*: UID:UUID -> crash_id conversion

This fixes at least three instances where we did not check whether
user is even allowed to report or delete a crash.

Also fixes a few cases when root might inadvertently act on (e.g. delete)
mote than one crash.

Renamed FILENAME_UID to CD_UID - makes more sense this way.
Added COL_INFORMALL and CD_INFORMALL. Nuked UID == -1 hacks.
Renamed getReport() to start_job on Python side.
Dropped a few unused parameters from server -> client dbus signals.
Fixed CLI's way of reverencing crashes (see updated help text).

Run-tested (GUI and CLI).

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Acked-by: Nikola Pajkovsky <npajkovs@redhat.com>

8 files changed, 156 insertions, 156 deletions

diff --git a/src/Daemon/CommLayerServer.h b/src/Daemon/CommLayerServer.h
index bb33a1e9..6e593d29 100644
--- a/src/Daemon/CommLayerServer.h
+++ b/src/Daemon/CommLayerServer.h
@@ -31,11 +31,11 @@ class CCommLayerServer {
 
         /* just stubs to be called when not implemented in specific comm layer */
         virtual void Crash(const char *progname, const char *uid_str) {}
-        virtual void JobDone(const char* pDest, const char* pUUID) = 0;
+        virtual void JobDone(const char* peer) = 0;
         virtual void QuotaExceed(const char* str) {}
 
-        virtual void Update(const char* pMessage, const char* peer, uint64_t pJobID) {};
-        virtual void Warning(const char* pMessage, const char* peer, uint64_t pJobID) {};
+        virtual void Update(const char* pMessage, const char* peer) {};
+        virtual void Warning(const char* pMessage, const char* peer) {};
 };
 
 #endif
diff --git a/src/Daemon/CommLayerServerDBus.cpp b/src/Daemon/CommLayerServerDBus.cpp
index a397dd15..6dcb8e45 100644
--- a/src/Daemon/CommLayerServerDBus.cpp
+++ b/src/Daemon/CommLayerServerDBus.cpp
@@ -95,33 +95,27 @@ void CCommLayerServerDBus::QuotaExceed(const char* str)
     send_flush_and_unref(msg);
 }
 
-void CCommLayerServerDBus::JobDone(const char* peer, const char* pUUID)
+void CCommLayerServerDBus::JobDone(const char* peer)
 {
     DBusMessage* msg = new_signal_msg("JobDone", peer);
-    dbus_message_append_args(msg,
-            DBUS_TYPE_STRING, &peer, /* TODO: redundant parameter, remove from API */
-            DBUS_TYPE_STRING, &pUUID, /* TODO: redundant parameter, remove from API */
-            DBUS_TYPE_INVALID);
-    VERB2 log("Sending signal JobDone('%s','%s')", peer, pUUID);
+    VERB2 log("Sending signal JobDone() to peer %s", peer);
     send_flush_and_unref(msg);
 }
 
-void CCommLayerServerDBus::Update(const char* pMessage, const char* peer, uint64_t job_id)
+void CCommLayerServerDBus::Update(const char* pMessage, const char* peer)
 {
     DBusMessage* msg = new_signal_msg("Update", peer);
     dbus_message_append_args(msg,
             DBUS_TYPE_STRING, &pMessage,
-            DBUS_TYPE_UINT64, &job_id, /* TODO: redundant parameter, remove from API */
             DBUS_TYPE_INVALID);
     send_flush_and_unref(msg);
 }
 
-void CCommLayerServerDBus::Warning(const char* pMessage, const char* peer, uint64_t job_id)
+void CCommLayerServerDBus::Warning(const char* pMessage, const char* peer)
 {
     DBusMessage* msg = new_signal_msg("Warning", peer);
     dbus_message_append_args(msg,
             DBUS_TYPE_STRING, &pMessage,
-            DBUS_TYPE_UINT64, &job_id, /* TODO: redundant parameter, remove from API */
             DBUS_TYPE_INVALID);
     send_flush_and_unref(msg);
 }
@@ -151,7 +145,7 @@ static long get_remote_uid(DBusMessage* call, const char** ppSender = NULL)
 static int handle_GetCrashInfos(DBusMessage* call, DBusMessage* reply)
 {
     long unix_uid = get_remote_uid(call);
-    vector_map_crash_data_t argout1 = GetCrashInfos(to_string(unix_uid).c_str());
+    vector_map_crash_data_t argout1 = GetCrashInfos(unix_uid);
 
