You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When failing to authenticate against a rule that mentions multiple permissions, Cog will crash when rendering the error message. All proper authorization checks have taken place, but no output is returned to the user.
do: "Sorry, you aren't allowed to execute '#{current_invocation}' :(\n You will need the '#{rule.permission_selector.perms.value}' permission to run this command."
An example of a rule that will trigger this condition is:
when command is twitter:tweet with option[as] == "support" must have twitter:tweet and site:support
If your user does not have both permissions, executing
twitter:tweet --as=support "blah blah blah"
will crash the executor process.
The error rendering code was written assuming a rule would only mention a single permission. This specific failure is caused because the AST node in question is now a Piper.Permissions.Ast.ConditionalExpr, and it has no :perms field.
The text was updated successfully, but these errors were encountered:
This commit uses the newly added Permissions.Ast.Rule.permissions_used/1
function to obtain the list of permissions mentioned in a access
rule to generate a better access denied error message. This also
prevents Cog from crashing when rules mention more than one permission.
This isn't an ideal solution as we're not telling the user exactly which
specific permissions they're lacking but it is a step in the right
direction and vastly better than crashing.
50% fix for #758
When failing to authenticate against a rule that mentions multiple permissions, Cog will crash when rendering the error message. All proper authorization checks have taken place, but no output is returned to the user.
The offending code is at
cog/lib/cog/error_response.ex
Lines 15 to 16 in a793edb
An example of a rule that will trigger this condition is:
If your user does not have both permissions, executing
will crash the executor process.
The error rendering code was written assuming a rule would only mention a single permission. This specific failure is caused because the AST node in question is now a
Piper.Permissions.Ast.ConditionalExpr
, and it has no:perms
field.The text was updated successfully, but these errors were encountered: