From 061b9ca666f4b5a2d44f3fd38ff3b10b9327f75f Mon Sep 17 00:00:00 2001 From: =?utf8?q?Fabian=20Gr=C3=BCnbichler?= Date: Tue, 5 Feb 2019 16:01:40 +0100 Subject: [PATCH] check_volume_access: tighten checks for iso/tmpl MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit (custom) templates might contain sensitive data, so require at least read access on the underlying storage to access ISO and template files. the same permissions are already needed for listing them, so this is unlikely to cause fallout. Signed-off-by: Fabian Grünbichler --- PVE/Storage.pm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/PVE/Storage.pm b/PVE/Storage.pm index fc7a2ea..a1c4a14 100755 --- a/PVE/Storage.pm +++ b/PVE/Storage.pm @@ -399,7 +399,8 @@ sub check_volume_access { if ($sid) { my ($vtype, undef, $ownervm) = parse_volname($cfg, $volid); if ($vtype eq 'iso' || $vtype eq 'vztmpl') { - # we simply allow access + # at least read access to storage + $rpcenv->check_any($user, "/storage/$sid", ['Datastore.AllocateSpace', 'Datastore.Audit']); } elsif (defined($ownervm) && defined($vmid) && ($ownervm == $vmid)) { # we are owner - allow access } elsif ($vtype eq 'backup' && $ownervm) { -- 2.39.2