From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 29 Oct 2021 05:38:41 +0000 (-0400)
Subject: Validate after we figure out it's a real pair list match
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=41cb3d2296172905ec07066822ac888cb1510083;p=thirdparty%2Ffreeradius-server.git

Validate after we figure out it's a real pair list match
---

diff --git a/src/lib/server/tmpl_tokenize.c b/src/lib/server/tmpl_tokenize.c
index f40186c3e05..6f8f9fc6c80 100644
--- a/src/lib/server/tmpl_tokenize.c
+++ b/src/lib/server/tmpl_tokenize.c
@@ -1905,13 +1905,6 @@ ssize_t tmpl_afrom_attr_substr(TALLOC_CTX *ctx, tmpl_attr_error_t *err,
 	fr_sbuff_out_by_longest_prefix(&list_len, &vpt->data.attribute.list, pair_list_table,
 				       &our_name, t_rules->list_def);
 
-	if ((t_rules->attr_parent || t_rules->disallow_qualifiers) && (list_len > 0)) {
-		fr_strerror_const("It is not permitted to specify a pair list here");
-		if (err) *err = TMPL_ATTR_ERROR_INVALID_LIST_QUALIFIER;
-		talloc_free(vpt);
-		FR_SBUFF_ERROR_RETURN(&our_name);
-	}
-
 	/*
 	 *	Check if we need to backtrack
 	 *
@@ -1929,6 +1922,13 @@ ssize_t tmpl_afrom_attr_substr(TALLOC_CTX *ctx, tmpl_attr_error_t *err,
 		vpt->data.attribute.list = t_rules->list_def;
 	}
 
+	if ((t_rules->attr_parent || t_rules->disallow_qualifiers) && (list_len > 0)) {
+		fr_strerror_const("It is not permitted to specify a pair list here");
+		if (err) *err = TMPL_ATTR_ERROR_INVALID_LIST_QUALIFIER;
+		talloc_free(vpt);
+		FR_SBUFF_ERROR_RETURN(&our_name);
+	}
+
 	/*
 	 *	Parse the attribute reference
 	 *