ACL LOAD fails on files generated by ACL SAVE when specific channels are allowed#8811
ACL LOAD fails on files generated by ACL SAVE when specific channels are allowed#8811oranagra wants to merge 4 commits intoredis:unstablefrom oranagra:acl_save_pubsub
Conversation
|
I think the more severe is when we I have a user like |
|
@huangzhw but why would such a thing happen?
bottom line:
i think this simple one line change fits all of these.. |
Co-authored-by: Yossi Gottlieb <[email protected]>
|
If you have a old server, execute |
right. but if you do the same without replacing the binary, start will fail too. point is, we're not breaking compatibility with (a valid) old version of the config. |
|
Agree. You are right. I think this fix is enough. |
|
folded into #8794 |
DRAFT (to be folded into #8794):
In the initial release of Redis 6.2 setting a user to only allow pubsub access to
a specific, and doing ACL SAVE, resulted in an assertion when ACL LOAD was used.
this was later changed by #8723 (not yet released), but still not properly resolved.
The problem is that the server that generates an ACL file, doesn't know what
would be the setting of the
acl-pubsub-defaultconfig in the server that will load it.so it needs to always start with
resetchannelsdirective.This should still be compatible with old acl files (from redis 6.0), and ones from earlier
versions of 6.2 that didn't mess with channels.