MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-07-08 08:32:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

Check if user or group is disabled when evaluating policy (#8078)

Browse Source
This commit is contained in:
Aditya Manthramurthy 2019-08-14 16:59:16 -07:00 committed by Harshavardhana
parent cebeca3075
commit 825e29f301
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
cmd/iam.go
View File

@ -945,8 +945,14 @@ func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) {
return []string{policy.Policy}, nil return []string{policy.Policy}, nil
} }
if _, ok := sys.iamUsersMap[name]; !ok { // When looking for a user's policies, we also check if the
// user and the groups they are member of are enabled.
if u, ok := sys.iamUsersMap[name]; !ok {
return nil, errNoSuchUser return nil, errNoSuchUser
} else if u.Status == statusDisabled {
// User is disabled, so we return no policy - this
// ensures the request is denied.
return nil, nil
} }
result := []string{} result := []string{}
@ -956,6 +962,12 @@ func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) {
result = append(result, policy.Policy) result = append(result, policy.Policy)
} }
for _, group := range sys.iamUserGroupMemberships[name].ToSlice() { for _, group := range sys.iamUserGroupMemberships[name].ToSlice() {
// Skip missing or disabled groups
gi, ok := sys.iamGroupsMap[group]
if !ok || gi.Status == statusDisabled {
continue
}
p, ok := sys.iamGroupPolicyMap[group] p, ok := sys.iamGroupPolicyMap[group]
if ok && p.Policy != "" { if ok && p.Policy != "" {
result = append(result, p.Policy) result = append(result, p.Policy)