     DBusMessageIter out_iter;
     dbus_message_iter_init_append(reply, &out_iter);
@@ -166,8 +160,8 @@ static int handle_StartJob(DBusMessage* call, DBusMessage* reply)
     int r;
     DBusMessageIter in_iter;
     dbus_message_iter_init(call, &in_iter);
-    const char* pUUID;
-    r = load_val(&in_iter, pUUID);
+    const char* crash_id;
+    r = load_val(&in_iter, crash_id);
     if (r != ABRT_DBUS_MORE_FIELDS)
     {
         error_msg("dbus call %s: parameter type mismatch", __func__ + 7);
@@ -183,13 +177,9 @@ static int handle_StartJob(DBusMessage* call, DBusMessage* reply)
 
     const char* sender;
     long unix_uid = get_remote_uid(call, &sender);
-    if (CreateReportThread(pUUID, to_string(unix_uid).c_str(), force, sender) != 0)
+    if (CreateReportThread(crash_id, unix_uid, force, sender) != 0)
         return -1; /* can't create thread (err msg is already logged) */
 
-    dbus_message_append_args(reply,
-                DBUS_TYPE_STRING, &pUUID, /* redundant, eliminate from API */
-                DBUS_TYPE_INVALID);
-
     send_flush_and_unref(reply);
     return 0;
 }
@@ -199,8 +189,8 @@ static int handle_CreateReport(DBusMessage* call, DBusMessage* reply)
     int r;
     DBusMessageIter in_iter;
     dbus_message_iter_init(call, &in_iter);
-    const char* pUUID;
-    r = load_val(&in_iter, pUUID);
+    const char* crash_id;
+    r = load_val(&in_iter, crash_id);
     if (r != ABRT_DBUS_LAST_FIELD)
     {
         error_msg("dbus call %s: parameter type mismatch", __func__ + 7);
@@ -209,7 +199,7 @@ static int handle_CreateReport(DBusMessage* call, DBusMessage* reply)
 
     long unix_uid = get_remote_uid(call);
     map_crash_data_t report;
-    CreateReport(pUUID, to_string(unix_uid).c_str(), /*force:*/ 0, report);
+    CreateReport(crash_id, unix_uid, /*force:*/ 0, report);
 
     DBusMessageIter out_iter;
     dbus_message_iter_init_append(reply, &out_iter);
@@ -300,7 +290,7 @@ static int handle_Report(DBusMessage* call, DBusMessage* reply)
     report_status_t argout1;
     try
     {
-        argout1 = Report(argin1, user_conf_data, to_string(unix_uid).c_str());
+        argout1 = Report(argin1, user_conf_data, unix_uid);
     }
     catch (CABRTException &e)
     {
@@ -325,8 +315,8 @@ static int handle_DeleteDebugDump(DBusMessage* call, DBusMessage* reply)
     int r;
     DBusMessageIter in_iter;
     dbus_message_iter_init(call, &in_iter);
-    const char* argin1;
-    r = load_val(&in_iter, argin1);
+    const char* crash_id;
+    r = load_val(&in_iter, crash_id);
     if (r != ABRT_DBUS_LAST_FIELD)
     {
         error_msg("dbus call %s: parameter type mismatch", __func__ + 7);
@@ -334,7 +324,7 @@ static int handle_DeleteDebugDump(DBusMessage* call, DBusMessage* reply)
     }
 
     long unix_uid = get_remote_uid(call);
-    int32_t result = DeleteDebugDump(argin1, to_string(unix_uid).c_str());
+    int32_t result = DeleteDebugDump(crash_id, unix_uid);
 
     DBusMessageIter out_iter;
     dbus_message_iter_init_append(reply, &out_iter);
diff --git a/src/Daemon/CommLayerServerDBus.h b/src/Daemon/CommLayerServerDBus.h
index 4fecf1be..91ec0919 100644
--- a/src/Daemon/CommLayerServerDBus.h
+++ b/src/Daemon/CommLayerServerDBus.h
@@ -30,11 +30,11 @@ class CCommLayerServerDBus
 
         /* DBus signal senders */
         virtual void Crash(const char *progname, const char *uid_str);
-        virtual void JobDone(const char* pDest, const char* pUUID);
+        virtual void JobDone(const char* peer);
         virtual void QuotaExceed(const char* str);
 
-        virtual void Update(const char* pMessage, const char* peer, uint64_t pJobID);
-        virtual void Warning(const char* pMessage, const char* peer, uint64_t pJobID);
+        virtual void Update(const char* pMessage, const char* peer);
+        virtual void Warning(const char* pMessage, const char* peer);
 };
 
 #endif
diff --git a/src/Daemon/CrashWatcher.cpp b/src/Daemon/CrashWatcher.cpp
index 4d68a811..b2215716 100644
--- a/src/Daemon/CrashWatcher.cpp
+++ b/src/Daemon/CrashWatcher.cpp
@@ -22,18 +22,18 @@
 #include "DebugDump.h"
 #include "CrashWatcher.h"
 
-void CCrashWatcher::Status(const char *pMessage, const char* peer, uint64_t pJobID)
+void CCrashWatcher::Status(const char *pMessage, const char* peer)
 {
     VERB1 log("Update('%s'): %s", peer, pMessage);
     if (g_pCommLayer != NULL)
-        g_pCommLayer->Update(pMessage, peer, pJobID);
+        g_pCommLayer->Update(pMessage, peer);
 }
 
