Closed korydraughn closed 2 years ago
alanking
commented
2 years ago Just for my own understanding... the privilege check for switching users is not needed here because it will be caught at a different level if it's not allowed to happen? What happens if a user which is not allowed to switch to some other user attempts to do so (or rather, the machinery tries to make that happen here, whether it was intended or not)?
korydraughn
commented
2 years ago Yes. The privilege check is simply being moved closer to where it matters. It is too deep right now.
What happens if a user which is not allowed to switch to some other user attempts to do so (or rather, the machinery tries to make that happen here, whether it was intended or not)?
The idea is that non-admin users aren't allowed to invoke logical quotas rules via irule. However, they are allowed to execute these rules if they are triggered indirectly. That means, if the admin wrote policy that calls a logical quotas rule, it is okay.
alanking
commented
2 years ago Ah, okay. Got it. Thanks!
korydraughn
commented
2 years ago Waiting to hear back from Sanju Timsina.
See https://groups.google.com/g/irod-chat/c/7oK-pAbBr5Q/m/yu6ZPsG-AwAJ
korydraughn
commented
2 years ago Sanju has confirmed that the changes have resolved this issue.
[x] 4-2-stable
Bug Report
The block of code below is called in several of the PEP handlers, if not all of them. If the user is not a rodsadmin, this will produce an error and block operations due to line 361. Ultimately, the check should be moved into a different location. PEP handlers should never be blocked at this level. https://github.com/irods/irods_rule_engine_plugin_logical_quotas/blob/52e473ca2a174b7d5dd7f87c09ecb181a37d0f22/src/handler.cpp#L358-L367