- add a "disallowed chars" map attribute

- disallow ':' in attributes in passwd.byname and passwd.byuid
- disallow ':,' in attributes in group.byname and group.bygid

8 files changed, 116 insertions, 47 deletions

diff --git a/src/backend.c b/src/backend.c
index e3e12b8..a40241a 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -58,6 +58,7 @@ struct backend_map_data {
 	char *domain, *map, **bases, *entry_filter, **key_formats;
 	char *value_format;
 	int n_key_formats;
+	char *disallowed_chars;
 	char **ref_attrs;
 	struct format_inref_attr **inref_attrs;
 };
@@ -175,6 +176,7 @@ backend_free_map_data_contents(void *data)
 		free(map_data->domain);
 		free(map_data->map);
 		free(map_data->bases);
+		free(map_data->disallowed_chars);
 		format_free_attr_list(map_data->ref_attrs);
 		format_free_inref_attrs(map_data->inref_attrs);
 		free(map_data->entry_filter);
@@ -201,6 +203,8 @@ backend_copy_cb_data(const struct backend_map_data *data)
 	ret->domain = strdup(data->domain);
 	ret->map = strdup(data->map);
 	ret->bases = backend_dup_strlist(data->bases);
+	ret->disallowed_chars = data->disallowed_chars ?
+				strdup(data->disallowed_chars) : NULL;
 	ret->ref_attrs = data->ref_attrs ?
 			 format_dup_attr_list(data->ref_attrs) :
 			 NULL;
@@ -214,6 +218,7 @@ backend_copy_cb_data(const struct backend_map_data *data)
 	if ((ret->domain == NULL) ||
 	    (ret->map == NULL) ||
 	    (ret->bases == NULL) ||
+	    (ret->disallowed_chars == NULL) ||
 	    (ret->entry_filter == NULL) ||
 	    (ret->key_formats == NULL) ||
 	    (ret->value_format == NULL)) {
@@ -232,13 +237,14 @@ backend_map_config_entry_add_one_cb(Slapi_Entry *e, void *callback_data)
 	char **keys, *value, *ndn;
 	int i, j;
 	data = callback_data;
-	/* Pull out the key and value for the entry. */
+	/* Pull out the keys and value for the entry. */
 	keys = malloc((data->n_key_formats + 1) * sizeof(char *));
 	if (keys != NULL) {
 		for (i = 0; i < data->n_key_formats; i++) {
 			keys[i] = format_get_data(data->state, NULL, e,
 						  data->domain, data->map,
 						  data->key_formats[i],
+						  data->disallowed_chars,
 						  &data->ref_attrs,
 						  &data->inref_attrs);
 		}
@@ -247,7 +253,7 @@ backend_map_config_entry_add_one_cb(Slapi_Entry *e, void *callback_data)
 		return 0;
 	}
 	value = format_get_data(data->state, NULL, e, data->domain, data->map,
-			        data->value_format,
+			        data->value_format, data->disallowed_chars,
 			        &data->ref_attrs, &data->inref_attrs);
 	/* Pull out the NDN of this entry. */
 	ndn = slapi_entry_get_ndn(e);
@@ -400,19 +406,20 @@ backend_map_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 			       bool_t *secure, struct backend_map_data *ret)
 {
 	const char *default_filter, **default_key_formats;
-	const char *default_value_format;
+	const char *default_value_format, *default_disallowed_chars;
 	char **bases, *entry_filter, **key_formats, *value_format, *actual_attr;
-	char **ref_attrs;
+	char **ref_attrs, *disallowed_chars;
 	struct format_inref_attr **inref_attrs;
 	char **use_bases, *use_entry_filter, **use_key_formats;
-	char *use_value_format;
+	char *use_value_format, *use_disallowed_chars;
 	const char *cvalue;
 	int i, j, disposition, buffer_flags, count;
 	Slapi_ValueSet *values;
 	Slapi_Value *value;
 	/* Read the hard-coded defaults for a map with this name. */
 	defaults_get_map_config(map, secure, &default_filter,
-				&default_key_formats, &default_value_format);
+				&default_key_formats, &default_value_format,
+				&default_disallowed_chars);
 	/* Read the values from the configuration entry. */
 	bases = NULL;
 	if (slapi_vattr_values_get(e, MAP_CONFIGURATION_BASE_ATTR, &values,
@@ -473,6 +480,17 @@ backend_map_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 		}
 		slapi_vattr_values_free(&values, &actual_attr, buffer_flags);
 	}
+	disallowed_chars = NULL;
+	if (slapi_vattr_values_get(e, MAP_CONFIGURATION_DISALLOWED_CHARS_ATTR,
+				   &values, &disposition, &actual_attr,
+				   0, &buffer_flags) == 0) {
+		i = slapi_valueset_first_value(values, &value);
+		if (i != -1) {
+			cvalue = slapi_value_get_string(value);
+			disallowed_chars = strdup(cvalue);
+		}
+		slapi_vattr_values_free(&values, &actual_attr, buffer_flags);
+	}
 	*secure = FALSE;
 	if (slapi_vattr_values_get(e, MAP_CONFIGURATION_SECURE_ATTR, &values,
 				   &disposition, &actual_attr,
@@ -506,6 +524,11 @@ backend_map_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 			   strdup(value_format) :
 			   strdup(default_value_format);
 	use_bases = backend_dup_strlist(bases);
+	use_disallowed_chars = disallowed_chars ?
+			       disallowed_chars :
+			       (default_disallowed_chars ?
+			        strdup(default_disallowed_chars) :
+				NULL);
 	/* Free the values we read from the entry. */
 	free(value_format);
 	backend_free_strlist(key_formats);
@@ -516,6 +539,7 @@ backend_map_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	ret->domain = strdup(domain);
 	ret->map = strdup(map);
 	ret->bases = use_bases;
+	ret->disallowed_chars = use_disallowed_chars;
 	ret->entry_filter = use_entry_filter;
 	ret->key_formats = use_key_formats;
 	ret->value_format = use_value_format;
@@ -951,7 +975,8 @@ backend_get_map_config(struct plugin_state *state,
 	cbdata.bases = NULL;
 	cbdata.state = state;
 	map_secure = FALSE;
-	defaults_get_map_config(map, &map_secure, &default_filter, NULL, NULL);
+	defaults_get_map_config(map, &map_secure, &default_filter,
+				NULL, NULL, NULL);
 	cbdata.entry_filter = strdup(default_filter);
 	slapi_search_internal_callback_pb(pb, &cbdata,
 					  NULL,
diff --git a/src/defaults.c b/src/defaults.c
index 29e0d8d..9ecd1f8 100644
--- a/src/defaults.c
+++ b/src/defaults.c
@@ -39,32 +39,38 @@ static struct configuration {
 	char *map;
 	enum { config_exact, config_glob } config_match;
 	bool_t secure;
-	char *filter, *key_formats[3], *value_format;
+	char *filter, *key_formats[3], *value_format, *disallowed_chars;
 } config[] = {
 	{"passwd.byname", config_exact, FALSE,
 	 "(objectClass=posixAccount)",
 	 {"%{uid}", NULL, NULL},
-	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{cn!:}:%{homeDirectory:-/}:%{loginShell!:}"},
+	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{gecos:-%{cn}}:%{homeDirectory:-/}:%{loginShell}",
+	 ":"},
 	{"passwd.byuid", config_exact, FALSE,
 	 "(objectClass=posixAccount)",
 	 {"%{uidNumber}", NULL, NULL},
-	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{cn!:}:%{homeDirectory:-/}:%{loginShell!:}"},
+	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{gecos:-%{cn}}:%{homeDirectory:-/}:%{loginShell}",
+	 ":"},
 	{"group.byname", config_exact, FALSE,
 	 "(objectClass=posixGroup)",
 	 {"%{cn}", NULL, NULL},
-	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byname\\\",\\\"memberOf\\\",\\\"uid\\\")\")"},
+	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byname\\\",\\\"memberOf\\\",\\\"uid\\\")\")",
+	 ":,"},
 	{"group.bygid", config_exact, FALSE,
 	 "(objectClass=posixGroup)",
 	 {"%{gidNumber}", NULL, NULL},
-	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byuid\\\",\\\"memberOf\\\",\\\"uid\\\")\")"},
+	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byuid\\\",\\\"memberOf\\\",\\\"uid\\\")\")",
+	 ":,"},
 	{"netgroup", config_exact, FALSE,
 	 "(objectClass=nisNetgroup)",
 	 {"%{cn}", NULL, NULL},
-	 "%list(\" \",\"nisNetgroupTriple\",\"memberNisNetgroup\")"},
+	 "%list(\" \",\"nisNetgroupTriple\",\"memberNisNetgroup\")",
+	 NULL},
 	{"auto.*", config_glob, FALSE,
 	 "(objectClass=automount)",
 	 {"%{automountKey}", NULL, NULL},
-	 "%{automountInformation}"},
+	 "%{automountInformation}",
+	 NULL},
 };
 
 void
@@ -72,7 +78,8 @@ defaults_get_map_config(const char *mapname,
 			bool_t *secure,
 			const char **filter,
 			const char ***key_formats,
-			const char **value_format)
+			const char **value_format,
+			const char **disallowed_chars)
 {
 	unsigned int i;
 	if (filter) {
@@ -103,6 +110,9 @@ defaults_get_map_config(const char *mapname,
 				if (value_format) {
 					*value_format = config[i].value_format;
 				}
+				if (disallowed_chars) {
+					*disallowed_chars = config[i].disallowed_chars;
+				}
 			}
 			break;
 		case config_glob:
@@ -120,6 +130,9 @@ defaults_get_map_config(const char *mapname,
 				if (value_format) {
 					*value_format = config[i].value_format;
 				}
+				if (disallowed_chars) {
+					*disallowed_chars = config[i].disallowed_chars;
+				}
 			}
 			break;
 		}
diff --git a/src/defaults.h b/src/defaults.h
index e36cbd1..7b93398 100644
--- a/src/defaults.h
+++ b/src/defaults.h
@@ -25,5 +25,6 @@ void defaults_get_map_config(const char *mapname,
 			     bool_t *secure,
 			     const char **filter,
 			     const char ***key_formats,
-			     const char **value_format);
+			     const char **value_format,
+			     const char **disallowed_chars);
 #endif
diff --git a/src/dummymap.c b/src/dummymap.c
index cd36c15..f99ea6d 100644
--- a/src/dummymap.c
+++ b/src/dummymap.c
@@ -219,7 +219,7 @@ map_match(struct plugin_state *state,
 bool_t
 map_match_id(struct plugin_state *state,
 	     const char *domain, const char *map, bool_t *secure,
-	     const char *in_id, int in_index,
+	     const char *in_id, unsigned int in_index,
 	     unsigned int *key_len, char **key,
 	     unsigned int *value_len, char **value,
 	     const char **id)
diff --git a/src/format.c b/src/format.c
index aabba07..2579eb2 100644
--- a/src/format.c
+++ b/src/format.c
@@ -49,7 +49,8 @@
 #define MAX_BUFFER_SIZE     0x100000
 static int format_expand(struct plugin_state *state,
 			 Slapi_PBlock *pb, Slapi_Entry *e,
-			 const char *domain, const char *map, const char *fmt,
+			 const char *domain, const char *map,
+			 const char *fmt, const char *disallowed,
 			 char *outbuf, int outbuf_len,
 			 char ***ref_attrs,
 			 struct format_inref_attr ***inref_attrs,
@@ -284,7 +285,8 @@ format_parse_args(struct plugin_state *state, const char *args,
 static int
 format_echo(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *domain, const char *map,
-	    const char *args, char *outbuf, int outbuf_len,
+	    const char *args, const char *disallowed,
+	    char *outbuf, int outbuf_len,
 	    char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int ret, i, argc, len;
@@ -324,7 +326,8 @@ format_echo(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static int
 format_list(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *domain, const char *map,
-	    const char *args, char *outbuf, int outbuf_len,
+	    const char *args, const char *disallowed,
+	    char *outbuf, int outbuf_len,
 	    char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int ret, i, j, len, slen, count, argc;
@@ -403,7 +406,8 @@ format_list(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static int
 format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *domain, const char *map,
-	     const char *args, char *outbuf, int outbuf_len,
+	     const char *args, const char *disallowed,
+	     char *outbuf, int outbuf_len,
