pull it into helper sub, since we need this one more time for token ACL
members.
Signed-off-by: Fabian Grünbichler <f.gruenbich...@proxmox.com>
---
Notes:
v1->v2:
- rename helper and variable
- also merge propagate/non-propagate loops
PVE/AccessControl.pm | 74 +++++++++++++++++++-------------------------
1 file changed, 32 insertions(+), 42 deletions(-)
diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index eb21f50..9d4373f 100644
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -1094,55 +1094,45 @@ sub write_user_config {
$data .= "\n";
+ my $collect_rolelist_members = sub {
+ my ($acl_members, $result, $prefix, $exclude) = @_;
+
+ foreach my $member (keys %$acl_members) {
+ next if $exclude && $member eq $exclude;
+
+ my $l0 = '';
+ my $l1 = '';
+ foreach my $role (sort keys %{$acl_members->{$member}}) {
+ my $propagate = $acl_members->{$member}->{$role};
+ if ($propagate) {
+ $l1 .= ',' if $l1;
+ $l1 .= $role;
+ } else {
+ $l0 .= ',' if $l0;
+ $l0 .= $role;
+ }
+ }
+ $result->{0}->{$l0}->{"${prefix}${member}"} = 1 if $l0;
+ $result->{1}->{$l1}->{"${prefix}${member}"} = 1 if $l1;
+ }
+ };
+
foreach my $path (sort keys %{$cfg->{acl}}) {
my $d = $cfg->{acl}->{$path};
- my $ra = {};
+ my $rolelist_members = {};
- foreach my $group (keys %{$d->{groups}}) {
- my $l0 = '';
- my $l1 = '';
- foreach my $role (sort keys %{$d->{groups}->{$group}}) {
- my $propagate = $d->{groups}->{$group}->{$role};
- if ($propagate) {
- $l1 .= ',' if $l1;
- $l1 .= $role;
- } else {
- $l0 .= ',' if $l0;
- $l0 .= $role;
- }
- }
- $ra->{0}->{$l0}->{"\@$group"} = 1 if $l0;
- $ra->{1}->{$l1}->{"\@$group"} = 1 if $l1;
- }
+ $collect_rolelist_members->($d->{'groups'}, $rolelist_members, '@');
- foreach my $user (keys %{$d->{users}}) {
- # no need to save, because root is always 'Administrator'
- next if $user eq 'root@pam';
+ # no need to save 'root@pam', it is always 'Administrator'
+ $collect_rolelist_members->($d->{'users'}, $rolelist_members, '',
'root@pam');
- my $l0 = '';
- my $l1 = '';
- foreach my $role (sort keys %{$d->{users}->{$user}}) {
- my $propagate = $d->{users}->{$user}->{$role};
- if ($propagate) {
- $l1 .= ',' if $l1;
- $l1 .= $role;
- } else {
- $l0 .= ',' if $l0;
- $l0 .= $role;
- }
+ foreach my $propagate (0,1) {
+ my $filtered = $rolelist_members->{$propagate};
+ foreach my $rolelist (sort keys %$filtered) {
+ my $uglist = join (',', sort keys %{$filtered->{$rolelist}});
+ $data .= "acl:$propagate:$path:$uglist:$rolelist:\n";
}
- $ra->{0}->{$l0}->{$user} = 1 if $l0;
- $ra->{1}->{$l1}->{$user} = 1 if $l1;
- }
-
- foreach my $rolelist (sort keys %{$ra->{0}}) {
- my $uglist = join (',', sort keys %{$ra->{0}->{$rolelist}});
- $data .= "acl:0:$path:$uglist:$rolelist:\n";
- }
- foreach my $rolelist (sort keys %{$ra->{1}}) {
- my $uglist = join (',', sort keys %{$ra->{1}->{$rolelist}});
- $data .= "acl:1:$path:$uglist:$rolelist:\n";
}
}
--
2.20.1
_______________________________________________
pve-devel mailing list
pve-devel@pve.proxmox.com
https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
