From: Howard Chu <hyc@openldap.org>
Date: Tue, 15 Dec 2020 22:55:47 +0000 (+0000)
Subject: ITS#9426 dynlist: don't add unexpanded groups at end of search
X-Git-Tag: OPENLDAP_REL_ENG_2_5_1ALPHA~15^2~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=354e678ce9fe2a7f6c33dbff7fd68cae300033a9;p=thirdparty%2Fopenldap.git

ITS#9426 dynlist: don't add unexpanded groups at end of search
if pagedResults is in use
---

diff --git a/doc/man/man5/slapo-dynlist.5 b/doc/man/man5/slapo-dynlist.5
index a6f2d6af16..ad73e327bd 100644
--- a/doc/man/man5/slapo-dynlist.5
+++ b/doc/man/man5/slapo-dynlist.5
@@ -263,6 +263,11 @@ The
 .BR slapo\-dynlist (5)
 overlay supports dynamic configuration via
 .BR back-config .
+
+.SH BUGS
+Filtering on dynamic groups may return incomplete results if the
+search operation uses the \fIpagedResults\fP control.
+
 .SH ACKNOWLEDGEMENTS
 .P
 This module was written in 2004 by Pierangelo Masarati for SysNet s.n.c.
diff --git a/servers/slapd/overlays/dynlist.c b/servers/slapd/overlays/dynlist.c
index 9519f97199..309c9bbf50 100644
--- a/servers/slapd/overlays/dynlist.c
+++ b/servers/slapd/overlays/dynlist.c
@@ -350,6 +350,7 @@ dynlist_urlmembers( Operation *op, dynlist_name_t *dyn, slap_callback *sc )
 	o.ors_tlimit = SLAP_NO_LIMIT;
 	o.ors_slimit = SLAP_NO_LIMIT;
 	o.ors_attrs = NULL;
+	memset( o.o_ctrlflag, 0, sizeof( o.o_ctrlflag ));
 	o.o_callback = sc;
 
 	for (i=0; i<dyn->dy_numuris; i++) {
@@ -547,6 +548,7 @@ dynlist_prepare_entry( Operation *op, SlapReply *rs, dynlist_info_t *dli, dynlis
 	o.ors_limit = NULL;
 	o.ors_tlimit = SLAP_NO_LIMIT;
 	o.ors_slimit = SLAP_NO_LIMIT;
+	memset( o.o_ctrlflag, 0, sizeof( o.o_ctrlflag ));
 
 	for ( url = a->a_nvals; !BER_BVISNULL( url ); url++ ) {
 		LDAPURLDesc	*lud = NULL;
@@ -1534,6 +1536,9 @@ dynlist_search2resp( Operation *op, SlapReply *rs )
 		SlapReply r = *rs;
 		Filter *f = ds->ds_origfilter ? ds->ds_origfilter : op->ors_filter;
 
+		if ( get_pagedresults( op ) > SLAP_CONTROL_IGNORED )
+			return SLAP_CB_CONTINUE;
+
 		/* Check for any unexpanded dynamic group entries that weren't picked up
 		 * by the original search filter.
 		 */
@@ -1677,6 +1682,7 @@ dynlist_search( Operation *op, SlapReply *rs )
 	sc->sc_private = (void *)(sc+1);
 	ds = sc->sc_private;
 
+	memset( o.o_ctrlflag, 0, sizeof( o.o_ctrlflag ));
 	o.o_managedsait = SLAP_CONTROL_CRITICAL;
 
 	/* Are we using memberOf, and does it affect this request? */