michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-10-20 03:00:38 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Fix privileged RPC username conversion checks

Browse Source 
Original fix 616547c26f protected normal user creation, but conversion could still create `root`, `admin`, or `sysadm`.

Similarly, conversion now alost skips these usernames unless the admin can edit ACLs.
This commit is contained in:
Ilia Ross
2026-10-13 14:31:33 +02:00
parent 5e4b937410
commit 045c7abfdf
2 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
acl/convert.cgi
View File

@@ -108,7 +108,11 @@ foreach my $u (@users) {
$msg = "<i>".&text('convert_exists', $u->{'user'})."</i>";
$exists++;
}
elsif ($u->{'user'} !~ /^[A-z0-9\-\_\.]+$/) {
elsif ($u->{'user'} !~ /^[A-z0-9\-\_\.]+$/ ||
(!$access{'acl'} &&
$u->{'user'} =~ /^(root|admin|sysadm)$/)) {
# Reject invalid names and privileged RPC names that this
# administrator is not allowed to create.
$msg = "<i>".&text('convert_invalid', $u->{'user'})."</i>";
$invalid++;
}

34
acl/t/run-tests.t
View File

@@ -1474,6 +1474,40 @@ subtest 'save_user.cgi create privilege' => sub {
delete_user('admin');
};
# Unix conversion must not bypass the privileged-name guard in save_user.cgi.
# An ACL-capable administrator can still deliberately convert such a user.
subtest 'convert.cgi privileged username gate' => sub {
_reset_fixture();
_seed_user_acl('operator', {
sync => 1, create => 1, acl => 0, gassign => '*',
});
create_group({ name => 'converted', members => [], modules => ['acl'] });
my $r = run_cgi('convert.cgi', {
conv => 1, users => 'root', wgroup => 'converted', sync => 1,
}, user => 'operator');
_clear_caches();
is($r->{status}, 0, 'conversion completes without ACL access');
ok(!get_user('root'),
'conversion skips a privileged RPC username without ACL access');
like($r->{out}, qr/root.*not a valid Webmin username/i,
'conversion reports the privileged username as invalid');
_reset_fixture();
_seed_user_acl('operator', {
sync => 1, create => 1, acl => 1, gassign => '*',
});
create_group({ name => 'converted', members => [], modules => ['acl'] });
$r = run_cgi('convert.cgi', {
conv => 1, users => 'root', wgroup => 'converted', sync => 1,
}, user => 'operator');
_clear_caches();
is($r->{status}, 0, 'conversion completes with ACL access');
ok(get_user('root'),
'ACL-capable administrator can convert a privileged username');
};
subtest 'save_user.cgi gassign whitelist' => sub {
# gassign='admins' allows assigning only to group "admins"; trying to
# assign to a different group should fail.