[1992] in Moira
proxy authentication fix
daemon@ATHENA.MIT.EDU (Garry Zacheiss)
Tue Sep 24 18:54:50 2002
Message-Id: <200209242254.SAA27948@brad-majors.mit.edu>
To: moiradev@MIT.EDU
Date: Tue, 24 Sep 2002 18:54:49 -0400
From: Garry Zacheiss <zacheiss@MIT.EDU>
This fixes what I consider a bug in the proxy authentication
code; it never checks if the capacl for a query is "default", such that
it's possible to stop being able to run some queries (get_container,
get_machine_cluster_mapping) if you proxy authenticate, but if you
connect without authenticating, you can run them. This change makes
queries with a capacl of "default" special.
Index: qrtn.pc
===================================================================
RCS file: /afs/athena.mit.edu/astaff/project/moiradev/repository/moira/server/qrtn.pc,v
retrieving revision 2.26
diff -u -r2.26 qrtn.pc
--- qrtn.pc 2002/08/02 10:30:08 2.26
+++ qrtn.pc 2002/09/24 22:45:01
@@ -564,15 +564,14 @@
return MR_BAD_CHAR;
}
- /* check initial query access, unless we're acting as a proxy */
- if (!cl->proxy_id)
- {
- status = check_query_access(q, Argv, cl);
- if (status != MR_SUCCESS && status != MR_PERM)
- return status;
- if (status == MR_SUCCESS)
- privileged++;
- }
+ /* Check initial query access. If we're acting as a proxy, only allow
+ * access if the query has "default" as a capacl.
+ */
+ status = check_query_access(q, Argv, cl);
+ if (status != MR_SUCCESS && status != MR_PERM)
+ return status;
+ if (status == MR_SUCCESS && (!cl->proxy_id || q->everybody))
+ privileged++;
/* validate arguments */
if (v && v->valobj)
