getncchanges: Do not filter secrets by PAS in EXOP_REPL_SECRET

This conforms with Windows' behaviour.

Signed-off-by: Bob Campbell <bobcampbell@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index efad0c9aa5e6b5cfaa290cc59f5af8693a55bead..5a5ad0cf3fabc7a3a74a86bfd425578ae74809c5 100644 (file)
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -340,7 +340,7 @@ static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItem
                }
 
                /* filter by partial_attribute_set */
-               if (partial_attribute_set) {
+               if (partial_attribute_set && !force_attribute) {
                        uint32_t *result = NULL;
                        BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id,
                                              uint32_t_cmp, result);