ptserver: Check for -restricted in SPR_Delete

Currently, all prdb write operations, except for SPR_Delete, will fail
with PRPERM if called by a non-system:administrators caller while
restricted mode is active.  SPR_Delete is missing this check, and so
is not affected by the -restricted option.

Fix this by inserting the same check for -restricted as all other code
paths that check for -restricted.

Change-Id: I35f19d0b715423cd91769e6de845efa330368e50
Reviewed-on: https://gerrit.openafs.org/13374
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

diff --git a/src/ptserver/ptprocs.c b/src/ptserver/ptprocs.c
index 4ce1cbf..a3ad9c5 100644 (file)
--- a/src/ptserver/ptprocs.c
+++ b/src/ptserver/ptprocs.c
@@ -739,6 +739,10 @@ Delete(struct rx_call *call, afs_int32 aid, afs_int32 *cid)
        && !IsAMemberOf(tt, *cid, tentry.owner) && !pr_noAuth)
        ABORT_WITH(tt, PRPERM);
 
+    if (restricted && !IsAMemberOf(tt, *cid, SYSADMINID)) {
+        ABORT_WITH(tt, PRPERM);
+    }
+
     /* Delete each continuation block as a separate transaction so that no one
      * transaction become to large to complete. */
     nptr = tentry.next;