• Madelyn Olson's avatar
    Fixed a bug where sequential matching ACL rules weren't compressed (#12472) · 7c179f9b
    Madelyn Olson authored
    When adding a new ACL rule was added, an attempt was made to remove
    any "overlapping" rules. However, there when a match was found, the search
    was not resumed at the right location, but instead after the original position of
    the original command.
    
    For example, if the current rules were `-config +config|get` and a rule `+config`
    was added. It would identify that `-config` was matched, but it would skip over
    `+config|get`, leaving the compacted rule `-config +config`. This would be evaluated
    safely, but looks weird.
    
    This bug can only be triggered with subcommands, since that is the only way to
    have sequential matching rules. Resolves #12470. This is also only present in 7.2.
    I think there was also a minor risk of removing another valid rule, since it would start
    the search of the next command at an arbitrary point. I couldn't find a valid offset that
    would have cause a match using any of the existing commands that have subcommands
    with another command. 
    7c179f9b
acl.c 121 KB