From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 5367063159 for ; Fri, 2 Oct 2020 13:17:19 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 412F39519 for ; Fri, 2 Oct 2020 13:17:19 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id F13DB950D for ; Fri, 2 Oct 2020 13:17:17 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id B7F8D45BB6 for ; Fri, 2 Oct 2020 13:17:17 +0200 (CEST) From: Thomas Lamprecht To: pbs-devel@lists.proxmox.com Date: Fri, 2 Oct 2020 13:17:12 +0200 Message-Id: <20201002111712.7135-1-t.lamprecht@proxmox.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.156 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [rest.rs] Subject: [pbs-devel] [PATCH backup] REST server: avoid hard coding world readable API endpoints X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2020 11:17:19 -0000 while we probably do not add much more to them, it still looks ugly. If this was made so that adding a World readable API call is "hard" and not done by accident, it rather should be done as a test on build time. But, IMO, the API permission schema definitions are easy to review, and not often changed/added - so any wrong World readable API call will normally still caught. Signed-off-by: Thomas Lamprecht --- the need to method.clone() to make the borrow checker happy isn't to nice, but figured it isn't to expensive, maybe there's a nicer way.. src/server/rest.rs | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/src/server/rest.rs b/src/server/rest.rs index feb0b462..4cfdd6c0 100644 --- a/src/server/rest.rs +++ b/src/server/rest.rs @@ -22,6 +22,7 @@ use proxmox::api::{ ApiHandler, ApiMethod, HttpError, + Permission, RpcEnvironment, RpcEnvironmentType, check_api_permission, @@ -546,13 +547,16 @@ pub async fn handle_request(api: Arc, req: Request) -> Result rpcenv.set_user(Some(userid.to_string())), @@ -565,7 +569,7 @@ pub async fn handle_request(api: Arc, req: Request) -> Result { let err = http_err!(NOT_FOUND, "Path '{}' not found.", path); return Ok((formatter.format_error)(err)); -- 2.27.0