From 25366f6dc16a42148bbaffc8fe35790d159e6c95 Mon Sep 17 00:00:00 2001
From: William Lallemand <wlallemand@haproxy.com>
Date: Tue, 31 Mar 2026 11:36:08 +0200
Subject: [PATCH] BUG/MEDIUM: map/cli: map/acl commands warn when accessed
 without admin level

This commit adds an ha_warning() when map/acl commands are accessed
without admin level. This is to warn users that these commands will be
restricted to admin only in HAProxy 3.3.

Must be backported in every stable branches.

Initially reported by Cameron Brown.
---
 src/map.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/map.c b/src/map.c
index 66875a079..1e5dcf13b 100644
--- a/src/map.c
+++ b/src/map.c
@@ -621,6 +621,9 @@ static int cli_parse_get_map(char **args, char *payload, struct appctx *appctx,
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0 || strcmp(args[1], "acl") == 0) {
 		/* Set flags. */
 		if (args[1][0] == 'm')
@@ -664,6 +667,9 @@ static int cli_parse_prepare_map(char **args, char *payload, struct appctx *appc
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0 ||
 	    strcmp(args[1], "acl") == 0) {
 		uint next_gen;
@@ -706,6 +712,9 @@ static int cli_parse_show_map(char **args, char *payload, struct appctx *appctx,
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0 ||
 	    strcmp(args[1], "acl") == 0) {
 		const char *gen = NULL;
@@ -760,6 +769,9 @@ static int cli_parse_set_map(char **args, char *payload, struct appctx *appctx,
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0) {
 		char *err;
 
@@ -832,6 +844,9 @@ static int cli_parse_add_map(char **args, char *payload, struct appctx *appctx,
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0 ||
 	    strcmp(args[1], "acl") == 0) {
 		const char *gen = NULL;
@@ -962,6 +977,9 @@ static int cli_parse_del_map(char **args, char *payload, struct appctx *appctx,
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (args[1][0] == 'm')
 		ctx->display_flags = PAT_REF_MAP;
 	else
@@ -1057,6 +1075,9 @@ static int cli_parse_clear_map(char **args, char *payload, struct appctx *appctx
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0 || strcmp(args[1], "acl") == 0) {
 		const char *gen = NULL;
 
@@ -1113,6 +1134,9 @@ static int cli_parse_commit_map(char **args, char *payload, struct appctx *appct
 {
 	struct show_map_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
 
+	if ((appctx->cli_ctx.level & ACCESS_LVL_MASK) < ACCESS_LVL_ADMIN)
+		ha_warning("'%s %s' accessed without admin rights, this won't be supported anymore starting from haproxy 3.3\n", args[0], args[1]);
+
 	if (strcmp(args[1], "map") == 0 || strcmp(args[1], "acl") == 0) {
 		const char *gen = NULL;
 		uint genid;