Mosquitto ignores acl_file on default listener if per_listener_settings=true

[jefdriesen]

When mosquitto is configured as follows:

per_listener_settings true

port 1883
acl_file /etc/mosquitto/aclfile.foo

listener 1884
acl_file /etc/mosquitto/aclfile.bar

Then the default listener (on port 1883) ignores the acl_file. This can easily confirmed by specifying a non-existing acl file. Mosquitto will startup fine, without complaining about the non-existing file. And when trying to send messages, there are indeed no acl's effective.

This is a potential security risk!

[nluedtke]

For completeness sake, this received CVE-2018-20145. https://nvd.nist.gov/vuln/detail/CVE-2018-20145

[ralight]

@nluedtke Thank you, as this was disclosed publicly my priority was to get a fix out rather than asking for a CVE. Thanks for removing that burden, I'll get the documentation updated.