-void CCrashWatcher::Warning(const char *pMessage, const char* peer, uint64_t pJobID)
+void CCrashWatcher::Warning(const char *pMessage, const char* peer)
 {
     VERB1 log("Warning('%s'): %s", peer, pMessage);
     if (g_pCommLayer != NULL)
-        g_pCommLayer->Warning(pMessage, peer, pJobID);
+        g_pCommLayer->Warning(pMessage, peer);
 }
 
 CCrashWatcher::CCrashWatcher()
@@ -44,32 +44,31 @@ CCrashWatcher::~CCrashWatcher()
 {
 }
 
-vector_map_crash_data_t GetCrashInfos(const char *pUID)
+vector_map_crash_data_t GetCrashInfos(long caller_uid)
 {
     vector_map_crash_data_t retval;
     log("Getting crash infos...");
     try
     {
-        vector_pair_string_string_t UUIDsUIDs;
-        UUIDsUIDs = GetUUIDsOfCrash(pUID);
+        vector_string_t crash_ids;
+        GetUUIDsOfCrash(caller_uid, crash_ids);
 
         unsigned int ii;
-        for (ii = 0; ii < UUIDsUIDs.size(); ii++)
+        for (ii = 0; ii < crash_ids.size(); ii++)
         {
-            const char *uuid = UUIDsUIDs[ii].first.c_str();
-            const char *uid = UUIDsUIDs[ii].second.c_str();
+            const char *crash_id = crash_ids[ii].c_str();
 
             map_crash_data_t info;
-            mw_result_t res = FillCrashInfo(uuid, uid, info);
+            mw_result_t res = FillCrashInfo(crash_id, info);
             switch (res)
             {
                 case MW_OK:
                     retval.push_back(info);
                     break;
                 case MW_ERROR:
-                    error_msg("Dump directory for UUID %s doesn't exist or misses crucial files, deleting", uuid);
+                    error_msg("Dump directory for crash_id %s doesn't exist or misses crucial files, deleting", crash_id);
                     /* Deletes both DB record and dump dir */
-                    DeleteDebugDump(uuid, uid);
+                    DeleteDebugDump(crash_id, /*caller_uid:*/ 0);
                     break;
                 default:
                     break;
@@ -81,8 +80,6 @@ vector_map_crash_data_t GetCrashInfos(const char *pUID)
         error_msg("%s", e.what());
     }
 
-    //retval = GetCrashInfos(pUID);
-    //Notify("Sent crash info");
     return retval;
 }
 
@@ -94,37 +91,37 @@ vector_map_crash_data_t GetCrashInfos(const char *pUID)
  * StartJob dbus call already did all the processing, and we just retrieve
  * the result from dump directory, which is fast.
  */
-void CreateReport(const char* pUUID, const char* pUID, int force, map_crash_data_t& crashReport)
+void CreateReport(const char* crash_id, long caller_uid, int force, map_crash_data_t& crashReport)
 {
     /* FIXME: starting from here, any shared data must be protected with a mutex.
      * For example, CreateCrashReport does:
      * g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
      * which is unsafe wrt concurrent updates to g_pPluginManager state.
      */
-    mw_result_t res = CreateCrashReport(pUUID, pUID, force, crashReport);
+    mw_result_t res = CreateCrashReport(crash_id, caller_uid, force, crashReport);
     switch (res)
     {
         case MW_OK:
             VERB2 log_map_crash_data(crashReport, "crashReport");
             break;
         case MW_IN_DB_ERROR:
-            error_msg("Can't find crash with UUID %s in database", pUUID);
+            error_msg("Can't find crash with id %s in database", crash_id);
             break;
         case MW_PLUGIN_ERROR:
             error_msg("Particular analyzer plugin isn't loaded or there is an error within plugin(s)");
             break;
         default:
-            error_msg("Corrupted crash with UUID %s, deleting", pUUID);
-            DeleteDebugDump(pUUID, pUID);
+            error_msg("Corrupted crash with id %s, deleting", crash_id);
+            DeleteDebugDump(crash_id, /*caller_uid:*/ 0);
             break;
     }
 }
 
 typedef struct thread_data_t {
     pthread_t thread_id;
-    char* UUID;
-    char* UID;
+    long caller_uid;
     int force;
+    char* crash_id;
     char* peer;
 } thread_data_t;
 static void* create_report(void* arg)
@@ -138,8 +135,8 @@ static void* create_report(void* arg)
     {
         log("Creating report...");
         map_crash_data_t crashReport;
-        CreateReport(thread_data->UUID, thread_data->UID, thread_data->force, crashReport);
-        g_pCommLayer->JobDone(thread_data->peer, thread_data->UUID);
+        CreateReport(thread_data->crash_id, thread_data->caller_uid, thread_data->force, crashReport);
+        g_pCommLayer->JobDone(thread_data->peer);
     }
     catch (CABRTException& e)
     {
@@ -149,19 +146,18 @@ static void* create_report(void* arg)
     set_client_name(NULL);
 
