all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Shan Shaji <s.shaji@proxmox.com>
To: pdm-devel@lists.proxmox.com
Subject: [PATCH datacenter-manager] api: nodes: add explicit permission check for RRD data points endpoint
Date: Thu, 27 Aug 2026 15:00:33 +0200	[thread overview]
Message-ID: <20260827130033.131872-1-s.shaji@proxmox.com> (raw)

The /rrddata endpoint did not have the access parameter defined inside
the API macro. This resulted in a "403: permission check failed" error
in the UI even though the user was assigned the Administrator role on
the / ACL path. This issue was raised in the forum [0].

Fix this by adding the explicit permission check.

- [0] https://forum.proxmox.com/threads/185992/

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 server/src/api/nodes/rrddata.rs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/server/src/api/nodes/rrddata.rs b/server/src/api/nodes/rrddata.rs
index b6e55b48..0bb8b374 100644
--- a/server/src/api/nodes/rrddata.rs
+++ b/server/src/api/nodes/rrddata.rs
@@ -1,11 +1,11 @@
 use anyhow::Error;
 use proxmox_rrd_api_types::{RrdMode, RrdTimeframe};
 
-use proxmox_router::{Router, http_bail};
+use proxmox_router::{Permission, Router, http_bail};
 use proxmox_schema::api;
 
-use pdm_api_types::NODE_SCHEMA;
 use pdm_api_types::rrddata::PdmNodeDatapoint;
+use pdm_api_types::{NODE_SCHEMA, PRIV_SYS_AUDIT};
 
 use crate::api::rrd_common::{self, DataPoint};
 
@@ -97,7 +97,11 @@ impl DataPoint for PdmNodeDatapoint {
         items: {
             type: PdmNodeDatapoint,
         }
-    }
+    },
+    access: {
+        permission: &Permission::Privilege(&["system", "status"], PRIV_SYS_AUDIT, false),
+        description: "Requires `Sys.Audit` privilege on `/system/status`."
+    },
 )]
 /// Read RRD data for this PDM node.
 fn get_node_rrddata(
-- 
2.47.3





             reply	other threads:[~2026-08-27 13:01 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-27 13:00 Shan Shaji [this message]
2026-08-28  9:56 ` [PATCH datacenter-manager] api: nodes: add explicit permission check for RRD data points endpoint Thomas Ellmenreich
2026-08-28 10:59 ` applied: " Lukas Wagner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260827130033.131872-1-s.shaji@proxmox.com \
    --to=s.shaji@proxmox.com \
    --cc=pdm-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal