mirrors/mumble
2
0
Fork 0
mirror of https://github.com/mumble-voip/mumble.git synced 2025-10-26 11:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

FIX(server): Add ACL cache invalidation after user id is set

Browse Source 
The ACL for group 'auth' depends on the user (db) id.
Previously, code paths using checks for 'auth' ACLs in msgAuthenticate
would not work correctly, because the ACL cache still contained
a state where the id was not set.

This commit adds cache invalidation after the user id is set, allowing
to correctly apply the 'auth' ACL in later parts of msgAuthenticate.
It also overhauls the general control flow regarding tokens and ACL
cache.

Fixes #5907
This commit is contained in:
Hartmnt 2023-01-25 20:23:26 +00:00
parent e0bc60086d
commit 635d71960f
1 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/murmur/Messages.cpp
View File

@ -165,14 +165,19 @@ bool isChannelEnterRestricted(Channel *c) {
void Server::msgAuthenticate(ServerUser *uSource, MumbleProto::Authenticate &msg) {
ZoneScoped;
if ((msg.tokens_size() > 0) || (uSource->sState == ServerUser::Authenticated)) {
if (uSource->sState == ServerUser::Authenticated && (msg.tokens_size() > 0 || !uSource->qslAccessTokens.empty())) {
// Process a change in access tokens for already authenticated users
QStringList qsl;
for (int i = 0; i < msg.tokens_size(); ++i)
for (int i = 0; i < msg.tokens_size(); ++i) {
qsl << u8(msg.tokens(i));
}
{
QMutexLocker qml(&qmCache);
uSource->qslAccessTokens = qsl;
}
clearACLCache(uSource);
// Send back updated enter states of all channels
@ -216,6 +221,28 @@ void Server::msgAuthenticate(ServerUser *uSource, MumbleProto::Authenticate &msg
uSource->iId = id >= 0 ? id : -1;
if (uSource->iId >= 0) {
if (msg.tokens_size() > 0) {
// Set the access tokens for the newly connected user
QStringList qsl;
for (int i = 0; i < msg.tokens_size(); ++i) {
qsl << u8(msg.tokens(i));
}
{
QMutexLocker qml(&qmCache);
uSource->qslAccessTokens = qsl;
}
}
// Clear cache as the "auth" ACL depends on the user id
// and any cached ACL won't have taken that into account yet
// Also, if we set access tokens above, we have to reset
// the ACL cache anyway.
clearACLCache(uSource);
}
QString reason;
MumbleProto::Reject_RejectType rtType = MumbleProto::Reject_RejectType_None;