Github user mike-jumper commented on a diff in the pull request:
https://github.com/apache/guacamole-client/pull/301#discussion_r194894400
--- Diff:
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
---
@@ -110,21 +110,21 @@ public TrackedActiveConnection
retrieveObject(ModeledAuthenticatedUser user,
@Override
public void deleteObject(ModeledAuthenticatedUser user, String
identifier)
throws GuacamoleException {
-
- // Only administrators may delete active connections
- if (!user.getUser().isAdministrator())
- throw new GuacamoleSecurityException("Permission denied.");
-
+
// Close connection, if it exists (and we have permission)
ActiveConnection activeConnection = retrieveObject(user,
identifier);
- if (activeConnection != null) {
+ if (activeConnection != null &&
+ (user.getUser().isAdministrator()
+ ||
user.getIdentifier().equals(activeConnection.getUsername()))) {
--- End diff --
This same check will need to be done within
`ActiveConnectionPermissionService` for permission queries to correctly declare
the actions available to the user:
https://github.com/apache/guacamole-client/blob/bf3d27611db6df6549c337ddc6063ad6a195d9ad/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionPermissionService.java#L99-L101
Rather than duplicating the checks, though, I suggest testing the
permissions using the permission set (similar to the checks performed for users
and connections).
---
