fix another encryption_key vs encryption-key instance

[pve-storage.git] / PVE / API2 / Storage / Config.pm

diff --git a/PVE/API2/Storage/Config.pm b/PVE/API2/Storage/Config.pm
index d20278495136b772c3fe0318454e36daf683b2c0..09ba747ddfe81755598593dd3911f6381c476c80 100755 (executable)
--- a/PVE/API2/Storage/Config.pm
+++ b/PVE/API2/Storage/Config.pm
@@ -112,6 +112,29 @@ __PACKAGE__->register_method ({
        return &$api_storage_config($cfg, $param->{storage});
     }});
 
+my sub extract_sensitive_params :prototype($$) {
+    my ($param, $delete_list) = @_;
+
+    my $sensitive;
+
+    my %delete = map { $_ => 1 } ($delete_list || [])->@*;
+
+    # always extract pw and keys, so they don't get written to the www-data readable scfg
+    for my $opt (qw(password encryption-key)) {
+       # First handle deletions as explicitly setting `undef`, afterwards new values may override
+       # it.
+       if (exists($delete{$opt})) {
+           $sensitive->{$opt} = undef;
+       }
+
+       if (defined(my $value = extract_param($param, $opt))) {
+           $sensitive->{$opt} = $value;
+       }
+    }
+
+    return $sensitive;
+}
+
 __PACKAGE__->register_method ({
     name => 'create',
     protected => 1,
@@ -133,15 +156,7 @@ __PACKAGE__->register_method ({
        # fix me in section config create never need an empty entity.
        delete $param->{nodes} if !$param->{nodes};
 
-       my $password;
-       # always extract pw, else it gets written to the www-data readable scfg
-       if (my $tmp_pw = extract_param($param, 'password')) {
-           if (($type eq 'pbs') || ($type eq 'cifs' && $param->{username})) {
-               $password = $tmp_pw;
-           } else {
-               warn "ignore password parameter\n";
-           }
-       }
+       my $sensitive = extract_sensitive_params($param, []);
 
        my $plugin = PVE::Storage::Plugin->lookup($type);
        my $opts = $plugin->check_config($storeid, $param, 1, 1);
@@ -157,7 +172,7 @@ __PACKAGE__->register_method ({
 
                $cfg->{ids}->{$storeid} = $opts;
 
-               $plugin->on_add_hook($storeid, $opts, password => $password);
+               $plugin->on_add_hook($storeid, $opts, %$sensitive);
 
                eval {
                    # try to activate if enabled on local node,
@@ -166,7 +181,7 @@ __PACKAGE__->register_method ({
                        PVE::Storage::activate_storage($cfg, $storeid);
                    }
                };
-               if(my $err = $@) {
+               if (my $err = $@) {
                    eval { $plugin->on_delete_hook($storeid, $opts) };
                    warn "$@\n" if $@;
                    die $err;
@@ -197,6 +212,10 @@ __PACKAGE__->register_method ({
        my $digest = extract_param($param, 'digest');
        my $delete = extract_param($param, 'delete');
 
+       if ($delete) {
+           $delete = [ PVE::Tools::split_list($delete) ];
+       }
+
         PVE::Storage::lock_storage_config(sub {
 
            my $cfg = PVE::Storage::config();
@@ -204,13 +223,16 @@ __PACKAGE__->register_method ({
            PVE::SectionConfig::assert_if_modified($cfg, $digest);
 
            my $scfg = PVE::Storage::storage_config($cfg, $storeid);
+           my $type = $scfg->{type};
+
+           my $sensitive = extract_sensitive_params($param, $delete);
 
-           my $plugin = PVE::Storage::Plugin->lookup($scfg->{type});
+           my $plugin = PVE::Storage::Plugin->lookup($type);
            my $opts = $plugin->check_config($storeid, $param, 0, 1);
 
            if ($delete) {
-               my $options = $plugin->private()->{options}->{$scfg->{type}};
-               foreach my $k (PVE::Tools::split_list($delete)) {
+               my $options = $plugin->private()->{options}->{$type};
+               foreach my $k (@$delete) {
                    my $d = $options->{$k} || die "no such option '$k'\n";
                    die "unable to delete required option '$k'\n" if !$d->{optional};
                    die "unable to delete fixed option '$k'\n" if $d->{fixed};
@@ -221,6 +243,8 @@ __PACKAGE__->register_method ({
                }
            }
 
+           $plugin->on_update_hook($storeid, $opts, %$sensitive);
+
            for my $k (keys %$opts) {
                $scfg->{$k} = $opts->{$k};
            }