 	     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int i, j, len, slen, ret, count, argc;
@@ -628,7 +632,8 @@ format_referred_entry_cb(Slapi_Entry *e, void *callback_data)
 static int
 format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	        const char *domain, const char *map,
-		const char *args, char *outbuf, int outbuf_len,
+		const char *args, const char *disallowed,
+		char *outbuf, int outbuf_len,
 	        char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int i, j, len, slen, ret, count, argc;
@@ -756,7 +761,8 @@ format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static int
 format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *domain, const char *map,
-	     const char *args, char *outbuf, int outbuf_len,
+	     const char *args, const char *disallowed,
+	     char *outbuf, int outbuf_len,
 	     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	int ret, i, argc, len, slen, count;
@@ -778,7 +784,8 @@ format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		/* Expand this argument. */
 		slapi_log_error(SLAPI_LOG_PLUGIN, state->plugin_desc->spd_id,
 				"merge: expanding ->%s<-\n", argv[i]);
-		len = format_expand(state, pb, e, domain, map, argv[i],
+		len = format_expand(state, pb, e, domain, map,
+				    argv[i], disallowed,
 				    outbuf + ret + (count ? slen : 0),
 				    outbuf_len - (ret + (count ? slen : 0)),
 				    ref_attrs, inref_attrs, FALSE);
@@ -822,6 +829,7 @@ format_match_generic(struct plugin_state *state,
 		     Slapi_PBlock *pb, Slapi_Entry *e,
 		     const char *domain, const char *map,
 		     const char *args, int min_args, int default_arg,
+		     const char *disallowed,
 		     char *outbuf, int outbuf_len,
 		     char ***ref_attrs,
 		     struct format_inref_attr ***inref_attrs,
@@ -972,10 +980,12 @@ static int
 format_match(struct plugin_state *state,
 	     Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *domain, const char *map,
-	     const char *args, char *outbuf, int outbuf_len,
+	     const char *args, const char *disallowed,
+	     char *outbuf, int outbuf_len,
 	     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	return format_match_generic(state, pb, e, domain, map, args, 2, 2,
+				    disallowed,
 				    outbuf, outbuf_len, ref_attrs, inref_attrs,
 				    "format_match", format_match_cb);
 }
@@ -999,10 +1009,12 @@ static int
 format_regmatch(struct plugin_state *state,
 	        Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *domain, const char *map,
-	        const char *args, char *outbuf, int outbuf_len,
+	        const char *args, const char *disallowed,
+		char *outbuf, int outbuf_len,
 		char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	return format_match_generic(state, pb, e, domain, map, args, 2, 2,
+				    disallowed,
 				    outbuf, outbuf_len, ref_attrs, inref_attrs,
 				    "format_regmatch", format_regmatch_cb);
 }
@@ -1119,10 +1131,12 @@ static int
 format_regsub(struct plugin_state *state,
 	      Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *domain, const char *map,
-	      const char *args, char *outbuf, int outbuf_len,
+	      const char *args, const char *disallowed,
+	      char *outbuf, int outbuf_len,
 	      char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	return format_match_generic(state, pb, e, domain, map, args, 3, 3,
+				    disallowed,
 				    outbuf, outbuf_len, ref_attrs, inref_attrs,
 				    "format_regsub", format_regsub_cb);
 }
@@ -1137,7 +1151,7 @@ format_lookup_fn(const char *fnname)
 		int (*fct_ptr)(struct plugin_state *state,
 			       Slapi_PBlock *pb, Slapi_Entry *e,
 			       const char *domain, const char *map,
