> On Sept. 20, 2013, 9:50 p.m., Chug Rolke wrote: > > /trunk/qpid/cpp/src/qpid/broker/Broker.cpp, line 1291 > > <https://reviews.apache.org/r/14254/diff/1/?file=354860#file354860line1291> > > > > Don't add ACT_ACCESS to this code. It's a subtle change that will > > confuse users. > > > > Just qualify the approveCreateQueue() call with 'if > > (!queues.find(name))'.
I had assumed that ACT_ACCESS permission could be different than ACT_CREATE. I've removed the authorise(ACT_ACCESS) call. - Ernie ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/14254/#review26305 ----------------------------------------------------------- On Sept. 21, 2013, 4:59 p.m., Ernie Allen wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/14254/ > ----------------------------------------------------------- > > (Updated Sept. 21, 2013, 4:59 p.m.) > > > Review request for qpid and Chug Rolke. > > > Repository: qpid > > > Description > ------- > > The acl quota count is incorrectly incremented when a queue already exists > and a request to create it again is received. > For example, calling the c++ spout utility multiple times like: > spout -c 1 -b guest/guest@localhost -a "q1;{create:always}" > will cause the quota count for guest to be incremented each time. This > eventually leads to acl denials even though only one queue was actually > created. > > Proposed solution: > Check for the existence of the queue in Broker::createQueue(). If the queue > exists, just check for acl access permission instead of making the acl call > that increments the user's quota count. > > > > Diffs > ----- > > /trunk/qpid/cpp/src/qpid/broker/Broker.cpp 1525129 > > Diff: https://reviews.apache.org/r/14254/diff/ > > > Testing > ------- > > Set queue quota in the acl config file for a user. > Run c++ spout utility with address of "q1;{create:always}" multiple times > (more than the allowed quota) to verify that quota is not consumed. > > Create multiple queues for user to verify that new queues count against the > quota. > > > > > > Thanks, > > Ernie Allen > >
