implement verify ticket on ticket api call

we now also try to verify vnc tickets, and if a path is given
we only verify the ticket (instead of creating a new one)

this will be used for xtermjs authentication

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

diff --git a/PMG/API2/AccessControl.pm b/PMG/API2/AccessControl.pm
index 9db507b8c83439af23010b8578040e3c6fd6b3b3..eb9de75a12b798e5c84e273b690bcc94437d63b0 100644 (file)
--- a/PMG/API2/AccessControl.pm
+++ b/PMG/API2/AccessControl.pm
@@ -58,8 +58,8 @@ __PACKAGE__->register_method ({
     }});
 
 
-my $create_ticket = sub {
-    my ($rpcenv, $username, $pw_or_ticket, $otp) = @_;
+my $create_or_verify_ticket = sub {
+    my ($rpcenv, $username, $pw_or_ticket, $otp, $path) = @_;
 
     my $ticketuser;
 
@@ -82,10 +82,17 @@ my $create_ticket = sub {
     if (($ticketuser = PMG::Ticket::verify_ticket($pw_or_ticket, 1)) &&
        ($ticketuser eq 'root@pam' || $ticketuser eq $username)) {
        # valid ticket. Note: root@pam can create tickets for other users
+    } elsif (PMG::Ticket::verify_vnc_ticket($pw_or_ticket, $username, $path, 1)) {
+       # valid vnc ticket for $path
     } else {
        $username = PMG::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
     }
 
+    if (defined($path)) {
+       # verify only
+       return { username => $username };
+    }
+
     my $ticket = PMG::Ticket::assemble_ticket($username);
     my $csrftoken = PMG::Ticket::assemble_csrf_prevention_token($username);
 
@@ -141,6 +148,12 @@ __PACKAGE__->register_method ({
                type => 'string',
                optional => 1,
            },
+           path => {
+               description => "Verify ticket, and check if user have access on 'path'",
+               type => 'string',
+               optional => 1,
+               maxLength => 64,
+           },
        }
     },
     returns => {
@@ -168,7 +181,8 @@ __PACKAGE__->register_method ({
 
        my $res;
        eval {
-           $res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp});
+           $res = &$create_or_verify_ticket($rpcenv, $username,
+                   $param->{password}, $param->{otp}, $param->{path});
        };
        if (my $err = $@) {
            my $clientip = $rpcenv->get_client_ip() || '';