     /* free strduped strings */
-    free(thread_data->UUID);
-    free(thread_data->UID);
+    free(thread_data->crash_id);
     free(thread_data->peer);
     free(thread_data);
 
     /* Bogus value. pthreads require us to return void* */
     return NULL;
 }
-int CreateReportThread(const char* pUUID, const char* pUID, int force, const char* pSender)
+int CreateReportThread(const char* crash_id, long caller_uid, int force, const char* pSender)
 {
     thread_data_t *thread_data = (thread_data_t *)xzalloc(sizeof(thread_data_t));
-    thread_data->UUID = xstrdup(pUUID);
-    thread_data->UID = xstrdup(pUID);
+    thread_data->crash_id = xstrdup(crash_id);
+    thread_data->caller_uid = caller_uid;
     thread_data->force = force;
     thread_data->peer = xstrdup(pSender);
 
@@ -172,8 +168,7 @@ int CreateReportThread(const char* pUUID, const char* pUID, int force, const cha
     pthread_attr_destroy(&attr);
     if (r != 0)
     {
-        free(thread_data->UUID);
-        free(thread_data->UID);
+        free(thread_data->crash_id);
         free(thread_data->peer);
         free(thread_data);
         /* The only reason this may happen is system-wide resource starvation,
@@ -188,16 +183,27 @@ int CreateReportThread(const char* pUUID, const char* pUID, int force, const cha
 
 
 /* Remove dump dir and its DB record */
-int DeleteDebugDump(const char *pUUID, const char *pUID)
+int DeleteDebugDump(const char *crash_id, long caller_uid)
 {
     try
     {
         CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
         database->Connect();
-        database_row_t row = database->GetRow(pUUID, pUID);
-        database->DeleteRow(pUUID, pUID);
+        database_row_t row = database->GetRow(crash_id);
+        if (row.m_sUUID == "")
+        {
+            database->DisConnect();
+            return ENOENT;
+        }
+        if (caller_uid != 0 /* not called by root */
+         && row.m_sInformAll != "1"
+         && to_string(caller_uid) != row.m_sUID
+        ) {
+            database->DisConnect();
+            return EPERM;
+        }
+        database->DeleteRow(crash_id);
         database->DisConnect();
-
         const char *dump_dir = row.m_sDebugDumpDir.c_str();
         if (dump_dir[0] != '\0')
         {
@@ -209,7 +215,7 @@ int DeleteDebugDump(const char *pUUID, const char *pUID)
     {
         error_msg("%s", e.what());
     }
-    return -1; /* failure */
+    return EIO; /* generic failure code */
 }
 
 void DeleteDebugDump_by_dir(const char *dump_dir)
diff --git a/src/Daemon/CrashWatcher.h b/src/Daemon/CrashWatcher.h
index eaf24997..015bd70f 100644
--- a/src/Daemon/CrashWatcher.h
+++ b/src/Daemon/CrashWatcher.h
@@ -43,14 +43,14 @@ class CCrashWatcher
 
     public:
         /* Observer methods */
-        virtual void Status(const char *pMessage, const char* peer, uint64_t pJobID);
-        virtual void Warning(const char *pMessage, const char* peer, uint64_t pJobID);
+        virtual void Status(const char *pMessage, const char* peer);
+        virtual void Warning(const char *pMessage, const char* peer);
 };
 
-vector_map_crash_data_t GetCrashInfos(const char *pUID);
-int CreateReportThread(const char* pUUID, const char* pUID, int force, const char* pSender);
-void CreateReport(const char* pUUID, const char* pUID, int force, map_crash_data_t&);
-int DeleteDebugDump(const char *pUUID, const char *pUID);
+vector_map_crash_data_t GetCrashInfos(long caller_uid);
+int  CreateReportThread(const char* crash_id, long caller_uid, int force, const char* pSender);
+void CreateReport(const char* crash_id, long caller_uid, int force, map_crash_data_t&);
+int  DeleteDebugDump(const char *crash_id, long caller_uid);
 void DeleteDebugDump_by_dir(const char *dump_dir);
 
 #endif
diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp
index 704d2c35..46bd9502 100644
--- a/src/Daemon/Daemon.cpp
+++ b/src/Daemon/Daemon.cpp
@@ -42,6 +42,8 @@
 #include "DebugDump.h"
 #include "Daemon.h"
 
