See commit message.
https://fedorahosted.org/freeipa/ticket/2479
--
Petr³
From 074afddae80c7f1851f54324e746ed6a01b878f2 Mon Sep 17 00:00:00 2001
From: Petr Viktorin
Date: Fri, 9 Mar 2012 04:45:15 -0500
Subject: [PATCH] Don't crash when searching with empty relationship options
Empty sequences (and sequences of empty strings) are normalized
to None, but the member filter code expected a list.
This patch extends a test for missing options to also catch
false values.
The functional change is from `if param_name in options:` to
`if options.get(param_name):`; the rest of the patch is code
de-duplication and tests.
These are CSV params with csv_skipspace set, so on the CLI, empty
set is given as a string with just spaces and commas (including
the empty string).
https://fedorahosted.org/freeipa/ticket/2479
---
ipalib/plugins/baseldap.py| 36 --
tests/test_xmlrpc/test_netgroup_plugin.py | 108 +
2 files changed, 122 insertions(+), 22 deletions(-)
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index c0f25479a1460cec9b46db7f10da837d07103887..184480915f2b869ff54863e99ae4047ca0e6701f 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -1744,28 +1744,20 @@ class LDAPSearch(BaseLDAPCommand, crud.Search):
relationship = self.obj.relationships.get(
attr, ['member', '', 'no_']
)
-param_name = '%s%s' % (relationship[1], to_cli(ldap_obj_name))
-if param_name in options:
-dns = []
-for pkey in options[param_name]:
-dns.append(ldap_obj.get_dn(pkey))
-flt = ldap.make_filter_from_attr(
-attr, dns, ldap.MATCH_ALL
-)
-filter = ldap.combine_filters(
-(filter, flt), ldap.MATCH_ALL
-)
-param_name = '%s%s' % (relationship[2], to_cli(ldap_obj_name))
-if param_name in options:
-dns = []
-for pkey in options[param_name]:
-dns.append(ldap_obj.get_dn(pkey))
-flt = ldap.make_filter_from_attr(
-attr, dns, ldap.MATCH_NONE
-)
-filter = ldap.combine_filters(
-(filter, flt), ldap.MATCH_ALL
-)
+# Handle positive (MATCH_ALL) and negative (MATCH_NONE)
+# searches similarly
+param_prefixes = relationship[1:] # e.g. ('in_', 'not_in_')
+rules = ldap.MATCH_ALL, ldap.MATCH_NONE
+for param_prefix, rule in zip(param_prefixes, rules):
+param_name = '%s%s' % (param_prefix, to_cli(ldap_obj_name))
+if options.get(param_name):
+dns = []
+for pkey in options[param_name]:
+dns.append(ldap_obj.get_dn(pkey))
+flt = ldap.make_filter_from_attr(attr, dns, rule)
+filter = ldap.combine_filters(
+(filter, flt), ldap.MATCH_ALL
+)
return filter
has_output_params = global_output_params
diff --git a/tests/test_xmlrpc/test_netgroup_plugin.py b/tests/test_xmlrpc/test_netgroup_plugin.py
index 1c6b94bd20027bc3c7e550322ae27a5a05bfe426..c40b01ad623f1566ce98f60e1254b43d539752bb 100644
--- a/tests/test_xmlrpc/test_netgroup_plugin.py
+++ b/tests/test_xmlrpc/test_netgroup_plugin.py
@@ -397,6 +397,43 @@ class test_netgroup(Declarative):
dict(
+desc='Search for netgroups using no_user',
+command=('netgroup_find', [], dict(no_user=user1)),
+expected=dict(
+count=2,
+truncated=False,
+summary=u'2 netgroups matched',
+result=[
+{
+'dn': fuzzy_netgroupdn,
+'cn': [netgroup2],
+'description': [u'Test netgroup 2'],
+'nisdomainname': [u'%s' % api.env.domain],
+},
+{
+'dn': fuzzy_netgroupdn,
+'memberhost_host': (host1,),
+'memberhost_hostgroup': (hostgroup1,),
+'cn': [netgroup1],
+'description': [u'Test netgroup 1'],
+'nisdomainname': [u'%s' % api.env.domain],
+},
+],
+),
+),
+
+dict(
+desc="Check %r doesn't match when searching for %s" % (netgroup1, user1),
+command=('netgroup_find', [], dict(user=user1)),
+expected=dict(
+count=0,
+truncated=False,
+
