| 739 | } |
| 740 | |
| 741 | static gboolean |
| 742 | acl_check_diff_xml(xmlNode * xml, GHashTable * xml_perms) |
| 743 | { |
| 744 | xml_perm_t *perm = NULL; |
| 745 | xmlNode *child = NULL; |
| 746 | |
| 747 | for (child = __xml_first_child(xml); child; child = __xml_next(child)) { |
| 748 | if (acl_check_diff_xml(child, xml_perms) == FALSE) { |
| 749 | return FALSE; |
| 750 | } |
| 751 | } |
| 752 | |
| 753 | g_hash_table_lookup_extended(xml_perms, xml, NULL, (gpointer) & perm); |
| 754 | |
| 755 | if (xml) { |
| 756 | xmlAttrPtr xIter = NULL; |
| 757 | |
| 758 | for (xIter = xml->properties; xIter; xIter = xIter->next) { |
| 759 | const char *prop_name = (const char *)xIter->name; |
| 760 | gpointer mode = NULL; |
| 761 | |
| 762 | if (crm_str_eq(crm_element_name(xml), XML_TAG_CIB, TRUE)) { |
| 763 | if (crm_str_eq(prop_name, XML_ATTR_GENERATION, TRUE) |
| 764 | || crm_str_eq(prop_name, XML_ATTR_NUMUPDATES, TRUE) |
| 765 | || crm_str_eq(prop_name, XML_ATTR_GENERATION_ADMIN, TRUE)) { |
| 766 | continue; |
| 767 | } |
| 768 | } |
| 769 | |
| 770 | if (crm_str_eq(prop_name, XML_ATTR_ID, TRUE)) { |
| 771 | continue; |
| 772 | } |
| 773 | |
| 774 | if (crm_str_eq(prop_name, XML_DIFF_MARKER, TRUE) && xml_has_children(xml)) { |
| 775 | continue; |
| 776 | } |
| 777 | |
| 778 | if (perm == NULL) { |
| 779 | crm_warn("No ACL defined to modify the element: tag=%s, id=%s, attribute=%s", |
| 780 | crm_element_name(xml), crm_element_value(xml, XML_ATTR_ID), prop_name); |
| 781 | return FALSE; |
| 782 | } |
| 783 | |
| 784 | if (perm->attribute_perms == NULL) { |
| 785 | if (can_write(perm->mode)) { |
| 786 | return TRUE; |
| 787 | } else { |
| 788 | crm_warn |
| 789 | ("No enough permission to modify the element: element_mode=%s, tag=%s, id=%s, attribute=%s", |
| 790 | perm->mode, crm_element_name(xml), crm_element_value(xml, XML_ATTR_ID), |
| 791 | prop_name); |
| 792 | return FALSE; |
| 793 | } |
| 794 | } |
| 795 | |
| 796 | if (g_hash_table_lookup_extended(perm->attribute_perms, prop_name, NULL, &mode)) { |
| 797 | if (can_write(mode) == FALSE) { |
| 798 | crm_warn |
no test coverage detected