<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 06/16/2016 12:00 PM, Petr Spacek
wrote:<br>
</div>
<blockquote
cite="mid:afb9728d-c6e7-ecbe-be40-eac6ec320a11@redhat.com"
type="cite">
<pre wrap="">Hello,
Require 389-ds-base >= 1.3.5.6
Old DS handles LDAP filters incorrectly</pre>
</blockquote>
no. Old DS handles filters strictly as documented in the admin
guide, requiring access rights to each attribute used in the search
filter. This was known and applications had to adapt, in your case
there would have had to be two searches one with the (&()())
filter and one with (|()()()()).<br>
<br>
This was improved in the latest version and componets withou access
are ignored in filter evaluation to avoid the problems you did run
into.<br>
<br>
otherwise your fix is ok<br>
<br>
Ludwig<br>
<blockquote
cite="mid:afb9728d-c6e7-ecbe-be40-eac6ec320a11@redhat.com"
type="cite">
<pre wrap="">and breaks bind-dyndb-ldap.
See <a class="moz-txt-link-freetext" href="https://www.redhat.com/archives/freeipa-devel/2016-June/msg00477.html">https://www.redhat.com/archives/freeipa-devel/2016-June/msg00477.html</a>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/2008">https://fedorahosted.org/freeipa/ticket/2008</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Red Hat GmbH, <a class="moz-txt-link-freetext" href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill, Eric Shander</pre>
</body>
</html>