From 7a3d1487e443c3cb5fde3605aebea20698a940b4 Mon Sep 17 00:00:00 2001 From: Harkrishn Patro <30795839+hpatro@users.noreply.github.com> Date: Mon, 19 Apr 2021 12:27:44 +0200 Subject: ACL channels permission handling for save/load scenario. (#8794) In the initial release of Redis 6.2 setting a user to only allow pubsub access to a specific channel, and doing ACL SAVE, resulted in an assertion when ACL LOAD was used. This was later changed by #8723 (not yet released), but still not properly resolved (now it errors instead of crash). The problem is that the server that generates an ACL file, doesn't know what would be the setting of the acl-pubsub-default config in the server that will load it. so ACL SAVE needs to always start with resetchannels directive. This should still be compatible with old acl files (from redis 6.0), and ones from earlier versions of 6.2 that didn't mess with channels. Co-authored-by: Harkrishn Patro Co-authored-by: Oran Agra --- src/acl.c | 1 + 1 file changed, 1 insertion(+) (limited to 'src/acl.c') diff --git a/src/acl.c b/src/acl.c index 6f8ab4055..6a2ade646 100644 --- a/src/acl.c +++ b/src/acl.c @@ -652,6 +652,7 @@ sds ACLDescribeUser(user *u) { if (u->flags & USER_FLAG_ALLCHANNELS) { res = sdscatlen(res,"&* ",3); } else { + res = sdscatlen(res,"resetchannels ",14); listRewind(u->channels,&li); while((ln = listNext(&li))) { sds thispat = listNodeValue(ln); -- cgit v1.2.1