Don't do stupid things like use a dn as a pattern

Also add metadata fields in objects created on initialization

1 files changed, 8 insertions, 2 deletions

diff --git a/acl.go b/acl.go
index 483e8fd..ec6e4de 100644
--- a/acl.go
+++ b/acl.go
@@ -87,8 +87,14 @@ func (entry *ACLEntry) Check(login *Login, action string, target string, attribu
 		}
 	}
 
-	rule_target_with_self := strings.ReplaceAll(entry.target, "SELF", login.user)
-	if !match(rule_target_with_self, target) {
+	matchTarget := match(entry.target, target)
+	if !matchTarget && len(target) >= len(login.user) {
+		start := len(target) - len(login.user)
+		if target[start:] == login.user {
+			matchTarget = match(entry.target, target[:start]+"SELF")
+		}
+	}
+	if !matchTarget {
 		return false
 	}