[Samba] Anyone can create empty files (v 3.5.11)

[Dan Carpenter]

I've mounted my cifs partition with a username and password and to
test whether I had my permissions right, I did:

$ sudo su testuser
$ touch asdf
touch: cannot touch `asdf': Permission denied
$

It says permission denied, but the `asdf' file is still created.  I
can't write any data to it, but I can create empty files.

This is because in smbd/open.c if the file doesn't exist and O_CREAT
flag is set then it lets you open the file without checking
smbd_check_open_rights().

Or am I doing something wrong?  I'm using Debian testing (wheezy).

regards,
dan carpenter