-			       const char *args,
+			       const char *args, const char *disallowed,
 			       char *outbuf, int outbuf_len,
 			       char ***ref_attrs,
 			       struct format_inref_attr ***inref_attrs);
@@ -1164,12 +1178,12 @@ format_lookup_fn(const char *fnname)
  * than one, fail. */
 static char *
 format_single(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
-	      const char *attr)
+	      const char *attr, const char *disallowed)
 {
 	Slapi_ValueSet *value_set;
 	Slapi_Value *value;
 	char *ret, *actual_attr;
-	const char *cret;
+	const char *cret, *d;
 	int count, disposition, buffer_flags;
 	if (slapi_vattr_values_get(e, (char *) attr, &value_set,
 				   &disposition, &actual_attr,
@@ -1182,7 +1196,17 @@ format_single(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		if (slapi_valueset_first_value(value_set, &value) == 0) {
 			cret = slapi_value_get_string(value);
 			if (cret != NULL) {
-				ret = strdup(cret);
+				if ((disallowed != NULL) &&
+				    ((d = strpbrk(cret, disallowed)) != NULL)) {
+					slapi_log_error(SLAPI_LOG_PLUGIN,
+							state->plugin_desc->spd_id,
+							"value for \"%s\" "
+							"contains disallowed "
+							"character %c\n",
+							attr, *d);
+				} else {
+					ret = strdup(cret);
+				}
 			}
 		}
 	} else {
@@ -1428,7 +1452,8 @@ static int
 format_expand_simple(struct plugin_state *state,
 		     Slapi_PBlock *pb, Slapi_Entry *e,
 		     const char *domain, const char *map,
-		     const char *fmt, char *outbuf, int outbuf_len,
+		     const char *fmt, const char *disallowed,
+		     char *outbuf, int outbuf_len,
 		     char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	char *shortstart, *longstart, *shortend, *longend;
@@ -1523,14 +1548,14 @@ format_expand_simple(struct plugin_state *state,
 		}
 	}
 	/* Retrieve the value. */
-	tmp = format_single(state, pb, e, attribute);
+	tmp = format_single(state, pb, e, attribute, disallowed);
 	if (tmp == NULL) {
 		/* The attribute is undefined, or we're treating it as if it
 		 * is. */
 		if (default_value != NULL) {
 			/* Supply the default value, expanding it if needed. */
 			i = format_expand(state, pb, e,
-					  domain, map, default_value,
+					  domain, map, default_value, NULL,
 					  outbuf, outbuf_len,
 					  ref_attrs, inref_attrs, FALSE);
 			free(expr);
@@ -1546,7 +1571,7 @@ format_expand_simple(struct plugin_state *state,
 		if (alternate_value != NULL) {
 			/* Supply the alternate value. */
 			i = format_expand(state, pb, e,
-					  domain, map, alternate_value,
+					  domain, map, alternate_value, NULL,
 					  outbuf, outbuf_len,
 					  ref_attrs, inref_attrs, FALSE);
 			free(tmp);
@@ -1584,7 +1609,8 @@ format_expand_simple(struct plugin_state *state,
  * evaluate it, otherwise return it. */
 static int
 format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
-	      const char *domain, const char *map, const char *fmt,
+	      const char *domain, const char *map,
+	      const char *fmt, const char *disallowed,
 	      char *outbuf, int outbuf_len,
 	      char ***ref_attrs, struct format_inref_attr ***inref_attrs,
 	      bool_t is_simple_expression)
@@ -1600,7 +1626,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	size_t spn;
 	int (*formatfn)(struct plugin_state *state,
 		        Slapi_PBlock *pb, Slapi_Entry *e,
-			const char *domain, const char *map, const char *args,
+			const char *domain, const char *map,
+			const char *args, const char *disallowed,
 		        char *outbuf, int outbuf_len,
 			char ***ref_attrs,
 			struct format_inref_attr ***inref_attrs);
@@ -1666,6 +1693,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 									domain,
