-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/14254/#review26305
-----------------------------------------------------------



/trunk/qpid/cpp/src/qpid/broker/Broker.cpp
<https://reviews.apache.org/r/14254/#comment51393>

    Don't add ACT_ACCESS to this code. It's a subtle change that will confuse 
users.
    
    Just qualify the approveCreateQueue() call with 'if (!queues.find(name))'.


- Chug Rolke


On Sept. 20, 2013, 9:10 p.m., Ernie Allen wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/14254/
> -----------------------------------------------------------
> 
> (Updated Sept. 20, 2013, 9:10 p.m.)
> 
> 
> Review request for qpid and Chug Rolke.
> 
> 
> Repository: qpid
> 
> 
> Description
> -------
> 
> The acl quota count is incorrectly incremented when a queue already exists 
> and a request to create it again is received.
> For example, calling the c++ spout utility multiple times like:
>     spout -c 1 -b guest/guest@localhost -a "q1;{create:always}"
> will cause the quota count for guest to be incremented each time. This 
> eventually leads to acl denials even though only one queue was actually 
> created.
> 
> Proposed solution:
> Check for the existence of the queue in Broker::createQueue(). If the queue 
> exists, just check for acl access permission instead of making the acl call 
> that increments the user's quota count. 
>   
> 
> 
> Diffs
> -----
> 
>   /trunk/qpid/cpp/src/qpid/broker/Broker.cpp 1525129 
> 
> Diff: https://reviews.apache.org/r/14254/diff/
> 
> 
> Testing
> -------
> 
> Set queue quota in the acl config file for a user.
> Run c++ spout utility with address of "q1;{create:always}" multiple times 
> (more than the allowed quota) to verify that quota is not consumed. 
> 
> Create multiple queues for user to verify that new queues count against the 
> quota.
> 
> 
>   
> 
> 
> Thanks,
> 
> Ernie Allen
> 
>

Reply via email to