From de42bdce8ff329998ad4eef467503ea3a4fafd89 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Wed, 21 Oct 2026 08:54:06 +0000
Subject: [PATCH] GHSA-6f6q-q9gw-4jr4 Sort and VLV controls let authenticated users learn password hashes and other attributes hidden by access control
---
opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciContainer.java | 18 +++++++++---------
1 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciContainer.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciContainer.java
index f3d0ddd..2f10a3e 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciContainer.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciContainer.java
@@ -13,6 +13,7 @@
*
* Copyright 2008 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.authorization.dseecompat;
@@ -215,19 +216,18 @@
}
//If an ACI evaluated because of an Targetattr="*", then the
- //AciHandler.maySend method signaled this via adding this attachment
- //string.
- String allUserAttrs=
- (String)operation.getAttachment(ALL_USER_ATTRS_MATCHED);
- if(allUserAttrs != null)
+ //AciHandler.maySend method signaled this via adding this attachment,
+ //holding the entry it evaluated: it only holds for that very entry.
+ if (entry != null
+ && operation.getAttachment(ALL_USER_ATTRS_MATCHED) == entry)
{
evalAllAttributes |= ACI_USER_ATTR_STAR_MATCHED;
}
//If an ACI evaluated because of an Targetattr="+", then the
- //AciHandler.maySend method signaled this via adding this attachment
- //string.
- String allOpAttrs=(String)operation.getAttachment(ALL_OP_ATTRS_MATCHED);
- if(allOpAttrs != null)
+ //AciHandler.maySend method signaled this via adding this attachment,
+ //holding the entry it evaluated: it only holds for that very entry.
+ if (entry != null
+ && operation.getAttachment(ALL_OP_ATTRS_MATCHED) == entry)
{
evalAllAttributes |= ACI_OP_ATTR_PLUS_MATCHED;
}
--
Gitblit v1.10.0