Fixes for the %U and %G problems people have reported.

Essentially, multiple session_setup_and_X's may be done
to an smbd. As there is only one global variable containing
the requested connection name (sessionsetup_user), then any
subsequent sessionsetups overwrite this name (causing %U
and %G to get the wrong name). This is particularly common
when an NT client does a null session setup to get a
browse list after the user has connected, but before
a share has been mounted.

These changes store the requested_name in the vuid structure
(so this only really works for user level and above security)
and copies this name back into the global variable before
the standard_sub call.

Jeremy.
(This used to be commit b5187ad6a3b3af9fbbeee8bced0ab16b41e9825b)

1 files changed, 5 insertions, 5 deletions

diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 3bdff29621a..13a8d1347fb 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -85,7 +85,7 @@ static int CopyExpanded(int cnum, int snum, char** dst, char* src, int* n)
 
   StrnCpy(buf,src,sizeof(buf)/2);
   string_sub(buf,"%S",lp_servicename(snum));
-  standard_sub(cnum,buf);
+  standard_sub(cnum,buf,UID_FIELD_INVALID);
   StrnCpy(*dst,buf,*n);
   l = strlen(*dst) + 1;
   (*dst) += l;
@@ -110,7 +110,7 @@ static int StrlenExpanded(int cnum, int snum, char* s)
   if (!s) return(0);
   StrnCpy(buf,s,sizeof(buf)/2);
   string_sub(buf,"%S",lp_servicename(snum));
-  standard_sub(cnum,buf);
+  standard_sub(cnum,buf,UID_FIELD_INVALID);
   return strlen(buf) + 1;
 }
 
@@ -120,7 +120,7 @@ static char* Expand(int cnum, int snum, char* s)
   if (!s) return(NULL);
   StrnCpy(buf,s,sizeof(buf)/2);
   string_sub(buf,"%S",lp_servicename(snum));
-  standard_sub(cnum,buf);
+  standard_sub(cnum,buf,UID_FIELD_INVALID);
   return &buf[0];
 }
 
@@ -2058,7 +2058,7 @@ static BOOL api_RNetServerGetInfo(int cnum,uint16 vuid, char *param,char *data,
 	SIVAL(p,6,0);
       } else {
 	SIVAL(p,6,PTR_DIFF(p2,*rdata));
-	standard_sub(cnum,comment);
+	standard_sub(cnum,comment,vuid);
 	StrnCpy(p2,comment,MAX(mdrcnt - struct_len,0));
 	p2 = skip_string(p2,1);
       }
@@ -2584,7 +2584,7 @@ static BOOL api_WWkstaUserLogon(int cnum,uint16 vuid, char *param,char *data,
 /* JHT - By calling lp_logon_script() and standard_sub() we have */
 /* made sure all macros are fully substituted and available */
     logon_script = lp_logon_script();
-    standard_sub( cnum, logon_script );
+    standard_sub( cnum, logon_script, vuid );
     PACKS(&desc,"z", logon_script);		/* script path */
 /* End of JHT mods */