[pmg-devel] [PATCH pmg-api] fix #5367 api: sa-custom-score: add missing permissions to api-calls

[pmg-devel] [PATCH pmg-api] fix #5367 api: sa-custom-score: add missing permissions to api-calls

[Stoiko Ivanov]

It seems we never added permission properties for the CRUD api calls,
for SpamAssassin custom scores. This results in them being available
only to root@pam.

OTOH the reverting (by deleting the shadow-file), applying (by
moving the shadow-file in place and restarting pmg-smtp-filter) was
available to all admin users, and listing all configured scores was
available to all 'admin' and 'audit' users.

The functionality itself should not be restricted to root@pam only.

Additionally remove a left-over commented 'protected => 1' and and one
that was active but not needed (reading
/etc/mail/spamassassin/pmg-scores.cf is possible for pmgproxy (running
as 'www-data').

Finally fix a mistake in describing the DELETE method.

Tested this with 'abc@pmg' as user - when the permissions were
'Auditor' the writing commands produced and error, with 'Administrator'
everything worked.

Fixes:  9aeedf1b ("add SACustom Package and API Calls for custom SpamAssassin scores")
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PMG/API2/SACustom.pm | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/PMG/API2/SACustom.pm b/src/PMG/API2/SACustom.pm
index 80a415f7..52a0fa38 100644
--- a/src/PMG/API2/SACustom.pm
+++ b/src/PMG/API2/SACustom.pm
@@ -54,7 +54,6 @@ __PACKAGE__->register_method({
     path => '',
     method => 'GET',
     description => "List custom scores.",
-    #    protected => 1,
     permissions => { check => ['admin', 'audit'] },
     proxyto => 'master',
     parameters => {
@@ -184,6 +183,7 @@ __PACKAGE__->register_method({
     description => "Create custom SpamAssassin score",
     protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin'] },
     parameters => {
         additionalProperties => 0,
         properties => json_config_properties({
@@ -226,8 +226,8 @@ __PACKAGE__->register_method({
     path => '{name}',
     method => 'GET',
     description => "Get custom SpamAssassin score",
-    protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin', 'audit'] },
     parameters => {
         additionalProperties => 0,
         properties => {
@@ -262,6 +262,7 @@ __PACKAGE__->register_method({
     description => "Edit custom SpamAssassin score",
     protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin'] },
     parameters => {
         additionalProperties => 0,
         properties => json_config_properties({
@@ -303,9 +304,10 @@ __PACKAGE__->register_method({
     name => 'delete_score',
     path => '{name}',
     method => 'DELETE',
-    description => "Edit custom SpamAssassin score",
+    description => "Delete custom SpamAssassin score",
     protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin'] },
     parameters => {
         additionalProperties => 0,
         properties => {
-- 
2.47.3



_______________________________________________
pmg-devel mailing list
pmg-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel