tyler.durden
/
icingaweb2
mirror of https://github.com/Icinga/icingaweb2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix the permission wildcards assertion 

fixes #9202
This commit is contained in:
Alexander Fuhr 2015-05-05 12:36:26 +02:00
parent 993cb31572
commit 612fefba9c
2 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
library/Icinga/User.php
View File

@ -413,30 +413,30 @@ class User
/** /**
* Whether the user has a given permission * Whether the user has a given permission
* *
* @param string $permission * @param string $requiredPermission
* *
* @return bool * @return bool
*/ */
public function can($permission) public function can($requiredPermission)
{ {
if (isset($this->permissions['*']) || isset($this->permissions[$permission])) { if (isset($this->permissions['*']) || isset($this->permissions[$requiredPermission])) {
return true; return true;
} }
// If the permission to check contains a wildcard, grant the permission if any permit related to the permission // If the permission to check contains a wildcard, grant the permission if any permit related to the permission
// matches // matches
$any = strpos($permission, '*'); $any = strpos($requiredPermission, '*');
foreach ($this->permissions as $permitted) { foreach ($this->permissions as $grantedPermission) {
if ($any !== false) { if ($any !== false && strpos($grantedPermission, '*') === false) {
$wildcard = $any; $wildcard = $any;
} else { } else {
// If the permit contains a wildcard, grant the permission if it's related to the permit // If the permit contains a wildcard, grant the permission if it's related to the permit
$wildcard = strpos($permitted, '*'); $wildcard = strpos($grantedPermission, '*');
} }
if ($wildcard !== false) { if ($wildcard !== false) {
if (substr($permission, 0, $wildcard) === substr($permitted, 0, $wildcard)) { if (substr($requiredPermission, 0, $wildcard) === substr($grantedPermission, 0, $wildcard)) {
return true; return true;
} }
} elseif ($permission === $permitted) { } elseif ($requiredPermission === $grantedPermission) {
return true; return true;
} }
} }

6
test/php/library/Icinga/UserTest.php
View File

@ -66,12 +66,16 @@ class UserTest extends BaseTestCase
$user->setPermissions(array( $user->setPermissions(array(
'test', 'test',
'test/some/specific', 'test/some/specific',
'test/more/*' 'test/more/*',
'test/wildcard-with-wildcard/*'
)); ));
$this->assertTrue($user->can('test')); $this->assertTrue($user->can('test'));
$this->assertTrue($user->can('test/some/specific')); $this->assertTrue($user->can('test/some/specific'));
$this->assertTrue($user->can('test/more/everything')); $this->assertTrue($user->can('test/more/everything'));
$this->assertTrue($user->can('test/wildcard-with-wildcard/*'));
$this->assertTrue($user->can('test/wildcard/sub/sub'));
$this->assertFalse($user->can('not/test')); $this->assertFalse($user->can('not/test'));
$this->assertFalse($user->can('test/some/not/so/specific')); $this->assertFalse($user->can('test/some/not/so/specific'));
$this->assertFalse($user->can('test/wildcard2/*'));
} }
} }