Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
4380423d
Commit
4380423d
authored
Jan 29, 2019
by
antirez
Browse files
ACL: enforce ACLs in Lua scripts as well.
parent
acd168a7
Changes
1
Hide whitespace changes
Inline
Side-by-side
src/scripting.c
View file @
4380423d
...
@@ -460,6 +460,7 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
...
@@ -460,6 +460,7 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
/* Setup our fake client for command execution */
/* Setup our fake client for command execution */
c
->
argv
=
argv
;
c
->
argv
=
argv
;
c
->
argc
=
argc
;
c
->
argc
=
argc
;
c
->
user
=
server
.
lua_caller
->
user
;
/* Log the command if debugging is active. */
/* Log the command if debugging is active. */
if
(
ldb
.
active
&&
ldb
.
step
)
{
if
(
ldb
.
active
&&
ldb
.
step
)
{
...
@@ -497,6 +498,19 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
...
@@ -497,6 +498,19 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
goto
cleanup
;
goto
cleanup
;
}
}
/* Check the ACLs. */
int
acl_retval
=
ACLCheckCommandPerm
(
c
);
if
(
acl_retval
!=
ACL_OK
)
{
if
(
acl_retval
==
ACL_DENIED_CMD
)
luaPushError
(
lua
,
"The user executing the script can't run this "
"command or subcommand"
);
else
luaPushError
(
lua
,
"The user executing the script can't access "
"at least one of the keys mentioned in the "
"command arguments"
);
goto
cleanup
;
}
/* Write commands are forbidden against read-only slaves, or if a
/* Write commands are forbidden against read-only slaves, or if a
* command marked as non-deterministic was already called in the context
* command marked as non-deterministic was already called in the context
* of this script. */
* of this script. */
...
@@ -655,6 +669,8 @@ cleanup:
...
@@ -655,6 +669,8 @@ cleanup:
argv_size
=
0
;
argv_size
=
0
;
}
}
c
->
user
=
NULL
;
if
(
raise_error
)
{
if
(
raise_error
)
{
/* If we are here we should have an error in the stack, in the
/* If we are here we should have an error in the stack, in the
* form of a table with an "err" field. Extract the string to
* form of a table with an "err" field. Extract the string to
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment