From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id DA19D609BA for ; Mon, 19 Oct 2020 09:40:38 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id D736D29A90 for ; Mon, 19 Oct 2020 09:40:08 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 425E9299AB for ; Mon, 19 Oct 2020 09:40:08 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0B6F545DFE for ; Mon, 19 Oct 2020 09:40:08 +0200 (CEST) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Date: Mon, 19 Oct 2020 09:39:17 +0200 Message-Id: <20201019073919.588521-14-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20201019073919.588521-1-f.gruenbichler@proxmox.com> References: <20201019073919.588521-1-f.gruenbichler@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.031 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pbs-devel] [RFC proxmox-backup 13/15] tasks: allow unpriv users to read their tokens' tasks X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Oct 2020 07:40:38 -0000 and tighten down the return schema while we're at it. Signed-off-by: Fabian Grünbichler --- src/api2/node/tasks.rs | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/src/api2/node/tasks.rs b/src/api2/node/tasks.rs index b86eaec7..379ec6fc 100644 --- a/src/api2/node/tasks.rs +++ b/src/api2/node/tasks.rs @@ -14,6 +14,14 @@ use crate::server::{self, UPID, TaskState, TaskListInfoIterator}; use crate::config::acl::{PRIV_SYS_AUDIT, PRIV_SYS_MODIFY}; use crate::config::cached_user_info::CachedUserInfo; +fn check_task_access(auth_user: &Userid, task_user: &Userid) -> Result<(), Error> { + if auth_user == task_user || (task_user.is_tokenid() && &task_user.owner().unwrap() == auth_user) { + Ok(()) + } else { + let user_info = CachedUserInfo::new()?; + user_info.check_privs(auth_user, &["system", "tasks"], PRIV_SYS_AUDIT, false) + } +} #[api( input: { @@ -57,7 +65,7 @@ use crate::config::cached_user_info::CachedUserInfo; description: "Worker ID (arbitrary ASCII string)", }, user: { - type: String, + schema: PROXMOX_USER_OR_TOKEN_ID_SCHEMA, description: "The user who started the task.", }, status: { @@ -85,11 +93,7 @@ async fn get_task_status( let upid = extract_upid(¶m)?; let userid: Userid = rpcenv.get_user().unwrap().parse()?; - - if userid != upid.userid { - let user_info = CachedUserInfo::new()?; - user_info.check_privs(&userid, &["system", "tasks"], PRIV_SYS_AUDIT, false)?; - } + check_task_access(&userid, &upid.userid)?; let mut result = json!({ "upid": param["upid"], @@ -162,11 +166,7 @@ async fn read_task_log( let upid = extract_upid(¶m)?; let userid: Userid = rpcenv.get_user().unwrap().parse()?; - - if userid != upid.userid { - let user_info = CachedUserInfo::new()?; - user_info.check_privs(&userid, &["system", "tasks"], PRIV_SYS_AUDIT, false)?; - } + check_task_access(&userid, &upid.userid)?; let test_status = param["test-status"].as_bool().unwrap_or(false); @@ -326,7 +326,9 @@ pub fn list_tasks( Err(_) => return None, }; - if !list_all && info.upid.userid != userid { return None; } + if !list_all && check_task_access(&userid, &info.upid.userid).is_err() { + return None; + } if let Some(userid) = &userfilter { if !info.upid.userid.as_str().contains(userid) { return None; } -- 2.20.1