Quarantine API: extend download call to download whole mails

this makes the attachmentid parameter optional and if it is not
given, open the whole mail for download

The permission check, that a quser only is able to get their own
mails/attachments, happens in get_and_check_mail, thus we can add the
quser to the "sufficient permissions" list without opening up the
real permissions the users has.

[Thomas] add permissions info to commit message

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Tested-By: Stoiko Ivanov <s.ivanov@proxmox.com>
Reviewed-By: Stoiko Ivanov <s.ivanov@proxmox.com>

diff --git a/src/PMG/API2/Quarantine.pm b/src/PMG/API2/Quarantine.pm
index 1869093010dd1d3e61a93da7879f77b29ff5f1b7..5cb0f8e6765a0360e27da66fd9395e5d6a6fa19d 100644 (file)
--- a/src/PMG/API2/Quarantine.pm
+++ b/src/PMG/API2/Quarantine.pm
@@ -1053,8 +1053,8 @@ __PACKAGE__->register_method ({
     name => 'download',
     path => 'download',
     method => 'GET',
-    permissions => { check => [ 'admin', 'qmanager', 'audit'] },
-    description => "Download Attachment for E-Mail in Quarantine.",
+    permissions => { check => [ 'admin', 'qmanager', 'audit', 'quser'] },
+    description => "Download E-Mail or Attachment from Quarantine.",
     download => 1,
     parameters => {
        additionalProperties => 0,
@@ -1068,6 +1068,7 @@ __PACKAGE__->register_method ({
            attachmentid => {
                description => "The Attachment ID for the mail.",
                type => 'integer',
+               optional => 1,
            },
        },
     },
@@ -1081,17 +1082,29 @@ __PACKAGE__->register_method ({
        my $attachmentid = $param->{attachmentid};
 
        my $dumpdir = "/run/pmgproxy/pmg-$mailid-$$/";
-       my $attachments = $get_attachments->($mailid, $dumpdir, 1);
+       my $res;
 
-       my $res = $attachments->[$attachmentid];
-       if (!$res) {
-           raise_param_exc({ attachmentid => "Invalid Attachment ID for Mail."});
+       if ($attachmentid) {
+           my $attachments = $get_attachments->($mailid, $dumpdir, 1);
+           $res = $attachments->[$attachmentid];
+           if (!$res) {
+               raise_param_exc({ attachmentid => "Invalid Attachment ID for Mail."});
+           }
+       } else {
+           my $rpcenv = PMG::RESTEnvironment->get();
+           my $ref = $get_and_check_mail->($mailid, $rpcenv);
+           my $spooldir = $PMG::MailQueue::spooldir;
+
+           $res = {
+               'content-type' => 'message/rfc822',
+               path => "$spooldir/$ref->{file}",
+           };
        }
 
        $res->{fh} = IO::File->new($res->{path}, '<') ||
            die "unable to open file '$res->{path}' - $!\n";
 
-       rmtree $dumpdir;
+       rmtree $dumpdir if -e $dumpdir;
 
        return $res;