From: "Lukas Wagner" <l.wagner@proxmox.com>
To: "Proxmox Datacenter Manager development discussion"
<pdm-devel@lists.proxmox.com>, "Shan Shaji" <s.shaji@proxmox.com>
Subject: [pdm-devel] applied: [PATCH datacenter-manager v3 0/3] fix #6901: allow non root users to access the EVPN dashboard
Date: Tue, 04 Nov 2025 15:45:26 +0100 [thread overview]
Message-ID: <DDZZP9IDKN78.3T1JPEARAWU08@proxmox.com> (raw)
In-Reply-To: <20251104101815.94348-1-s.shaji@proxmox.com>
On Tue Nov 4, 2025 at 11:18 AM CET, Shan Shaji wrote:
> When a non-root user tried to access the EVPN section, the API was
> returning a "403: permission check failed" error. To fix this, explicit
> permission checks have been added for the `/zones`, `/vnets`, and
> `/controllers` endpoints.
>
> Now, every authenticated user can access these endpoints however, the user
> must have at least the Resource.Audit permission under `/resource`.
> Remotes are also filtered based on the user’s access. Lists will only be
> fetched from remotes for which the user has at least the
> `Resource.Audit` permission on `/resource/{remote_name}`.
>
> History
> =======
>
> changes since v2: Thanks @Lukas
> patch: https://lore.proxmox.com/pdm-devel/DDUYO409X0BY.28PIYRXCLMUST@proxmox.com/T/#t
> - Fixed typo inside API description and commit description.
>
> changes since v1: thanks @stefan
> patch: https://lore.proxmox.com/pdm-devel/DDKKKUCY3S4R.1FDPCH2742RY5@proxmox.com/T/#t
> - Removed unused import from vnets.rs file.
>
>
> Shan Shaji (3):
> fix #6901: api: add explicit permission check for controllers list
> fix #6901: api: add explicit permission check for vnets list
> fix #6901: api: add explicit permission check for zones list
>
> server/src/api/sdn/controllers.rs | 30 ++++++++++++++++++++++++++----
> server/src/api/sdn/vnets.rs | 28 +++++++++++++++++++++++++---
> server/src/api/sdn/zones.rs | 28 +++++++++++++++++++++++++---
> 3 files changed, 76 insertions(+), 10 deletions(-)
applied, thanks a lot!
I quickly followed up with a patch fixing some trivial clippy warnings,
see [1].
[1] https://git.proxmox.com/?p=proxmox-datacenter-manager.git;a=commitdiff;h=db9f42aa87711ba5ff18ef3454a453f97a4027d9
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
prev parent reply other threads:[~2025-11-04 14:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-04 10:18 [pdm-devel] " Shan Shaji
2025-11-04 10:18 ` [pdm-devel] [PATCH datacenter-manager v3 1/3] fix #6901: api: add explicit permission check for controllers list Shan Shaji
2025-11-04 10:18 ` [pdm-devel] [PATCH datacenter-manager v3 2/3] fix #6901: api: add explicit permission check for vnets list Shan Shaji
2025-11-04 10:18 ` [pdm-devel] [PATCH datacenter-manager v3 3/3] fix #6901: api: add explicit permission check for zones list Shan Shaji
2025-11-04 14:45 ` Lukas Wagner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DDZZP9IDKN78.3T1JPEARAWU08@proxmox.com \
--to=l.wagner@proxmox.com \
--cc=pdm-devel@lists.proxmox.com \
--cc=s.shaji@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox