storage add: always extract password from parameters

[pve-storage.git] / PVE / API2 / Storage / Config.pm

diff --git a/PVE/API2/Storage/Config.pm b/PVE/API2/Storage/Config.pm
index 3b38304c801fa664d62d61842f6d763a436fdc1d..95ca9b86d9f637ea5d41e8c0142064dad7c3428d 100755 (executable)
--- a/PVE/API2/Storage/Config.pm
+++ b/PVE/API2/Storage/Config.pm
@@ -103,7 +103,7 @@ __PACKAGE__->register_method ({
            storage => get_standard_option('pve-storage-id'),
        },
     },
-    returns => {},
+    returns => { type => 'object' },
     code => sub {
        my ($param) = @_;
 
@@ -133,8 +133,15 @@ __PACKAGE__->register_method ({
        # fix me in section config create never need an empty entity.
        delete $param->{nodes} if !$param->{nodes};
 
-       my $password = extract_param($param, 'password')
-           if $type eq 'cifs' && $param->{username};
+       my $password;
+       # always extract pw, else it gets written to the www-data readable scfg
+       if (my $tmp_pw = extract_param($param, 'password')) {
+           if ($type eq 'cifs' && $param->{username}) {
+               $password = $tmp_pw;
+           } else {
+               warn "ignore password parameter\n";
+           }
+       }
 
        if ($param->{portal}) {
            $param->{portal} = PVE::Storage::resolv_portal($param->{portal});
@@ -154,6 +161,8 @@ __PACKAGE__->register_method ({
 
                $cfg->{ids}->{$storeid} = $opts;
 
+               my $cred_file = undef;
+
                if ($type eq 'lvm' && $opts->{base}) {
 
                    my ($baseid, $volname) = PVE::Storage::parse_volume_id($opts->{base});
@@ -186,11 +195,11 @@ __PACKAGE__->register_method ({
                        unlink $ceph_storage_keyring;
                        die "failed to copy ceph authx keyring for storage '$storeid': $err\n";
                    }
+               } elsif ($type eq 'cifs' && defined($password)) {
+                   # create a password file in /etc/pve/priv,
+                   # this file is used as a cert_file at mount time.
+                   $cred_file = PVE::Storage::CIFSPlugin::cifs_set_credentials($password, $storeid);
                }
-               # create a password file in /etc/pve/priv,
-               # this file is used as a cert_file at mount time.
-               my $cred_file = PVE::Storage::CIFSPlugin::cifs_set_credentials($password, $storeid)
-                   if $type eq 'cifs' && defined($password);
 
                eval {
                    # try to activate if enabled on local node,