Skip to content

Commit 86c12d4

Browse files
committed
Fix intercept plugin ignoring ACL (#12076)
(cherry picked from commit 9d9bd53b4a4b788ddb9a36e0abed4b7efe822c10) Co-authored-by: Chris McFarlen <cmcfarlen@apple.com> (cherry picked from commit 2f028c8)
1 parent 595cc5e commit 86c12d4

1 file changed

Lines changed: 9 additions & 0 deletions

File tree

src/proxy/http/HttpTransact.cc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1205,6 +1205,15 @@ HttpTransact::EndRemapRequest(State *s)
12051205
obj_describe(s->hdr_info.client_request.m_http, true);
12061206
}
12071207
1208+
// If the client failed ACLs, send error response
1209+
// This extra condition was added to separate it from the logic below that might allow
1210+
// requests that use some types of plugins as that code was allowing requests that didn't
1211+
// pass ACL checks. ACL mismatches are also not counted as invalid client requests
1212+
if (!s->client_connection_allowed) {
1213+
TxnDbg(dbg_ctl_http_trans, "END HttpTransact::EndRemapRequest: connection not allowed");
1214+
TRANSACT_RETURN(SM_ACTION_SEND_ERROR_CACHE_NOOP, nullptr);
1215+
}
1216+
12081217
/*
12091218
if s->reverse_proxy == false, we can assume remapping failed in some way
12101219
-however-

0 commit comments

Comments
 (0)