s4:rdn_name LDB module - move the "distinguishedName" write prevent check here

In my eyes it fits better here than in the TDB backend code.

diff --git a/source4/lib/ldb/ldb_tdb/ldb_tdb.c b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
index 42e1bd57b6ffb835308ec36ae45f78dc91b888dd..c80ecd0b4337fc53a239a4b8e7fb589d93928582 100644 (file)
--- a/source4/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -652,13 +652,6 @@ int ltdb_modify_internal(struct ldb_module *module,
                const struct ldb_schema_attribute *a = ldb_schema_attribute_by_name(ldb, el->name);
                const char *dn;
 
-               if (ldb_attr_cmp(el->name, "distinguishedName") == 0) {
-                       ldb_asprintf_errstring(ldb, "it is not permitted to perform a modify on 'distinguishedName' (use rename instead): %s",
-                                              ldb_dn_get_linearized(msg2->dn));
-                       ret = LDB_ERR_CONSTRAINT_VIOLATION;
-                       goto done;
-               }
-
                switch (msg->elements[i].flags & LDB_FLAG_MOD_MASK) {
                case LDB_FLAG_MOD_ADD:
 

diff --git a/source4/lib/ldb/modules/rdn_name.c b/source4/lib/ldb/modules/rdn_name.c
index 38a1b6f583d29d13617e04aec5113628991a8e98..5dc122f254a8e8ac9d9a64fb6ed79e1c7c0ab72f 100644 (file)
--- a/source4/lib/ldb/modules/rdn_name.c
+++ b/source4/lib/ldb/modules/rdn_name.c
@@ -348,6 +348,12 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
                return ldb_next_request(module, req);
        }
 
+       if (ldb_msg_find_element(req->op.mod.message, "distinguishedName")) {
+               ldb_asprintf_errstring(ldb, "Modify of 'distinguishedName' on %s not permitted, must use 'rename' operation instead",
+                                      ldb_dn_get_linearized(req->op.mod.message->dn));
+               return LDB_ERR_CONSTRAINT_VIOLATION;
+       }
+
        if (ldb_msg_find_element(req->op.mod.message, "name")) {
                ldb_asprintf_errstring(ldb, "Modify of 'name' on %s not permitted, must use 'rename' operation instead",
                                       ldb_dn_get_linearized(req->op.mod.message->dn));