From: Dmitry Timoshkov Subject: Re: [PATCH] wbemprox: Return WBEM_E_ACCESS_DENIED from IEnumWbemClassObject::Next() if the object is empty. Message-Id: <20190708200901.0dda7dde7793e09addd7025e@baikal.ru> Date: Mon, 8 Jul 2019 20:09:01 +0800 In-Reply-To: <20190708180219.c75ae7e744400d7966cb5ed3@baikal.ru> References: <20190708130718.675b6fbc701cdbb0ea932f2d@baikal.ru> <2ee08af8b40c9d679d65527d4f272d40238c1cba.camel@codeweavers.com> <20190708170411.c58c4005590d2389c858ff82@baikal.ru> <7bca5a82c631ba4af4a93aea93276b8bf8307822.camel@codeweavers.com> <20190708173703.66c377af2052013780bd3d6c@baikal.ru> <20190708180219.c75ae7e744400d7966cb5ed3@baikal.ru> Dmitry Timoshkov wrote: > > > Could you suggest a place in Wine where a permission check could be added? > > > > It's not clear to me if this is a general WMI thing or if it depends on the > > object being queried. > > I'll copy WMI tests from dlls/wbemprox/tests to the MSI custom action tests > to get a picture how it works under Windows. I've ported dlls/wbemprox/query.c to run from the MSI custom action, added strict checks for ::Next() return values everywhere, and while some of the queries fail ::Next() never returns WBEM_E_ACCESS_DENIED. It turned out that commenting out CoSetProxyBlanket() made the ::Next() calls for empty objects always return WBEM_E_ACCESS_DENIED instead of WBEM_S_FALSE/WBEM_S_TIMEDOUT. It's not obvious to me where the proposed access check should be added. Hans, do the test results add any clue to you? -- Dmitry.