• Huang Zhw's avatar
    Fix "default" and overwritten / reset users will not have pubsub channels... · 3b74b550
    Huang Zhw authored
    Fix "default" and overwritten / reset users will not have pubsub channels permissions by default. (#8723)
    
    Background:
    Redis 6.2 added ACL control for pubsub channels (#7993), which were supposed
    to be permissive by default to retain compatibility with redis 6.0 ACL. 
    But due to a bug, only newly created users got this `acl-pubsub-default` applied,
    while overwritten (updated) users got reset to `resetchannels` (denied).
    
    Since the "default" user exists before loading the config file,
    any ACL change to it, results in an update / overwrite.
    
    So when a "default" user is loaded from config file or include ACL
    file with no channels related rules, the user will not have any
    permissions to any channels. But other users will have default
    permissions to any channels.
    
    When upgraded from 6.0 with config rewrite, this will lead to
    "default" user channels permissions lost.
    When users are loaded from include file, then call "acl load", users
    will also lost channels permissions.
    
    Similarly, the `reset` ACL rule, would have reset the user to be denied
    access to any channels, ignoring `acl-pubsub-default` and breaking
    compatibility with redis 6.0.
    
    The implication of this fix is that it regains compatibility with redis 6.0,
    but breaks compatibility with redis 6.2.0 and 2.0.1. e.g. after the upgrade,
    the default user will regain access to pubsub channels.
    
    Other changes:
    Additionally this commit rename server.acl_pubusub_default to
    server.acl_pubsub_default and fix typo in acl tests.
    3b74b550
acl.c 87.3 KB