Description of problem:
QMF opcode _query_request does not authorize against ACL. That allows any user (that can publish to QMF exchange, create+consume from temp.queue,..) to get details about any broker object.


Version-Release number of selected component (if applicable):
qpid-cpp-0.22-40


How reproducible:
100%


Steps to Reproduce:
1) Start broker with any ACL file you want, with trace+:acl logging
2) run this python script:
#!/usr/bin/python

from qpid.messaging import *

conn = Connection("guest/guest@localhost:5672")
try:
    conn.open()
    ssn = conn.session()
    snd = ssn.sender("qmf.default.direct/broker")
    reply_to = "reply-queue; {create:always, node:{x-declare:{auto-delete:true}}}"
    rcv = ssn.receiver(reply_to)

    content = {
        "_what": "OBJECT",
        "_object_id": {"_object_name": "org.apache.qpid.broker:broker:amqp-broker"}
        }
    request = Message(reply_to=reply_to, content=content)
    request.properties["x-amqp-0-10.app-id"] = "qmf2"
    request.properties["qmf.opcode"] = "_query_request"
    snd.send(request)

    try:
        response = rcv.fetch()
        print response
    except Exception, e:
        print e
except ReceiverError, e:
    print e
except KeyboardInterrupt:
    pass
conn.close()

(optionally, replace _object_id by whatever object you want to query for, i.e. a queue, exchange,..)


Actual results:
Broker provides the response and no ACL check (access queue, access method,..) is made


Expected results:
A new ACL object "request" similar to "method" to be added, or "method" to be applied to _query_request as well.


Additional info:
It would be nice if _query_request can differentiate based on object name or type to be requested. I.e. to have the ability to allow user A to request queue Q1 but not queue Q2 and allow user B to request only exchanges.