Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DynamicSecurity] modifyGroup command does not validate against clients #2598

Closed
sszczep opened this issue Jul 23, 2022 · 3 comments
Closed
Labels
Component: mosquitto-broker Status: Completed Nothing further to be done with this issue, it can be closed by the requestor or committer. Type: Bug
Milestone

Comments

@sszczep
Copy link

sszczep commented Jul 23, 2022

Consider following message on $CONTROL MQTT topic:

{
  "commands": [
    {
      "groupname": "groupName",
      "roles": [
        {
          "rolename": "roleName"
        }
      ],
      "clients": [
        {
          "username": "userName"
        }
      ],
      "command": "modifyGroup"
    }
  ]
}

If the role does not exist, it will result in error stating Role not found, however, the same does not apply to the nonexistent client - the command goes through successfully and results in empty clients group in database file.

I truly believe it is a mistake and should throw error in such case.

Using latest eclipse-mosquitto docker image running on Apple M1.

@ralight
Copy link
Contributor

ralight commented Aug 6, 2022

Thank you, yes, the modify commands need some work to ensure that if there is an error the thing they are modifying remains unchanged.

@ralight ralight added Type: Enhancement A new feature for a minor or major release. Component: mosquitto-broker labels Aug 6, 2022
@sszczep
Copy link
Author

sszczep commented Aug 6, 2022

Do you want me to take a look at it? If it's a small change and you already know how to fix it, it would be great as I wouldn't need to deep dive into the source code. Please let me know.

@ralight
Copy link
Contributor

ralight commented Aug 15, 2022

Thank you for the offer. It wasn't a trivial change, otherwise I would have just done it then. I've made the change now, and for the modifyClient command.

@ralight ralight added Type: Bug Status: Completed Nothing further to be done with this issue, it can be closed by the requestor or committer. and removed Type: Enhancement A new feature for a minor or major release. labels Aug 15, 2022
@ralight ralight added this to the 2.0.15 milestone Aug 15, 2022
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 20, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Component: mosquitto-broker Status: Completed Nothing further to be done with this issue, it can be closed by the requestor or committer. Type: Bug
Projects
None yet
Development

No branches or pull requests

2 participants