Ticket #47308 - unintended information exposure when anonymous access is set to rootdse

Bug description: The actual search base was not being checked
at all.  There was a check for the search base when this feature
was initially implemented, but it was inadvertently removed when
changes were made to reduce the DN normalization throughout the
source tree (commit f6397113666f06848412bb12f754f04258cfa5fa).

Fix description: This patch adds the search base check back.

Note: CVE-2013-1897

https://fedorahosted.org/389/ticket/47308

Reviewed by Rich, Noriko and Mark.

ldap/servers/slapd/search.c

@@ -141,7 +141,7 @@ do_search( Slapi_PBlock *pb )
 	/* If anonymous access is only allowed for searching the root DSE,
 	 * we need to reject any other anonymous search attempts. */
 	if ((slapi_sdn_get_dn(&(operation->o_sdn)) == NULL) &&
-	    (scope != LDAP_SCOPE_BASE) &&
+	    ((rawbase && strlen(rawbase) > 0) || (scope != LDAP_SCOPE_BASE)) &&
 	    (config_get_anon_access_switch() == SLAPD_ANON_ACCESS_ROOTDSE)) {
 		op_shared_log_error_access(pb, "SRCH", rawbase?rawbase:"",
 		                           "anonymous search not allowed");