From: Howard Chu <hyc@openldap.org>
Date: Tue, 7 Oct 2025 18:12:12 +0000 (+0100)
Subject: ITS#10398 slapo-memberof/refint: fix clash on subtree renames
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1b1b687bd491ae0a40c560132156fe531c9e751e;p=thirdparty%2Fopenldap.git

ITS#10398 slapo-memberof/refint: fix clash on subtree renames

refint must use manageDsaIt control on its repair ops, and
memberof must ignore modify ops with this control set.
---

diff --git a/servers/slapd/overlays/memberof.c b/servers/slapd/overlays/memberof.c
index 46232e45c8..4e6ae5ad9f 100644
--- a/servers/slapd/overlays/memberof.c
+++ b/servers/slapd/overlays/memberof.c
@@ -903,6 +903,9 @@ memberof_op_modify( Operation *op, SlapReply *rs )
 	memberof_cbinfo_t *mci, mcis;
 	OpExtra		*oex;
 
+	if ( get_manageDSAit( op ))
+		return SLAP_CB_CONTINUE;
+
 	LDAP_SLIST_FOREACH( oex, &op->o_extra, oe_next ) {
 		if ( oex->oe_key == (void *)&memberof )
 			return SLAP_CB_CONTINUE;
@@ -2154,8 +2157,7 @@ mo_cf_gen( ConfigArgs *c )
 				if ( SLAP_ISGLOBALOVERLAY( c->be ) ) {
 					snprintf( c->cr_msg, sizeof( c->cr_msg ),
 						"addcheck functionality not supported "
-						"when memberof is a global overlay",
-						c->argv[ 1 ] );
+						"when memberof is a global overlay" );
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 						c->log, c->cr_msg );
 					return 1;
diff --git a/servers/slapd/overlays/refint.c b/servers/slapd/overlays/refint.c
index 1bcaf0ee9d..6d990dc558 100644
--- a/servers/slapd/overlays/refint.c
+++ b/servers/slapd/overlays/refint.c
@@ -660,6 +660,7 @@ refint_repair(
 		op2.orm_no_opattrs = 1;
 		op2.o_dont_replicate = 1;
 		op2.o_opid = 0;
+		op2.o_managedsait = SLAP_CONTROL_CRITICAL;
 
 		/* Set our ModifiersName */
 		if ( SLAP_LASTMOD( op->o_bd ) ) {