[pdm-devel] [PATCH datacenter-manager] server/ui: don't return token secret in api response

[pdm-devel] [PATCH datacenter-manager] server/ui: don't return token secret in api response

[Dominik Csapak]

as a stop-gap, simply return the empty string for the secret.
Later we can fix that up with a proper type e.g. like we do in
proxmox-backup with `RemoteWithoutPassword`, but that touches too many
places here currently, so this seems fine for now.

On the UI side it's enough to simply don't mark it required and
add a placeholder. If its empty, it won't get submitted anyway.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 server/src/api/remotes.rs     | 8 ++++++--
 ui/src/remotes/edit_remote.rs | 3 ++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/server/src/api/remotes.rs b/server/src/api/remotes.rs
index 02843fa..d4412d0 100644
--- a/server/src/api/remotes.rs
+++ b/server/src/api/remotes.rs
@@ -76,7 +76,9 @@ pub fn list_remotes(rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<Remote>, Erro
 
     Ok(remotes
         .into_iter()
-        .filter_map(|(id, value)| {
+        .filter_map(|(id, mut value)| {
+            // FIXME: proper type here?
+            value.token = String::new(); // remove secret from api response
             (top_level_allowed || 0 != user_info.lookup_privs(&auth_id, &["resource", &id]))
                 .then_some(value)
         })
@@ -286,6 +288,8 @@ pub async fn version(id: String) -> Result<pve_api_types::VersionResponse, Error
 /// Get the Remote Configuration
 pub fn remote_config(id: String) -> Result<Remote, Error> {
     let (remotes, _) = pdm_config::remotes::config()?;
-    let remote = get_remote(&remotes, &id)?;
+    let mut remote = get_remote(&remotes, &id)?.clone();
+    // FIXME: proper type here?
+    remote.token = String::new(); // mask token in response
     Ok(remote.clone())
 }
diff --git a/ui/src/remotes/edit_remote.rs b/ui/src/remotes/edit_remote.rs
index 8902273..ecdb7d5 100644
--- a/ui/src/remotes/edit_remote.rs
+++ b/ui/src/remotes/edit_remote.rs
@@ -90,8 +90,9 @@ fn edit_remote_input_panel(_form_ctx: &FormContext, remote_id: &str) -> Html {
             tr!("Password/Secret"),
             Field::new()
                 .name("token")
+                .placeholder(tr!("Unchanged"))
                 .input_type(InputType::Password)
-                .required(true),
+                .required(false),
         )
         .with_custom_child(
             Container::new()
-- 
2.39.5



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] applied: [PATCH datacenter-manager] server/ui: don't return token secret in api response

[Thomas Lamprecht]

Am 19.12.24 um 13:03 schrieb Dominik Csapak:
> as a stop-gap, simply return the empty string for the secret.
> Later we can fix that up with a proper type e.g. like we do in
> proxmox-backup with `RemoteWithoutPassword`, but that touches too many
> places here currently, so this seems fine for now.
> 
> On the UI side it's enough to simply don't mark it required and
> add a placeholder. If its empty, it won't get submitted anyway.
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  server/src/api/remotes.rs     | 8 ++++++--
>  ui/src/remotes/edit_remote.rs | 3 ++-
>  2 files changed, 8 insertions(+), 3 deletions(-)
> 
>

applied, thanks!


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel