Merge pull request #763 from alaaeddineelamri/dev/alaaeddineelamri/ma…

…ster/acl-messages-command

Fix CommandACL bug that prevents messages to be seen

CHANGELOG.md

@@ -21,6 +21,7 @@ and since Bareos version 20 this project adheres to [Semantic Versioning](https:
 - fix volume-pruning to be reliable on all test platforms [PR #761]
 - fix memory leak in python module constants [PR #778]
 - fix systemtests: reduce the number of broken tests to two [PR #771]
+- [Issue #1329]: If CommandACL limits any command, no messages can be read but "you have messages" is displayed. [PR #763]
 
 ### Added
 - systemtests for S3 functionalities (droplet, libcloud) now use https [PR #765]

core/src/dird/ua_output.cc

@@ -3,7 +3,7 @@
 
    Copyright (C) 2000-2012 Free Software Foundation Europe e.V.
    Copyright (C) 2011-2016 Planets Communications B.V.
-   Copyright (C) 2013-2020 Bareos GmbH & Co. KG
+   Copyright (C) 2013-2021 Bareos GmbH & Co. KG
 
    This program is Free Software; you can redistribute it and/or
    modify it under the terms of version three of the GNU Affero General Public
@@ -1498,7 +1498,7 @@ void DoMessages(UaContext* ua, const char* cmd)
 
 bool DotMessagesCmd(UaContext* ua, const char* cmd)
 {
-  if (console_msg_pending && ua->AclNoRestrictions(Command_ACL)
+  if (console_msg_pending && ua->AclAccessOk(Command_ACL, cmd)
       && ua->auto_display_messages) {
     DoMessages(ua, cmd);
   }
@@ -1507,7 +1507,7 @@ bool DotMessagesCmd(UaContext* ua, const char* cmd)
 
 bool MessagesCmd(UaContext* ua, const char* cmd)
 {
-  if (console_msg_pending && ua->AclNoRestrictions(Command_ACL)) {
+  if (console_msg_pending && ua->AclAccessOk(Command_ACL, cmd)) {
     DoMessages(ua, cmd);
   } else {
     ua->send->Decoration(_("You have no messages.\n"));

systemtests/tests/bareos-acl/etc/bareos/bareos-dir.d/console/bareos-acl-none.conf.in

@@ -0,0 +1,4 @@
+Console {
+  Name = bareos-acl-none
+  Password = "@dir_password@"
+}

systemtests/tests/bareos-acl/etc/bareos/bareos-dir.d/console/bareos-acl-restricted.conf.in

@@ -0,0 +1,14 @@
+Console {
+  Name = bareos-acl-restricted
+  Description = "Restricted console."
+  Password = "@dir_password@"
+  CommandACL = restore, cancel, enable, disable, estimate, exit, gui, help, list, llist, messages, memory, quit, release, reload, rerun, restore, run, show, status, time, version, wait, whoami
+  Job ACL = *all*
+  Schedule ACL = all
+  Catalog ACL = all
+  Pool ACL = all
+  Storage ACL = all
+  Client ACL = all
+  FileSet ACL = all
+  Where ACL = all
+}

systemtests/tests/bareos-acl/etc/bareos/bareos-dir.d/console/bareos-acl-status-conf.conf.in

@@ -0,0 +1,5 @@
+Console {
+  Name = bareos-acl-status-conf
+  Password = "@dir_password@"
+  CommandACL = status, .status, configure
+}

systemtests/tests/bareos-acl/etc/bareos/bareos-dir.d/console/bareos-acl-status.conf.in

@@ -0,0 +1,5 @@
+Console {
+  Name = bareos-acl-status
+  Password = "@dir_password@"
+  CommandACL = status, .status
+}

systemtests/tests/bareos-acl/etc/bareos/bareos-dir.d/console/bareos-mon.conf.in

@@ -1,6 +1,5 @@
 Console {
   Name = bareos-mon
-  Description = "Restricted console used by tray-monitor to get the status of the director."
   Password = "@mon_dir_password@"
   CommandACL = status, .status
   JobACL = *all*

systemtests/tests/bareos-acl/etc/bareos/bconsole-acl-restricted.conf.in

@@ -0,0 +1,16 @@
+#
+# Bareos User Agent (or Console) Configuration File
+#
+
+Director {
+  Name = @basename@-dir
+  DIRport = @dir_port@
+  Password = "@dir_password@"
+  Address = @hostname@
+}
+
+Console {
+  Name = bareos-acl-restricted
+  Password = "@dir_password@"
+  Director = @basename@-dir
+}