GHSA-6f6q-q9gw-4jr4 Sort and VLV controls let authenticated users learn pas...

Valera V Harseko

21 hours ago de42bdce8ff329998ad4eef467503ea3a4fafd89

 opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciHandler.java

@@ -80,12 +80,14 @@
  /**
   * String used to indicate that the evaluating ACI had a all
   * operational attributes targetattr match (targetattr="+").
   * The attachment's value is the entry it holds for.
   */
  static final String ALL_OP_ATTRS_MATCHED = "allOpAttrsMatched";

  /**
   * String used to indicate that the evaluating ACI had a all user
   * attributes targetattr match (targetattr="*").
   * The attachment's value is the entry it holds for.
   */
  static final String ALL_USER_ATTRS_MATCHED = "allUserAttrsMatched";

@@ -456,13 +458,15 @@
      return false;
    }

    // Each shortcut holds the very entry it was decided for, so that filterEntry() applies it to that entry alone
    // and to no other entry of the operation (GHSA-6f6q-q9gw-4jr4).
    if (!container.hasEvalUserAttributes())
    {
      operation.setAttachment(ALL_USER_ATTRS_MATCHED, ALL_USER_ATTRS_MATCHED);
      operation.setAttachment(ALL_USER_ATTRS_MATCHED, entry);
    }
    if (!container.hasEvalOpAttributes())
    {
      operation.setAttachment(ALL_OP_ATTRS_MATCHED, ALL_OP_ATTRS_MATCHED);
      operation.setAttachment(ALL_OP_ATTRS_MATCHED, entry);
    }

    return true;