Fine changes to previous fix for bug #7104 - "wide links" and "unix extensions" are...

Make sure we match the previous allow widelinks behavior, in that
non-root preexec scripts can create share directories for a share
definition.

Jeremy

diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 9d3da8352ace1a1201e59742988e8f5c8301b67e..1e8c15bfde3a8d367a51bc01e6c34d6adfdbb83b 100644 (file)
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -916,26 +916,6 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
                }
        }
 
-       /*
-        * If widelinks are disallowed we need to canonicalise the connect
-        * path here to ensure we don't have any symlinks in the
-        * connectpath. We will be checking all paths on this connection are
-        * below this directory. We must do this after the VFS init as we
-        * depend on the realpath() pointer in the vfs table. JRA.
-        */
-       if (!lp_widelinks(snum)) {
-               if (!canonicalize_connect_path(conn)) {
-                       DEBUG(0, ("canonicalize_connect_path failed "
-                       "for service %s, path %s\n",
-                               lp_servicename(snum),
-                               conn->connectpath));
-                       yield_connection(conn, lp_servicename(snum));
-                       conn_free(conn);
-                       *pstatus = NT_STATUS_BAD_NETWORK_NAME;
-                       return NULL;
-               }
-       }
-
 /* USER Activites: */
        if (!change_to_user(conn, conn->vuid)) {
                /* No point continuing if they fail the basic checks */
@@ -972,6 +952,24 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
                }
        }
 
+       /*
+        * If widelinks are disallowed we need to canonicalise the connect
+        * path here to ensure we don't have any symlinks in the
+        * connectpath. We will be checking all paths on this connection are
+        * below this directory. We must do this after the VFS init as we
+        * depend on the realpath() pointer in the vfs table. JRA.
+        */
+       if (!lp_widelinks(snum)) {
+               if (!canonicalize_connect_path(conn)) {
+                       DEBUG(0, ("canonicalize_connect_path failed "
+                       "for service %s, path %s\n",
+                               lp_servicename(snum),
+                               conn->connectpath));
+                       *pstatus = NT_STATUS_BAD_NETWORK_NAME;
+                       goto err_root_exit;
+               }
+       }
+
 #ifdef WITH_FAKE_KASERVER
        if (lp_afs_share(snum)) {
                afs_login(conn);