Details
-
Bug
-
Status: Stalled (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.6
-
Can result in unexpected behaviour
Description
When SERVER_AUDIT_INCL_USERS or SERVER_AUDIT_EXCL_USERS contains double commas (e.g., 'user1,,user2'), the audit plugin behaves incorrectly:
For incl_users: ALL users are logged instead of only specified users
For excl_users: ALL users are excluded instead of only specified users
The root cause is in user_coll_fill(). When parsing a user list string with consecutive commas, the parser calls getkey_user() with the pointer positioned at a comma, which returns cmp_length of 0. Then coll_insert() inserts an empty string into the user collection, corrupting the collection's search behavior.
The fix adds a check to skip empty tokens (when the current character is a comma after whitespace has been skipped) before attempting to extract a username.