prevent overwriting ipsets/sec. groups by renaming

we did not check if the target name of the group/ipset
already existed, so we overwrote them

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

diff --git a/src/PVE/API2/Firewall/Groups.pm b/src/PVE/API2/Firewall/Groups.pm
index 99ea41877cc6196bb504e5945f13bbaff045b41a..dfc181c90a2724c8ae19043e366fa4d427036108 100644 (file)
--- a/src/PVE/API2/Firewall/Groups.pm
+++ b/src/PVE/API2/Firewall/Groups.pm
@@ -101,6 +101,11 @@ __PACKAGE__->register_method({
            raise_param_exc({ group => "Security group '$param->{rename}' does not exists" }) 
                if !$cluster_conf->{groups}->{$param->{rename}};
 
+           # prevent overwriting an existing group
+           raise_param_exc({ group => "Security group '$param->{group}' does already exist" })
+               if $cluster_conf->{groups}->{$param->{group}} &&
+               $param->{group} ne $param->{rename};
+
            my $data = delete $cluster_conf->{groups}->{$param->{rename}};
            $cluster_conf->{groups}->{$param->{group}} = $data;
            if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {

diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
index 1266fd17d4f6b68c05b5c90b476884d8ab1c441f..6129c9d6f79c4fff9284f19240725c35bc643f25 100644 (file)
--- a/src/PVE/API2/Firewall/IPSet.pm
+++ b/src/PVE/API2/Firewall/IPSet.pm
@@ -587,6 +587,11 @@ sub register_create {
                raise_param_exc({ name => "IPSet '$param->{rename}' does not exists" }) 
                    if !$fw_conf->{ipset}->{$param->{rename}};
 
+               # prevent overwriting existing ipset
+               raise_param_exc({ name => "IPSet '$param->{name}' does already exist"})
+                   if $fw_conf->{ipset}->{$param->{name}} &&
+                   $param->{name} ne $param->{rename};
+
                my $data = delete $fw_conf->{ipset}->{$param->{rename}};
                $fw_conf->{ipset}->{$param->{name}} = $data;
                if (my $comment = delete $fw_conf->{ipset_comments}->{$param->{rename}}) {