Skip to content

Commit 6db6bcb

Browse files
committed
fix: Check if folder is owned by administrators group (#1429)
The code had checked the process or thread's SID to see if it matched the administrators group, but this will never be the case since the process or thread is running as some user. If the folder token is that of the administrators group, then at that point we can check membership of the current thread SID in it.
1 parent 0b28297 commit 6db6bcb

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

gix-sec/src/identity.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -187,12 +187,12 @@ mod impl_ {
187187
}
188188

189189
// Admin-group owned folders are considered owned by the current user, if they are in the admin group
190-
if IsWellKnownSid(token_owner, WinBuiltinAdministratorsSid) == 0 {
190+
if IsWellKnownSid(folder_owner, WinBuiltinAdministratorsSid) == 0 {
191191
return Ok(false);
192192
}
193193

194194
let mut is_member = 0;
195-
if CheckTokenMembership(0, token_owner, &mut is_member) == 0 {
195+
if CheckTokenMembership(0, folder_owner, &mut is_member) == 0 {
196196
error!("Couldn't check if user is an administrator");
197197
}
198198

0 commit comments

Comments
 (0)