+using namespace std;
+
 
 /* Daemon initializes, then sits in glib main loop, waiting for events.
  * Events can be:
@@ -53,16 +55,16 @@
  * - GetCrashInfos(): returns a vector_map_crash_data_t (vector_map_vector_string_t)
  *      of crashes for given uid
  *      v[N]["executable"/"uid"/"kernel"/"backtrace"][N] = "contents"
- * - StartJob(UUID,force): starts creating a report for /var/cache/abrt/DIR with this UUID.
+ * - StartJob(crash_id,force): starts creating a report for /var/cache/abrt/DIR with this UID:UUID.
  *      Returns job id (uint64).
  *      After thread returns, when report creation thread has finished,
- *      JobDone(client_dbus_ID,UUID) dbus signal is emitted.
- * - CreateReport(UUID): returns map_crash_data_t (map_vector_string_t)
+ *      JobDone() dbus signal is emitted.
+ * - CreateReport(crash_id): returns map_crash_data_t (map_vector_string_t)
  * - Report(map_crash_data_t (map_vector_string_t[, map_map_string_t])):
  *      "Please report this crash": calls Report() of all registered reporter plugins.
  *      Returns report_status_t (map_vector_string_t) - the status of each call.
  *      2nd parameter is the contents of user's abrt.conf.
- * - DeleteDebugDump(UUID): delete it from DB and delete corresponding /var/cache/abrt/DIR
+ * - DeleteDebugDump(crash_id): delete it from DB and delete corresponding /var/cache/abrt/DIR
  * - GetPluginsInfo(): returns map_map_string_t
  *      map["plugin"] = { "Name": "plugin", "Enabled": "yes" ... }
  * - GetPluginSettings(PluginName): returns map_plugin_settings_t (map_string_t)
@@ -74,16 +76,12 @@
  *
  * DBus signals we emit:
  * - Crash(progname,uid) - a new crash occurred (new /var/cache/abrt/DIR is found)
- * - JobDone(client_dbus_ID,UUID) - see StartJob above.
+ * - JobDone(client_dbus_ID) - see StartJob above.
  *      Sent as unicast to the client which did StartJob.
- * - Warning(msg,job_id)
- * - Update(msg,job_id)
+ * - Warning(msg)
+ * - Update(msg)
  *      Both are sent as unicast to last client set by set_client_name(name).
  *      If set_client_name(NULL) was done, they are not sent.
- *
- * TODO:
- * - JobDone signal does not need to pass any parameters
- *   - our clients never send multiple StartJob's.
  */
 
 
@@ -514,7 +512,7 @@ static gboolean handle_inotify_cb(GIOChannel *gio, GIOCondition condition, gpoin
 #define fullname fullname_should_not_be_used_here
 
                     const char *analyzer = get_crash_data_item_content(crashinfo, FILENAME_ANALYZER).c_str();
-                    const char *uid_str = get_crash_data_item_content(crashinfo, FILENAME_UID).c_str();
+                    const char *uid_str = get_crash_data_item_content(crashinfo, CD_UID).c_str();
 
                     /* Autoreport it if configured to do so */
                     if (res != MW_REPORTED
@@ -522,9 +520,12 @@ static gboolean handle_inotify_cb(GIOChannel *gio, GIOCondition condition, gpoin
                     ) {
                         VERB1 log("Reporting the crash automatically");
                         map_crash_data_t crash_report;
+                        string crash_id = ssprintf("%s:%s", uid_str, get_crash_data_item_content(crashinfo, CD_UUID).c_str());
                         mw_result_t crash_result = CreateCrashReport(
-                                        get_crash_data_item_content(crashinfo, CD_UUID).c_str(),
-                                        uid_str, /*force:*/ 0, crash_report
+                                        crash_id.c_str(),
+                                        /*caller_uid:*/ 0,
+                                        /*force:*/ 0,
+                                        crash_report
                         );
                         if (crash_result == MW_OK)
                         {
diff --git a/src/Daemon/MiddleWare.cpp b/src/Daemon/MiddleWare.cpp
index 16b86da0..1ed13e86 100644
--- a/src/Daemon/MiddleWare.cpp
+++ b/src/Daemon/MiddleWare.cpp
@@ -235,24 +235,34 @@ static void run_analyser_CreateReport(const char *pAnalyzer,
     /* else: GetAnalyzer() already complained, no need to handle it here */
 }
 
