backport of commit fb97a459ece4420cdb1237836affbfb40c24ad92 (#23876)
Co-authored-by: miagilepner <mia.epner@hashicorp.com>
This commit is contained in:
parent
c948c64a84
commit
3fe08e8374
3
changelog/23874.txt
Normal file
3
changelog/23874.txt
Normal file
@ -0,0 +1,3 @@
|
||||
```release-note:bug
|
||||
core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash
|
||||
```
|
10
vault/acl.go
10
vault/acl.go
@ -391,6 +391,16 @@ func (a *ACL) AllowOperation(ctx context.Context, req *logical.Request, capCheck
|
||||
}
|
||||
}
|
||||
|
||||
// List operations need to check without the trailing slash first, because
|
||||
// there could be other rules with trailing wildcards that will match the
|
||||
// path
|
||||
if op == logical.ListOperation && strings.HasSuffix(path, "/") {
|
||||
permissions = a.CheckAllowedFromNonExactPaths(strings.TrimSuffix(path, "/"), false)
|
||||
if permissions != nil {
|
||||
capabilities = permissions.CapabilitiesBitmap
|
||||
goto CHECK
|
||||
}
|
||||
}
|
||||
permissions = a.CheckAllowedFromNonExactPaths(path, false)
|
||||
if permissions != nil {
|
||||
capabilities = permissions.CapabilitiesBitmap
|
||||
|
Loading…
Reference in New Issue
Block a user