523ed8a3e53 100644 --- a/ipalib/plugins/idviews.py +++ b/ipalib/plugins/idviews.py @@ -106,8 +106,9 @@ class idview_del(LDAPDelete): msg_summary = _('Deleted ID View "%(value)s"') def pre_callback(self, ldap, dn, *keys, **options): - if "Default Trust View" in keys: - raise protected_default_trust_view_error + for key in keys: + if key.lower() == "default trust view": + raise protected_default_trust_view_error return dn @@ -118,8 +119,9 @@ class idview_mod(LDAPUpdate): msg_summary = _('Modified an ID View "%(value)s"') def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): - if "Default Trust View" in keys: - raise protected_default_trust_view_error + for key in keys: + if key.lower() == "default trust view": + raise protected_default_trust_view_error return dn @@ -240,7 +242,7 @@ class baseidview_apply(LDAPQuery): # the ipaAssignedIDView to None view_dn = None - if view == 'Default Trust View': + if view.lower() == 'default trust view': raise errors.ValidationError( name=_('ID View'), error=_('Default Trust View cannot be applied on hosts') @@ -584,7 +586,7 @@ class baseidoverride(LDAPObject): # Check if parent object is Default Trust View, if so, prohibit # adding overrides for IPA objects - if dn[1].value == 'Default Trust View': + if dn[1].value.lower() == 'default trust view': if dn[0].value.startswith(IPA_ANCHOR_PREFIX): raise errors.ValidationError( name=_('ID View'), -- 2.1.0
_______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
