Function acl_check_diff

lib/cib/cib_acl.c:131–201

rc = TRUE if the request passes the ACL check */ rc = FALSE if the permission is denied */

/* rc = TRUE if the request passes the ACL check */
/* rc = FALSE if the permission is denied */
gboolean
acl_check_diff(xmlNode * request, xmlNode * current_cib, xmlNode * result_cib, xmlNode * diff)
{
    const char *user = NULL;
    xmlNode *xml_acls = NULL;
    GListPtr user_acl = NULL;
    xmlNode *orig_diff = NULL;
    xmlNode *diff_child = NULL;
    int rc = FALSE;

    if (req_by_privileged(request)) {
        return TRUE;
    }

    if (diff == NULL) {
        return TRUE;
    }

    if (current_cib == NULL) {
        return FALSE;
    }

    xml_acls = get_object_root(XML_CIB_TAG_ACLS, current_cib);
    if (xml_acls == NULL) {
        crm_warn("Ordinary users cannot access the CIB without any defined ACLs: '%s'", user);
        return FALSE;
    }

    user = crm_element_value(request, F_CIB_USER);
    unpack_user_acl(xml_acls, user, &user_acl);

    orig_diff = diff_xml_object_orig(current_cib, result_cib, FALSE, diff);

    for (diff_child = __xml_first_child(orig_diff); diff_child; diff_child = __xml_next(diff_child)) {
        const char *tag = crm_element_name(diff_child);
        GListPtr parsed_acl = NULL;
        xmlNode *diff_cib = NULL;

        crm_debug("Preparing ACL checking on '%s'", tag);

        if (crm_str_eq(tag, XML_TAG_DIFF_REMOVED, TRUE)) {
            crm_debug("Parsing any xpaths under the ACL according to the current CIB");
            parse_acl_xpath(current_cib, user_acl, &parsed_acl);
        } else if (crm_str_eq(tag, XML_TAG_DIFF_ADDED, TRUE)) {
            crm_debug("Parsing any xpaths under the ACL according to the result CIB");
            parse_acl_xpath(result_cib, user_acl, &parsed_acl);
        } else {
            continue;
        }

        for (diff_cib = __xml_first_child(diff_child); diff_cib; diff_cib = __xml_next(diff_cib)) {
            GHashTable *xml_perms = NULL;

            gen_xml_perms(diff_cib, parsed_acl, &xml_perms);
            rc = acl_check_diff_xml(diff_cib, xml_perms);
            g_hash_table_destroy(xml_perms);

            if (rc == FALSE) {