Re: Samba-LDAP Developer Release

[idsfa]

I stopped reading at this part in Samba::LDAP:

    if ( $self->{ldapTLS} == 1 ) {
        $ldap_master->start_tls(
            verify     => $self->{verify},
            clientcert => $self->{clientcert},
            clientkey  => $self->{clientkey},
            cafile     => $self->{cafile},
        );
    }

    $ldap_master->bind( $self->{masterDN}, password => $self->{masterP
+w}, );

Please, please, please confirm that the requested TLS connection worked before you send a Domain Admin privileged account and password over the connection. The needed code looks like:

    $ladp_master->code && die "failed to start TLS: ", $ldap_master->e
+rror ;

The same holds true for the _slave function.

Updated: Okay I read some more. I'm twitching about:

    if ($homedir) {
        my @rmargs = ('-rf');

        # print "rm @rmargs $homedir\n";
        system( 'rm', @rmargs, $homedir );
    }

in Samba::LDAP::User. So many possible values of $homedir lead to ruin.

In general, there appears to be a lot of shelling out functionality that could be done in pure perl.

[ghenry]

Thanks for taking the time to read some of it idsfa.

Like I said, I haven't really touched/cleaned up any of the original code. The above isn't mine, all I have done so far is split everything up into classes and move things to methods.

I saw the above right away too, but in the next release, things like this will be re-written and removed.

Thanks though.
Gavin.