Re: [PATCH datacenter-manager] fix #7795: remote: guest shell: fix privilege path

[Dominik Csapak <d.csapak@proxmox.com>]

On 7/8/26 12:40 PM, Fabian Grünbichler wrote:
> the wrong path was copied over from the node shell, and since there is no
> "node" parameter here, calls as non-root will fail with 403..
> 
> Fixes: 525c8c49 "server: add termproxy and vncwebsocket calls for qemu guests"
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> 403 if the API schema is actually invalid might be something to catch
> lower in the stack as well?

i guess the substitution fails during privilege check in proxmox-router
and that triggers a 403 higher up in the stack?

since that must be const, maybe there can be a compile time check that
the parameters must exist here?

> 
>   server/src/api/pve/lxc.rs  | 4 ++--
>   server/src/api/pve/qemu.rs | 4 ++--
>   2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
> index 6183f62d..ca32eb84 100644
> --- a/server/src/api/pve/lxc.rs
> +++ b/server/src/api/pve/lxc.rs
> @@ -807,9 +807,9 @@ pub const API_METHOD_LXC_WEBSOCKET: ApiMethod = ApiMethod::new(
>       ),
>   )
>   .access(
> -    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
> +    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
>       &Permission::Privilege(
> -        &["resource", "{remote}", "node", "{node}"],
> +        &["resource", "{remote}", "guest", "{vmid}"],
>           PRIV_SYS_CONSOLE,
>           false,
>       ),
> diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
> index 65de6389..5d01e69e 100644
> --- a/server/src/api/pve/qemu.rs
> +++ b/server/src/api/pve/qemu.rs
> @@ -895,9 +895,9 @@ pub const API_METHOD_QEMU_WEBSOCKET: ApiMethod = ApiMethod::new(
>       ),
>   )
>   .access(
> -    Some("The user needs Sys.Console on /resource/{remote}/node/{node}."),
> +    Some("The user needs Sys.Console on /resource/{remote}/guest/{vmid}."),
>       &Permission::Privilege(
> -        &["resource", "{remote}", "node", "{node}"],
> +        &["resource", "{remote}", "guest", "{vmid}"],
>           PRIV_SYS_CONSOLE,
>           false,
>       ),