-mw_result_t CreateCrashReport(const char *pUUID,
-                const char *pUID,
+/*
+ * Called in three cases:
+ * (1) by StartJob dbus call -> CreateReportThread(), in the thread
+ * (2) by CreateReport dbus call
+ * (3) by daemon if AutoReportUID is set for this user's crashes
+ */
+mw_result_t CreateCrashReport(const char *crash_id,
+                long caller_uid,
                 int force,
                 map_crash_data_t& pCrashData)
 {
-    VERB2 log("CreateCrashReport('%s','%s',result)", pUUID, pUID);
+    VERB2 log("CreateCrashReport('%s',%ld,result)", crash_id, caller_uid);
 
     database_row_t row;
-    if (pUUID[0] != '\0')
+    CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
+    database->Connect();
+    row = database->GetRow(crash_id);
+    database->DisConnect();
+    if (row.m_sUUID == "")
     {
-        CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
-        database->Connect();
-        row = database->GetRow(pUUID, pUID);
-        database->DisConnect();
+        error_msg("crash '%s' is not in database", crash_id);
+        return MW_IN_DB_ERROR;
     }
-    if (pUUID[0] == '\0' || row.m_sUUID != pUUID)
-    {
-        error_msg("UUID '%s' is not in database", pUUID);
+    if (caller_uid != 0 /* not called by root */
+     && row.m_sInformAll != "1"
+     && to_string(caller_uid) != row.m_sUID
+    ) {
+        error_msg("crash '%s' can't be accessed by user with uid %ld", crash_id, caller_uid);
         return MW_IN_DB_ERROR;
     }
 
@@ -282,9 +292,8 @@ mw_result_t CreateCrashReport(const char *pUUID,
         RunAnalyzerActions(analyzer.c_str(), row.m_sDebugDumpDir.c_str(), force);
 
         DebugDumpToCrashReport(row.m_sDebugDumpDir.c_str(), pCrashData);
-
+        add_to_crash_data_ext(pCrashData, CD_UUID   , CD_SYS, CD_ISNOTEDITABLE, row.m_sUUID.c_str());
         add_to_crash_data_ext(pCrashData, CD_DUPHASH, CD_TXT, CD_ISNOTEDITABLE, dup_hash.c_str());
-        add_to_crash_data_ext(pCrashData, CD_UUID   , CD_SYS, CD_ISNOTEDITABLE, pUUID);
     }
     catch (CABRTException& e)
     {
@@ -366,20 +375,34 @@ void RunActionsAndReporters(const char *pDebugDumpDir)
 // dbus handler passes it from user without checking
 report_status_t Report(const map_crash_data_t& client_report,
                        map_map_string_t& pSettings,
-                       const char *pUID)
+                       long caller_uid)
 {
     // Get ID fields
-    const char *UID = get_crash_data_item_content_or_NULL(client_report, FILENAME_UID);
+    const char *UID = get_crash_data_item_content_or_NULL(client_report, CD_UID);
     const char *UUID = get_crash_data_item_content_or_NULL(client_report, CD_UUID);
-    if (!UID || !UUID) {
+    if (!UID || !UUID)
+    {
         throw CABRTException(EXCEP_ERROR, "Report(): UID or UUID is missing in client's report data");
     }
+    string crash_id = ssprintf("%s:%s", UID, UUID);
 
     // Retrieve corresponding stored record
     map_crash_data_t stored_report;
-    mw_result_t r = FillCrashInfo(UUID, UID, stored_report);
+    mw_result_t r = FillCrashInfo(crash_id.c_str(), stored_report);
     if (r != MW_OK)
+    {
         return report_status_t();
+    }
+
+    // Is it allowed for this user to report?
+    if (caller_uid != 0   // not called by root
+     && get_crash_data_item_content(stored_report, CD_INFORMALL) != "1"
+     && strcmp(to_string(caller_uid).c_str(), UID) != 0
+    ) {
+        throw CABRTException(EXCEP_ERROR, "Report(): user with uid %ld can't report crash %s",
+                        caller_uid, crash_id.c_str());
+    }
+
     const std::string& pDumpDir = get_crash_data_item_content(stored_report, CD_DUMPDIR);
 
     // Save comment, "how to reproduce", backtrace
@@ -536,11 +559,11 @@ report_status_t Report(const map_crash_data_t& client_report,
             const vector_string_t &v = ret_it->second;
             if (v[REPORT_STATUS_IDX_FLAG] == "1")
             {
-                database->SetReportedPerReporter(UUID, UID, plugin_name.c_str(), v[REPORT_STATUS_IDX_MSG].c_str());
+                database->SetReportedPerReporter(crash_id.c_str(), plugin_name.c_str(), v[REPORT_STATUS_IDX_MSG].c_str());
             }
             ret_it++;
         }
-        database->SetReported(UUID, UID, message.c_str());
+        database->SetReported(crash_id.c_str(), message.c_str());
         database->DisConnect();
     }
 
@@ -556,14 +579,14 @@ report_status_t Report(const map_crash_data_t& client_report,
  * @return It returns true if debugdump dir is already saved, otherwise
  * it returns false.
  */
-static bool IsDebugDumpSaved(const char *pUID,
+static bool IsDebugDumpSaved(long uid,
                                    const char *pDebugDumpDir)
 {
     /* TODO: use database query instead of dumping all rows and searching in them */
 
     CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
     database->Connect();
-    vector_database_rows_t rows = database->GetUIDData(pUID);
+    vector_database_rows_t rows = database->GetUIDData(uid);
     database->DisConnect();
 
     int ii;
@@ -838,8 +861,8 @@ static void RunAnalyzerActions(const char *pAnalyzer, const char *pDebugDumpDir,
  * @param pCrashData A filled crash info.
  * @return It return results of operation. See mw_result_t.
  */
-static mw_result_t SaveDebugDumpToDatabase(const char *pUUID,
-                const char *pUID,
+static mw_result_t SaveDebugDumpToDatabase(const char *crash_id,
+                bool inform_all_users,
                 const char *pTime,
                 const char *pDebugDumpDir,
                 map_crash_data_t& pCrashData)
@@ -847,11 +870,11 @@ static mw_result_t SaveDebugDumpToDatabase(const char *pUUID,
     CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
     database->Connect();
     /* note: if [UUID,UID] record exists, pDebugDumpDir is not updated in the record */
-    database->Insert_or_Update(pUUID, pUID, pDebugDumpDir, pTime);
-    database_row_t row = database->GetRow(pUUID, pUID);
+    database->Insert_or_Update(crash_id, inform_all_users, pDebugDumpDir, pTime);
+    database_row_t row = database->GetRow(crash_id);
     database->DisConnect();
 
-    mw_result_t res = FillCrashInfo(pUUID, pUID, pCrashData);
+    mw_result_t res = FillCrashInfo(crash_id, pCrashData);
     if (res == MW_OK)
     {
         const char *first = get_crash_data_item_content(pCrashData, CD_DUMPDIR).c_str();
@@ -869,15 +892,6 @@ static mw_result_t SaveDebugDumpToDatabase(const char *pUUID,
     return res;
 }
 
-std::string getDebugDumpDir(const char *pUUID, const char *pUID)
-{
-    CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
-    database->Connect();
-    database_row_t row = database->GetRow(pUUID, pUID);
-    database->DisConnect();
-    return row.m_sDebugDumpDir;
-}
-
 mw_result_t SaveDebugDump(const char *pDebugDumpDir,
                 map_crash_data_t& pCrashData)
 {
@@ -891,7 +905,7 @@ mw_result_t SaveDebugDump(const char *pDebugDumpDir,
         CDebugDump dd;
         dd.Open(pDebugDumpDir);
         dd.LoadText(FILENAME_TIME, time);
-        dd.LoadText(FILENAME_UID, UID);
+        dd.LoadText(CD_UID, UID);
         dd.LoadText(FILENAME_ANALYZER, analyzer);
         dd.LoadText(FILENAME_EXECUTABLE, executable);
         dd.LoadText(FILENAME_CMDLINE, cmdline);
@@ -902,7 +916,7 @@ mw_result_t SaveDebugDump(const char *pDebugDumpDir,
         return MW_ERROR;
     }
 
-    if (IsDebugDumpSaved(UID.c_str(), pDebugDumpDir))
+    if (IsDebugDumpSaved(xatou(UID.c_str()), pDebugDumpDir))
     {
         return MW_IN_DB;
     }
@@ -913,10 +927,8 @@ mw_result_t SaveDebugDump(const char *pDebugDumpDir,
         return res;
     }
 
-    std::string lUUID = GetLocalUUID(analyzer.c_str(), pDebugDumpDir);
-    const char *uid_str = analyzer_has_InformAllUsers(analyzer.c_str())
-        ? "-1"
-        : UID.c_str();
+    std::string UUID = GetLocalUUID(analyzer.c_str(), pDebugDumpDir);
+    std::string crash_id = ssprintf("%s:%s", UID.c_str(), UUID.c_str());
     /* Loads pCrashData (from the *first debugdump dir* if this one is a dup)
      * Returns:
      * MW_REPORTED: "the crash is flagged as reported in DB" (which also means it's a dup)
@@ -924,16 +936,19 @@ mw_result_t SaveDebugDump(const char *pDebugDumpDir,
      * MW_OK: "crash count is 1" (iow: this is a new crash, not a dup)
      * else: an error code
      */
-    return SaveDebugDumpToDatabase(lUUID.c_str(), uid_str, time.c_str(), pDebugDumpDir, pCrashData);
+    return SaveDebugDumpToDatabase(crash_id.c_str(),
+                analyzer_has_InformAllUsers(analyzer.c_str()),
+                time.c_str(),
+                pDebugDumpDir,
+                pCrashData);
 }
 
-mw_result_t FillCrashInfo(const char *pUUID,
-                const char *pUID,
+mw_result_t FillCrashInfo(const char *crash_id,
                 map_crash_data_t& pCrashData)
 {
     CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
     database->Connect();
-    database_row_t row = database->GetRow(pUUID, pUID);
+    database_row_t row = database->GetRow(crash_id);
     database->DisConnect();
 
     std::string package;
@@ -952,34 +967,32 @@ mw_result_t FillCrashInfo(const char *pUUID,
         return MW_ERROR;
     }
 
