From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 16 Jan 2013 15:35:33 +0000 (+0100)
Subject: dsdb-acl: use acl_check_access_on_objectclass() instead of acl_check_access_on_class()
X-Git-Url: http://git.samba.org/?a=commitdiff_plain;h=34f1a52689f4cc64fb63118e685a4442e3fe187a;p=metze%2Fsamba%2Fwip.git

dsdb-acl: use acl_check_access_on_objectclass() instead of acl_check_access_on_class()

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c
index 638955de9790..a3f43032be28 100644
--- a/source4/dsdb/samdb/ldb_modules/acl.c
+++ b/source4/dsdb/samdb/ldb_modules/acl.c
@@ -434,14 +434,19 @@ static int acl_childClassesEffective(struct ldb_module *module,
 		}
 
 		for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
-			ret = acl_check_access_on_class(module,
-							schema,
-							msg,
-							sd,
-							acl_user_token(module),
-							sid,
-							SEC_ADS_CREATE_CHILD,
-							sclass->possibleInferiors[j]);
+			const struct dsdb_class *sc;
+
+			sc = dsdb_class_by_lDAPDisplayName(schema,
+							   sclass->possibleInferiors[j]);
+			if (!sc) {
+				/* We don't know this class?  what is going on? */
+				continue;
+			}
+
+			ret = acl_check_access_on_objectclass(module, ac,
+							      sd, sid,
+							      SEC_ADS_CREATE_CHILD,
+							      sc);
 			if (ret == LDB_SUCCESS) {
 				ldb_msg_add_string(msg, "allowedChildClassesEffective",
 						   sclass->possibleInferiors[j]);