Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
2127f7c8
"vscode:/vscode.git/clone" did not exist on "fe5da2e60d8d6d907062f4789673fbe06fa8773e"
Unverified
Commit
2127f7c8
authored
Oct 07, 2020
by
Madelyn Olson
Committed by
GitHub
Oct 07, 2020
Browse files
Fixed excessive categories being displayed from acls (#7889)
parent
f659d236
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/acl.c
View file @
2127f7c8
...
...
@@ -478,17 +478,30 @@ sds ACLDescribeUserCommandRules(user *u) {
/* Try to add or subtract each category one after the other. Often a
* single category will not perfectly match the set of commands into
* it, so at the end we do a final pass adding/removing the single commands
* needed to make the bitmap exactly match. */
* needed to make the bitmap exactly match. A temp user is maintained to
* keep track of categories already applied. */
user
tu
=
{
0
};
user
*
tempuser
=
&
tu
;
memcpy
(
tempuser
->
allowed_commands
,
u
->
allowed_commands
,
sizeof
(
u
->
allowed_commands
));
for
(
int
j
=
0
;
ACLCommandCategories
[
j
].
flag
!=
0
;
j
++
)
{
unsigned
long
on
,
off
;
ACLCountCategoryBitsForUser
(
u
,
&
on
,
&
off
,
ACLCommandCategories
[
j
].
name
);
ACLCountCategoryBitsForUser
(
tempuser
,
&
on
,
&
off
,
ACLCommandCategories
[
j
].
name
);
if
((
additive
&&
on
>
off
)
||
(
!
additive
&&
off
>
on
))
{
sds
op
=
sdsnewlen
(
additive
?
"+@"
:
"-@"
,
2
);
op
=
sdscat
(
op
,
ACLCommandCategories
[
j
].
name
);
ACLSetUser
(
fakeuser
,
op
,
-
1
);
sds
invop
=
sdsnewlen
(
additive
?
"-@"
:
"+@"
,
2
);
invop
=
sdscat
(
invop
,
ACLCommandCategories
[
j
].
name
);
ACLSetUser
(
tempuser
,
invop
,
-
1
);
rules
=
sdscatsds
(
rules
,
op
);
rules
=
sdscatlen
(
rules
,
" "
,
1
);
sdsfree
(
op
);
sdsfree
(
invop
);
}
}
...
...
tests/unit/acl.tcl
View file @
2127f7c8
...
...
@@ -135,6 +135,20 @@ start_server {tags {"acl"}} {
assert_match
{
*+acl*
}
$cmdstr
}
# A regression test make sure that as long as there is a simple
# category defining the commands, that it will be used as is.
test
{
ACL GETUSER provides reasonable results
}
{
# Test for future commands where allowed
r ACL setuser additive reset +@all -@write
set cmdstr
[
dict get
[
r ACL getuser additive
]
commands
]
assert_match
{
+@all -@write
}
$cmdstr
# Test for future commands are disallowed
r ACL setuser subtractive reset -@all +@read
set cmdstr
[
dict get
[
r ACL getuser subtractive
]
commands
]
assert_match
{
-@all +@read
}
$cmdstr
}
test
{
ACL #5998 regression: memory leaks adding / removing subcommands
}
{
r AUTH default
""
r ACL setuser newuser reset -debug +debug|a +debug|b +debug|c
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment