spiceproxy: use POST instead of GET

using GET is a security risk (no CSRF checks)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 4712abb9eb2723f83c1f7a4d999d6c0a703582d4..456076866f1711c94dc2241fdbad529764856cb5 100644 (file)
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -1348,9 +1348,9 @@ __PACKAGE__->register_method({
 __PACKAGE__->register_method({
     name => 'spiceproxy',
     path => '{vmid}/spiceproxy',
-    method => 'GET',
+    method => 'POST',
     protected => 1,
-    proxyto => 'node', # fixme: use direct connections or ssh tunnel?
+    proxyto => 'node',
     permissions => {
        check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
     },