]> git.proxmox.com Git - proxmox-backup.git/commitdiff
projects / proxmox-backup.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 0c6b83d)
REST server: avoid hard coding world readable API endpoints
authorThomas Lamprecht <t.lamprecht@proxmox.com>
Fri, 2 Oct 2020 11:17:12 +0000 (13:17 +0200)
committerDietmar Maurer <dietmar@proxmox.com>
Mon, 5 Oct 2020 06:29:43 +0000 (08:29 +0200)
while we probably do not add much more to them, it still looks ugly.

If this was made so that adding a World readable API call is "hard"
and not done by accident, it rather should be done as a test on build
time. But, IMO, the API permission schema definitions are easy to
review, and not often changed/added - so any wrong World readable API
call will normally still caught.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
src/server/rest.rs patch | blob | blame | history

diff --git a/src/server/rest.rs b/src/server/rest.rs
index feb0b4628daeae21cada3dfb2bfcbe64572b1968..4cfdd6c0587028d131c74ea1015ef37e0a5b63a1 100644 (file)
--- a/src/server/rest.rs
+++ b/src/server/rest.rs
@@ -22,6 +22,7 @@ use proxmox::api::{
     ApiHandler,
     ApiMethod,
     HttpError,
+    Permission,
     RpcEnvironment,
     RpcEnvironmentType,
     check_api_permission,
@@ -546,13 +547,16 @@ pub async fn handle_request(api: Arc<ApiConfig>, req: Request<Body>) -> Result<R
             };
 
             let mut uri_param = HashMap::new();
+            let api_method = api.find_method(&components[2..], method.clone(), &mut uri_param);
 
-            if comp_len == 4 && components[2] == "access" && (
-                (components[3] == "ticket" && method ==  hyper::Method::POST) ||
-                (components[3] == "domains" && method ==  hyper::Method::GET)
-            ) {
-                // explicitly allow those calls without auth
-            } else {
+            let mut auth_required = true;
+            if let Some(api_method) = api_method {
+                if let Permission::World = *api_method.access.permission {
+                    auth_required = false; // no auth for endpoints with World permission
+                }
+            }
+
+            if auth_required {
                 let (ticket, token, _) = extract_auth_data(&parts.headers);
                 match check_auth(&method, &ticket, &token, &user_info) {
                     Ok(userid) => rpcenv.set_user(Some(userid.to_string())),
@@ -565,7 +569,7 @@ pub async fn handle_request(api: Arc<ApiConfig>, req: Request<Body>) -> Result<R
                 }
             }
 
-            match api.find_method(&components[2..], method, &mut uri_param) {
+            match api_method {
                 None => {
                     let err = http_err!(NOT_FOUND, "Path '{}' not found.", path);
                     return Ok((formatter.format_error)(err));
Proxmox Backup Server and Client