From 91234e0ba4b12a995ef625ee6d4e6bff8a611892 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20Czern=C3=BD?= <pczerny@opennebula.systems>
Date: Thu, 26 Mar 2020 11:16:36 +0100
Subject: [PATCH] B 4416: Fix restricted params for UserTemplate (#4433)

* B #4416: Fix restricted params for UserTemplate

* M #-: Fix crash on VM action with wrong user

(cherry picked from commit f652a5fbb8fdb4e2505ec381dc6fe0d6abe2e83b)
---
 src/rm/Request.cc  | 6 ++----
 src/um/UserPool.cc | 6 +++---
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/rm/Request.cc b/src/rm/Request.cc
index 7129307c8e..912e08f036 100644
--- a/src/rm/Request.cc
+++ b/src/rm/Request.cc
@@ -1123,10 +1123,9 @@ void RequestAttributes::set_auth_op(VMActions::Action action)
     if (user != nullptr)
     {
         result = user->get_vm_auth_op(action);
+        user->unlock();
     }
 
-    user->unlock();
-
     if (result != AuthRequest::NONE)
     {
         auth_op = result;
@@ -1138,10 +1137,9 @@ void RequestAttributes::set_auth_op(VMActions::Action action)
     if (group != nullptr)
     {
         result = group->get_vm_auth_op(action);
+        group->unlock();
     }
 
-    group->unlock();
-
     if (result != AuthRequest::NONE)
     {
         auth_op = result;
diff --git a/src/um/UserPool.cc b/src/um/UserPool.cc
index 3f67f75435..13cb82ebd5 100644
--- a/src/um/UserPool.cc
+++ b/src/um/UserPool.cc
@@ -75,6 +75,9 @@ UserPool::UserPool(SqlDB * db, time_t __session_expiration_time, bool is_slave,
 
     _session_expiration_time = __session_expiration_time;
 
+    // Set restricted attributes
+    UserTemplate::parse_restricted(restricted_attrs);
+
     User * oneadmin_user = get_ro(0);
 
     //Slaves do not need to init the pool, just the oneadmin username
@@ -183,9 +186,6 @@ UserPool::UserPool(SqlDB * db, time_t __session_expiration_time, bool is_slave,
         goto error_serveradmin;
     }
 
-    // Set restricted attributes
-    UserTemplate::parse_restricted(restricted_attrs);
-
     return;
 
 error_readoneauth: