Skip to content

Commit

Permalink
FIX(server, client): Remove "Write" ACL parent channel inheritance
Browse files Browse the repository at this point in the history
Since 2a9dcfd and 62b1536 the Mumble server
would overwrite the current channel Write ACL, if the user
had Write ACL permission in the parent channel.
Supposedly, this was done because otherwise malicious users
could create temporary "ungovernable" channels by locking admins out
denying Write ACL for them.
However, this makes ACL management a lot less intuitive with regard
to the Write permission.

This commit reverts those commits and instead adds a check to see
if the user has Write permission in the root channel instead.
The reasoning being: If the server owner grants Write ACL on root,
they probably want those users to be able to moderate every channel.
If instead the server owner only grants Write on part of the channel
tree, normal ACL rules apply and users may lock other users out for
whatever reason.
  • Loading branch information
Hartmnt committed Jul 18, 2024
1 parent 4101c4a commit b9f6ca6
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 17 deletions.
16 changes: 1 addition & 15 deletions src/mumble/MainWindow.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2553,20 +2553,6 @@ void MainWindow::updateMenuPermissions() {
target.channel->uiPermissions = p;
}

Channel *cparent = target.channel ? target.channel->cParent : nullptr;
ChanACL::Permissions pparent =
cparent ? static_cast< ChanACL::Permissions >(cparent->uiPermissions) : ChanACL::None;

if (cparent && !pparent) {
Global::get().sh->requestChannelPermissions(cparent->iId);
if (cparent->iId == 0)
pparent = Global::get().pPermissions;
else
pparent = ChanACL::All;

cparent->uiPermissions = pparent;
}

ClientUser *user = Global::get().uiSession ? ClientUser::get(Global::get().uiSession) : nullptr;
Channel *homec = user ? user->cChannel : nullptr;
ChanACL::Permissions homep = homec ? static_cast< ChanACL::Permissions >(homec->uiPermissions) : ChanACL::None;
Expand Down Expand Up @@ -2602,7 +2588,7 @@ void MainWindow::updateMenuPermissions() {

qaChannelAdd->setEnabled(p & (ChanACL::Write | ChanACL::MakeChannel | ChanACL::MakeTempChannel));
qaChannelRemove->setEnabled(p & ChanACL::Write);
qaChannelACL->setEnabled((p & ChanACL::Write) || (pparent & ChanACL::Write));
qaChannelACL->setEnabled((p & ChanACL::Write) || (Global::get().pPermissions & ChanACL::Write));

qaChannelLink->setEnabled((p & (ChanACL::Write | ChanACL::LinkChannel))
&& (homep & (ChanACL::Write | ChanACL::LinkChannel)));
Expand Down
3 changes: 1 addition & 2 deletions src/murmur/Messages.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1756,8 +1756,7 @@ void Server::msgACL(ServerUser *uSource, MumbleProto::ACL &msg) {
if (!c)
return;

if (!hasPermission(uSource, c, ChanACL::Write)
&& !(c->cParent && hasPermission(uSource, c->cParent, ChanACL::Write))) {
if (!hasPermission(uSource, c, ChanACL::Write) && !hasPermission(uSource, qhChannels.value(0), ChanACL::Write)) {
PERM_DENIED(uSource, c, ChanACL::Write);
return;
}
Expand Down

0 comments on commit b9f6ca6

Please sign in to comment.