[DynamicSecurity] modifyGroup command does not validate against clients

[sszczep]

Consider following message on $CONTROL MQTT topic:

{
  "commands": [
    {
      "groupname": "groupName",
      "roles": [
        {
          "rolename": "roleName"
        }
      ],
      "clients": [
        {
          "username": "userName"
        }
      ],
      "command": "modifyGroup"
    }
  ]
}

If the role does not exist, it will result in error stating Role not found, however, the same does not apply to the nonexistent client - the command goes through successfully and results in empty clients group in database file.

I truly believe it is a mistake and should throw error in such case.

Using latest eclipse-mosquitto docker image running on Apple M1.

[ralight]

Thank you, yes, the modify commands need some work to ensure that if there is an error the thing they are modifying remains unchanged.

[sszczep]

Do you want me to take a look at it? If it's a small change and you already know how to fix it, it would be great as I wouldn't need to deep dive into the source code. Please let me know.

[ralight]

Thank you for the offer. It wasn't a trivial change, otherwise I would have just done it then. I've made the change now, and for the modifyClient command.