From ca5db7567c4027cc075bf1f2164209916e00b47e Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Wed, 27 May 2026 00:17:52 +0800 Subject: [PATCH] fix: check both regular ACEs and resource pool ACEs for proper access control This fix addresses a critical issue in the RBAC permission checking logic introduced in PR #2750. When a project is shared through a resource pool, both the project creator (with regular ACEs like "All endpoints") and the shared user (with resource pool ACEs) should be able to see the project. Changes: - Modified `check_user_has_privilege` in `gns3server/db/repositories/rbac.py` - Changed from if-elif (exclusive) to sequential (inclusive) checking - Now checks regular ACEs first, then resource pool ACEs - Both types of ACEs can grant access (OR logic instead of XOR) This fixes the scenario where: 1. user100 has "All endpoints" ACE and creates a project 2. user100 shares the project via resource pool with user200 3. Both users should see the project (user100 via regular ACE, user200 via pool ACE) Related to PR #2750 - RBAC user isolation implementation. --- gns3server/db/repositories/rbac.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/gns3server/db/repositories/rbac.py b/gns3server/db/repositories/rbac.py index ce62c5caa..cd769012e 100644 --- a/gns3server/db/repositories/rbac.py +++ b/gns3server/db/repositories/rbac.py @@ -428,22 +428,26 @@ class RbacRepository(BaseRepository): aces = await self._get_user_aces(user_id, privilege_name) try: + # Check regular ACEs first + if self._check_path_with_aces(path, aces): + # the user has an ACE matching the path and privilege, there is no need to check group ACEs + return True + # Then check resource pool ACEs if path_is_in_pool: if await self._get_resources_in_pools(aces, path): return True - elif self._check_path_with_aces(path, aces): - # the user has an ACE matching the path and privilege, there is no need to check group ACEs - return True except PermissionError: return False aces = await self._get_group_aces(user_id, privilege_name) try: + # Check regular ACEs first + if self._check_path_with_aces(path, aces): + return True + # Then check resource pool ACEs if path_is_in_pool: if await self._get_resources_in_pools(aces, path): return True - elif self._check_path_with_aces(path, aces): - return True except PermissionError: return False return False