 									map,
 									tmp,
+									disallowed,
 									expr + j,
 									exp_size - j,
 									ref_attrs,
@@ -1773,7 +1801,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				}
 				/* Call the "function". */
 				exp_used = (*formatfn)(state, pb, e,
-						       domain, map, tmp,
+						       domain, map,
+						       tmp, disallowed,
 						       expr + j, exp_size - j,
 						       ref_attrs, inref_attrs);
 				free(tmp);
@@ -1818,7 +1847,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 
 	if (is_simple_expression) {
 		exp_used = format_expand_simple(state, pb, e, domain, map,
-						expr, outbuf, outbuf_len,
+						expr, disallowed,
+						outbuf, outbuf_len,
 						ref_attrs, inref_attrs);
 		if (exp_used < 0) {
 			free(expr);
@@ -1842,7 +1872,7 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 static char *
 format_format(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *domain, const char *map,
-	      const char *fmt,
+	      const char *fmt, const char *disallowed,
 	      char ***ref_attrs, struct format_inref_attr ***inref_attrs)
 {
 	char *buf, *tmp, *ret, *spd_id;
@@ -1863,8 +1893,8 @@ format_format(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			return NULL;
 		}
 
-		i = format_expand(state, pb, e, domain, map, fmt, buf, buflen,
-				  ref_attrs, inref_attrs, FALSE);
+		i = format_expand(state, pb, e, domain, map, fmt, disallowed,
+				  buf, buflen, ref_attrs, inref_attrs, FALSE);
 		if ((i >= 0) && (i < buflen)) {
 			buf[i] = '\0';
 			ret = strdup(buf);
@@ -1910,7 +1940,7 @@ format_format(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 char *
 format_get_data(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *domain, const char *map,
-		const char *fmt,
+		const char *fmt, const char *disallowed,
 		char ***ref_attrs,
 		struct format_inref_attr ***inref_attrs)
 {
@@ -1925,7 +1955,7 @@ format_get_data(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		local_pb = NULL;
 	}
 
-	ret = format_format(state, pb, e, domain, map, fmt,
+	ret = format_format(state, pb, e, domain, map, fmt, disallowed,
 			    ref_attrs, inref_attrs);
 
 	/* If we supplied a PBlock, clean it up. */
diff --git a/src/format.h b/src/format.h
index 7bc4775..5728ff2 100644
--- a/src/format.h
+++ b/src/format.h
@@ -39,7 +39,7 @@ void format_free_data(char *data);
 char *format_get_data(struct plugin_state *state,
 		      struct slapi_pblock *pb, struct slapi_entry *e,
 		      const char *domain, const char *map,
-		      const char *fmt,
+		      const char *fmt, const char *disallowed_chars,
 		      char ***ref_attrs,
 		      struct format_inref_attr ***inref_attrs);
 
diff --git a/src/map.c b/src/map.c
index 810a400..9174cf4 100644
--- a/src/map.c
+++ b/src/map.c
@@ -420,7 +420,7 @@ bool_t
 map_match_id(struct plugin_state *state,
 	     const char *domain_name, const char *map_name,
 	     bool_t *secure,
-	     const char *in_id, int in_key_index,
+	     const char *in_id, unsigned int in_key_index,
 	     unsigned int *key_len, char **key,
 	     unsigned int *value_len, char **value,
 	     const char **id)
diff --git a/src/map.h b/src/map.h
index 8739f22..30db7bc 100644
--- a/src/map.h
+++ b/src/map.h
@@ -41,7 +41,7 @@ bool_t map_match(struct plugin_state *state,
 		 unsigned int *value_len, char **value, const char **id);
 bool_t map_match_id(struct plugin_state *state,
 		    const char *domain, const char *map, bool_t *secure,
-		    const char *id_in, int id_index,
+		    const char *id_in, unsigned int id_index,
 		    unsigned int *key_len, char **key,
 		    unsigned int *value_len, char **value,
 		    const char **id);