From de42bdce8ff329998ad4eef467503ea3a4fafd89 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Wed, 21 Oct 2026 08:54:06 +0000
Subject: [PATCH] GHSA-6f6q-q9gw-4jr4 Sort and VLV controls let authenticated users learn password hashes and other attributes hidden by access control
---
opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciHandler.java | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciHandler.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciHandler.java
index 010928b..38d4de7 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciHandler.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/AciHandler.java
@@ -80,12 +80,14 @@
/**
* String used to indicate that the evaluating ACI had a all
* operational attributes targetattr match (targetattr="+").
+ * The attachment's value is the entry it holds for.
*/
static final String ALL_OP_ATTRS_MATCHED = "allOpAttrsMatched";
/**
* String used to indicate that the evaluating ACI had a all user
* attributes targetattr match (targetattr="*").
+ * The attachment's value is the entry it holds for.
*/
static final String ALL_USER_ATTRS_MATCHED = "allUserAttrsMatched";
@@ -456,13 +458,15 @@
return false;
}
+ // Each shortcut holds the very entry it was decided for, so that filterEntry() applies it to that entry alone
+ // and to no other entry of the operation (GHSA-6f6q-q9gw-4jr4).
if (!container.hasEvalUserAttributes())
{
- operation.setAttachment(ALL_USER_ATTRS_MATCHED, ALL_USER_ATTRS_MATCHED);
+ operation.setAttachment(ALL_USER_ATTRS_MATCHED, entry);
}
if (!container.hasEvalOpAttributes())
{
- operation.setAttachment(ALL_OP_ATTRS_MATCHED, ALL_OP_ATTRS_MATCHED);
+ operation.setAttachment(ALL_OP_ATTRS_MATCHED, entry);
}
return true;
--
Gitblit v1.10.0