bareos: bareos-15.2 95e12931
| Author | Committer | Branch | Timestamp | Parent | |
|---|---|---|---|---|---|
| mvwieringen | mvwieringen | bareos-15.2 | 2016-09-01 19:06 | bareos-15.2 f0ea06f2 | Pending |
| Changeset | bcommand: BVFS should check for ACLs. BVFS has pretty bad ideas on security it allows the end user to specify any set of JobIds without checking ACLs next to that is allows you to specify any client without checking access and it also allows filesets to be browsed that may not be part of your ACLs. This patch tries to make things more secure by filtering the JobIds you can supply to the commands and which are returned by making sure that the JobName and ClientName used by the Job are within your ACLs. User input on clients and filesets is also validated against the proper ACLs. |
||||
| mod - src/dird/ua_dotcmds.c | Diff File | ||||