+    add_to_crash_data(pCrashData, CD_UID              , row.m_sUID.c_str()         );
     add_to_crash_data(pCrashData, CD_UUID             , row.m_sUUID.c_str()        );
+    add_to_crash_data(pCrashData, CD_INFORMALL        , row.m_sInformAll.c_str()   );
     add_to_crash_data(pCrashData, CD_COUNT            , row.m_sCount.c_str()       );
     add_to_crash_data(pCrashData, CD_REPORTED         , row.m_sReported.c_str()    );
     add_to_crash_data(pCrashData, CD_MESSAGE          , row.m_sMessage.c_str()     );
     add_to_crash_data(pCrashData, CD_DUMPDIR          , row.m_sDebugDumpDir.c_str());
-//TODO: why do we keep uid and time in DB and in dumpdir?!
-    add_to_crash_data(pCrashData, FILENAME_UID        , row.m_sUID.c_str()         );
     add_to_crash_data(pCrashData, FILENAME_TIME       , row.m_sTime.c_str()        );
 
     return MW_OK;
 }
 
-vector_pair_string_string_t GetUUIDsOfCrash(const char *pUID)
+void GetUUIDsOfCrash(long caller_uid, vector_string_t &result)
 {
     CDatabase* database = g_pPluginManager->GetDatabase(g_settings_sDatabase.c_str());
     vector_database_rows_t rows;
     database->Connect();
-    rows = database->GetUIDData(pUID);
+    rows = database->GetUIDData(caller_uid);
     database->DisConnect();
 
-    vector_pair_string_string_t UUIDsUIDs;
     unsigned ii;
     for (ii = 0; ii < rows.size(); ii++)
     {
-        UUIDsUIDs.push_back(make_pair(rows[ii].m_sUUID, rows[ii].m_sUID));
+        string crash_id = ssprintf("%s:%s", rows[ii].m_sUID.c_str(), rows[ii].m_sUUID.c_str());
+        result.push_back(crash_id);
     }
-
-    return UUIDsUIDs;
 }
 
 void AddAnalyzerActionOrReporter(const char *pAnalyzer,
diff --git a/src/Daemon/MiddleWare.h b/src/Daemon/MiddleWare.h
index 94f9fb99..275d5312 100644
--- a/src/Daemon/MiddleWare.h
+++ b/src/Daemon/MiddleWare.h
@@ -29,8 +29,8 @@
  * An enum contains all return codes.
  */
 typedef enum {
-    MW_ERROR,            /**< Common error.*/
     MW_OK,               /**< No error.*/
+    MW_ERROR,            /**< Common error.*/
     MW_BLACKLISTED,      /**< Package is blacklisted.*/
     MW_CORRUPTED,        /**< Debugdump directory is corrupted.*/
     MW_PACKAGE_ERROR,    /**< Cannot determine package name.*/
@@ -62,8 +62,8 @@ void LoadOpenGPGPublicKey(const char* key);
  * @param pCrashData A filled crash report.
  * @return It return results of operation. See mw_result_t.
  */
-mw_result_t CreateCrashReport(const char *pUUID,
-                              const char *pUID,
+mw_result_t CreateCrashReport(const char *crash_id,
+                              long caller_uid,
                               int force,
                               map_crash_data_t& pCrashData);
 /**
@@ -93,16 +93,7 @@ void RunActionsAndReporters(const char *pDebugDumpDir);
  */
 report_status_t Report(const map_crash_data_t& pCrashData,
                        map_map_string_t& pSettings,
-                       const char *pUID);
-/**
- * Get debugdump direcotory. If debugdump is not found
- * in database it will return empty string.
- * @param pUUID A local UUID of a crash.
- * @param pUID An UID of an user.
- * @return A debugdump directory.
- */
-std::string getDebugDumpDir( const char *pUUID,
-                             const char *pUID);
+                       long caller_uid);
 /**
  * Adds package name and description to debugdump dir.
  * Saves debugdump into database.
@@ -123,8 +114,7 @@ mw_result_t SaveDebugDump(const char *pDebugDumpDir,
  * @param pCrashData A crash info.
  * @return It return results of operation. See mw_result_t.
  */
-mw_result_t FillCrashInfo(const char *pUUID,
-                        const char *pUID,
+mw_result_t FillCrashInfo(const char *crash_id,
                         map_crash_data_t& pCrashData);
 /**
  * Gets all local UUIDs and UIDs of crashes. These crashes
@@ -132,7 +122,7 @@ mw_result_t FillCrashInfo(const char *pUUID,
  * @param pUID an UID of an user.
  * @return A vector of pairs  (local UUID, UID).
  */
-vector_pair_string_string_t GetUUIDsOfCrash(const char *pUID);
+void GetUUIDsOfCrash(long caller_uid, vector_string_t &result);
 /**
  * Adds one association among alanyzer plugin and its
  * action and reporter plugins.