Properly set and preserve rule ordering https://sourceforge.net/tracker/?func=detail&atid=117457&aid=3540909&group_id=17457

ldap-server/acl_form.cgi

@@ -10,11 +10,13 @@ $access{'acl'} || &error($text{'acl_ecannot'});
 if (&get_config_type() == 1) {
 	$conf = &get_config();
 	@access = &find("access", $conf);
+	$hasorder = 0;
 	}
 else {
 	$defdb = &get_default_db();
 	$conf = &get_ldif_config();
 	@access = &find_ldif("olcAccess", $conf, $defdb);
+	$hasorder = 1;
 	}
 
 # Page header
@@ -35,6 +37,12 @@ print &ui_hidden("new", $in{'new'});
 print &ui_hidden("idx", $in{'idx'});
 print &ui_table_start($text{'eacl_header'}, undef, 2);
 
+# Rule ordering
+if ($hasorder && !$in{'new'}) {
+	print &ui_table_row($text{'eacl_order'},
+		$p->{'order'} eq '' ? $text{'eacl_noorder'} : $p->{'order'});
+	}
+
 # Granting to what object
 $what = $p->{'what'} eq '*' || $p->{'what'} eq '' ? 1 : 0;
 if ($p->{'what'} =~ /^dn(\.([^=]+))?="(.*)"$/i ||

ldap-server/acl_save.cgi

@@ -12,11 +12,13 @@ $access{'acl'} || &error($text{'acl_ecannot'});
 if (&get_config_type() == 1) {
 	$conf = &get_config();
 	@access = &find("access", $conf);
+	$hasorder = 0;
 	}
 else {
 	$defdb = &get_default_db();
 	$conf = &get_ldif_config();
 	@access = &find_ldif("olcAccess", $conf, $defdb);
+	$hasorder = 1;
 	}
 
 # Get the ACL object
@@ -90,6 +92,18 @@ else {
 		}
 	$p->{'by'} = \@by;
 
+	# Set order to end of list, if we are using orders
+	if ($hasorder && $in{'new'}) {
+		$maxorder = -1;
+		foreach $oa (@access) {
+			$op = &parse_ldap_access($oa);
+			if ($op->{'order'} > $maxorder) {
+				$maxorder = $op->{'order'};
+				}
+			}
+		$p->{'order'} = $maxorder + 1;
+		}
+
 	# Add to access directive list
 	if ($in{'new'}) {
 		$acl = { 'name' => 'access',

ldap-server/edit_acl.cgi

@@ -10,11 +10,17 @@ $access{'acl'} || &error($text{'acl_ecannot'});
 if (&get_config_type() == 1) {
 	$conf = &get_config();
 	@access = &find("access", $conf);
+	$hasorder = 0;
 	}
 else {
 	$defdb = &get_default_db();
 	$conf = &get_ldif_config();
 	@access = &find_ldif("olcAccess", $conf, $defdb);
+	@access = sort { 
+		$pa = &parse_ldap_access($a);
+		$pb = &parse_ldap_access($b);
+		$pa->{'order'} <=> $pb->{'order'} } @access;
+	$hasorder = 1;
 	}
 
 @crlinks = ( "<a href='acl_form.cgi?new=1'>$text{'acl_add'}</a>" );
@@ -24,8 +30,11 @@ if (@access) {
 	@links = ( &select_all_link("d"), &select_invert_link("d"), @crlinks );
 	print &ui_links_row(\@links);
 	@tds = ( "width=5", "width=30%", "width=65%", "width=5%" );
-	print &ui_columns_start([ "", $text{'acl_what'},
-				  $text{'acl_who'}, $text{'acl_move'} ],
+	print &ui_columns_start([ "",
+				  $text{'acl_what'},
+				  $text{'acl_who'},
+				  $hasorder ? ( $text{'acl_order'} ) : ( ),
+				  $text{'acl_move'} ],
 				100, 0, \@tds);
 	$i = 0;
 	foreach $a (@access) {
@@ -38,6 +47,7 @@ if (@access) {
 		print &ui_checked_columns_row([
 			"<a href='acl_form.cgi?idx=$i'>$p->{'whatdesc'}</a>",
 			$p->{'bydesc'},
+			$hasorder ? ( $p->{'order'} ) : ( ),
 			$mover,
 			], \@tds, "d", $i);
 		$i++;

ldap-server/lang/en

@@ -100,6 +100,7 @@ schema_ecannot=You are not allowed to manage the LDAP schema
 acl_title=LDAP Access Control
 acl_ecannot=You are not allowed to configure LDAP access control
 acl_what=Objects
+acl_order=Order
 acl_who=Access granted
 acl_move=Move
 acl_none=No access control rules have been defined yet. All objects in the LDAP database will be readable by all users.
@@ -322,4 +323,7 @@ eacl_efilter=Missing or invalid filter - should be like <tt>(objectClass=posixAc
 eacl_eattrs=Missing or invalid comma-separated list of attributes
 eacl_ewho=Missing or invalid-looking DN in row $1
 eacl_eaccess=Missing or invalid access level in row $1
+eacl_order=Rule order
+eacl_noorder=None set
+
 __norefs=1