[PATCH datacenter-manager 4/4] fix #7747: openid: allow non HTTP schemes in redirect URL

[Thomas Ellmenreich <t.ellmenreich@proxmox.com>]

Loosen validation on redirect URLs for OpenID authentication to also allow
other valid schemes that are not HTTP or HTTPS.

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7747
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 lib/pdm-api-types/src/lib.rs    | 1 +
 server/src/api/access/openid.rs | 6 ++----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/lib/pdm-api-types/src/lib.rs b/lib/pdm-api-types/src/lib.rs
index 89d1b4ad..6ddeab5d 100644
--- a/lib/pdm-api-types/src/lib.rs
+++ b/lib/pdm-api-types/src/lib.rs
@@ -71,6 +71,7 @@ pub use proxmox_schema::api_types::HTTP_URL_SCHEMA;
 pub use proxmox_schema::api_types::MULTI_LINE_COMMENT_SCHEMA;
 pub use proxmox_schema::api_types::NODE_SCHEMA;
 pub use proxmox_schema::api_types::SINGLE_LINE_COMMENT_FORMAT;
+pub use proxmox_schema::api_types::URL_SCHEMA;
 pub use proxmox_schema::api_types::{
     BLOCKDEVICE_DISK_AND_PARTITION_NAME_SCHEMA, BLOCKDEVICE_NAME_SCHEMA,
 };
diff --git a/server/src/api/access/openid.rs b/server/src/api/access/openid.rs
index 5048fde3..caa065f3 100644
--- a/server/src/api/access/openid.rs
+++ b/server/src/api/access/openid.rs
@@ -18,9 +18,7 @@ use proxmox_router::{
 use proxmox_schema::{ApiType, ObjectSchema, ParameterSchema, StringSchema, api};
 use proxmox_sortable_macro::sortable;
 
-use pdm_api_types::{
-    HTTP_URL_SCHEMA, OPENID_DEFAULT_SCOPE_LIST, OpenIdRealmConfig, REALM_ID_SCHEMA,
-};
+use pdm_api_types::{OPENID_DEFAULT_SCOPE_LIST, OpenIdRealmConfig, REALM_ID_SCHEMA, URL_SCHEMA};
 use pdm_buildcfg::PDM_RUN_DIR_M;
 
 use crate::auth;
@@ -252,7 +250,7 @@ fn create_ticket_http_only(
                 schema: REALM_ID_SCHEMA,
             },
             "redirect-url": {
-                schema: HTTP_URL_SCHEMA,
+                schema: URL_SCHEMA,
             },
         },
     },
-- 
2.47.3