From: Jeffrey Altman <jaltman@your-file-system.com>
Date: Thu, 22 Dec 2011 02:37:41 +0000 (-0500)
Subject: Windows: AFSRetrieveValidAuthGroup FILE_READ_DATA
X-Git-Tag: upstream/1.8.0_pre1^2~2912
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=68b10efa7dbabbedbb95928dccac29ed8d4179c4;p=packages%2Fo%2Fopenafs.git

Windows: AFSRetrieveValidAuthGroup FILE_READ_DATA

Only an AuthGroup belonging to a Context Control Block that was
granted the FILE_READ_DATA permission is capable of reading
data from the file server.

Change-Id: I93a7d8e65a6bc87b44399a30da5c0dd7d4e07685
Reviewed-on: http://gerrit.openafs.org/6398
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Peter Scott <pscott@kerneldrivers.com>
Reviewed-by: Jeffrey Altman <jaltman@secure-endpoints.com>
Tested-by: Jeffrey Altman <jaltman@secure-endpoints.com>
---

diff --git a/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp b/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp
index f6f973f8f..f0376646f 100644
--- a/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp
+++ b/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp
@@ -8458,7 +8458,7 @@ AFSRetrieveValidAuthGroup( IN AFSFcb *Fcb,
 
                     break;
                 }
-                else if( pCcb->GrantedAccess != 0)
+                else if( pCcb->GrantedAccess & FILE_READ_DATA)
                 {
                     //
                     // At least get the read-only access