fluencelabs/redis
1
0
Fork 0
mirror of https://github.com/fluencelabs/redis synced 2025-04-03 00:01:04 +00:00
Code Issues Projects Releases Wiki Activity

ACL: enforce ACLs in Lua scripts as well.

Browse Source
This commit is contained in:
antirez 2019-01-29 10:12:22 +01:00
parent acd168a70b
commit 4380423d40
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/scripting.c
View File

@ -460,6 +460,7 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
/* Setup our fake client for command execution */ /* Setup our fake client for command execution */
c->argv = argv; c->argv = argv;
c->argc = argc; c->argc = argc;
c->user = server.lua_caller->user;
/* Log the command if debugging is active. */ /* Log the command if debugging is active. */
if (ldb.active && ldb.step) { if (ldb.active && ldb.step) {
@ -497,6 +498,19 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
goto cleanup; goto cleanup;
} }
/* Check the ACLs. */
int acl_retval = ACLCheckCommandPerm(c);
if (acl_retval != ACL_OK) {
if (acl_retval == ACL_DENIED_CMD)
luaPushError(lua, "The user executing the script can't run this "
"command or subcommand");
else
luaPushError(lua, "The user executing the script can't access "
"at least one of the keys mentioned in the "
"command arguments");
goto cleanup;
}
/* Write commands are forbidden against read-only slaves, or if a /* Write commands are forbidden against read-only slaves, or if a
* command marked as non-deterministic was already called in the context * command marked as non-deterministic was already called in the context
* of this script. */ * of this script. */
@ -655,6 +669,8 @@ cleanup:
argv_size = 0; argv_size = 0;
} }
c->user = NULL;
if (raise_error) { if (raise_error) {
/* If we are here we should have an error in the stack, in the /* If we are here we should have an error in the stack, in the
* form of a table with an "err" field. Extract the string to * form of a table with an "err" field. Extract the string to