Subject: Bug#1234: acl-users-allow=ALL superceeds acl-users-deny

From: Walid MOGHRABI <[email-masked]>
Date: Tue, 21 Nov 2017 18:23:32 +0100 (CET)

package: x2gobroker
priority: normal
tags: patch

When using ACLs with the session broker, I wanted to give access to a session setting to ALL users EXCEPT some (namely "formation{1..9}").
I tried this but it didn't work :

=================================================
[TRAVAUX]
fullscreen=true
clipboard=none
name=TRAVAUX
host=tce-server (10.10.10.1)
acl-users-allow=ALL
acl-users-deny=formation1, formation2, formation3, formation4, formation5, formation6, formation7, formation8, formation9
acl-any-order=deny-allow
=================================================

I played with many settings, changing order, using only the "acl-users-deny" option, ... none of them worked as expected.

I ended in thinking that there was a bug with acl-users-allow=ALL which was taking over any other setting.

I did a little fix that seem to work, at least for this use case.

Regards,
Walid Moghrabi

TRAVAUX.COM
BAT I - PARC CEZANNE 2 290 AVENUE GALILEE - CS 80403
13591 AIX EN PROVENCE CEDEX 3

---
DISCLAIMER: This e-mail is private and confidential and may contain proprietary or legally privileged information. It is for the intended recipient only. If you have received this email in error, please notify the author by replying to it and then destroy it. If you are not the intended recipient you must not use, disclose, distribute, copy, print or rely on this e-mail or any attachment. Thank you

diff --git a/.gitignore b/.gitignore
index 7288ef5..1605925 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,5 @@ debian/*.prerm.debhelper
 debian/*.substvars
 debian/*x2go*/
 *.egg-info/
+/.project
+/.gitignore
diff --git a/x2gobroker/brokers/base_broker.py b/x2gobroker/brokers/base_broker.py
index b6a6ee6..7955cdc 100644
--- a/x2gobroker/brokers/base_broker.py
+++ b/x2gobroker/brokers/base_broker.py
@@ -431,7 +431,7 @@ class X2GoBroker(object):
             _allow_user = False
             _deny_user = False
 
-            if username in _acls['acl-users-allow'] or 'ALL' in _acls['acl-users-allow']:
+            if (username in _acls['acl-users-allow'] or 'ALL' in _acls['acl-users-allow']) and username not in _acls['acl-users-deny']:
                 _allow_user_override = True
                 _allow_user = True