Fix removal of attributes in LDAP - we would not actually remove the old

value in the previous code.

Andrew Bartlett

diff --git a/source/lib/smbldap.c b/source/lib/smbldap.c
index b8ce4236e45d2b95d9e5bf24c2f7b7e29730ec77..2bfaeccd15c32e3abd497fd815cd3f071991124b 100644 (file)
--- a/source/lib/smbldap.c
+++ b/source/lib/smbldap.c
@@ -425,7 +425,7 @@ BOOL fetch_ldap_pw(char **dn, char** pw)
 
        /* all of our string attributes are case insensitive */
        
-       if (existed && (StrCaseCmp(oldval, newval) == 0)) {
+       if (existed && newval && (StrCaseCmp(oldval, newval) == 0)) {
                
                /* Believe it or not, but LDAP will deny a delete and
                   an add at the same time if the values are the
@@ -433,26 +433,26 @@ BOOL fetch_ldap_pw(char **dn, char** pw)
                return;
        }
 
+       if (existed) {
+               /* There has been no value before, so don't delete it.
+                * Here's a possible race: We might end up with
+                * duplicate attributes */
+               /* By deleting exactly the value we found in the entry this
+                * should be race-free in the sense that the LDAP-Server will
+                * deny the complete operation if somebody changed the
+                * attribute behind our back. */
+               /* This will also allow modifying single valued attributes 
+                * in Novell NDS. In NDS you have to first remove attribute and then
+                * you could add new value */
+               
+               smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, oldval);
+       }
+
        /* Regardless of the real operation (add or modify)
           we add the new value here. We rely on deleting
           the old value, should it exist. */
 
        if ((newval != NULL) && (strlen(newval) > 0)) {
-               if (existed) {
-                       /* There has been no value before, so don't delete it.
-                        * Here's a possible race: We might end up with
-                        * duplicate attributes */
-                       /* By deleting exactly the value we found in the entry this
-                        * should be race-free in the sense that the LDAP-Server will
-                        * deny the complete operation if somebody changed the
-                        * attribute behind our back. */
-                       /* This will also allow modifying single valued attributes 
-                        * in Novell NDS. In NDS you have to first remove attribute and then
-                        * you could add new value */
-
-                        smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, oldval);
-               }
-
                smbldap_set_mod(mods, LDAP_MOD_ADD, attribute, newval);
        }
 }