From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: [pve-devel] applied: [PATCH pve-access-control v2] fix #6528: tfa: update user config on removal of TFA
Date: Wed, 30 Jul 2025 15:22:21 +0200 [thread overview]
Message-ID: <1753881715.2u78t2kbnt.astroid@yuna.none> (raw)
In-Reply-To: <20250729110229.118959-1-s.shaji@proxmox.com>
thanks!
On July 29, 2025 1:02 pm, Shan Shaji wrote:
> When removing TFA from a user via the command line, the change was not
> reflected in the GUI or in the output of `pveum user list`. Both
> continued to show that TFA was enabled for the user. Fixed the issue
> by updating the user configuration file.
>
> Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
> ---
>
> changes since v1:
> - unconditionaly set `$update_user_config` to `true` when deleting the TFA
> entry using userid.
> - Fixed incomplete user config lock to avoid race conditions.
>
> History:
> - v1: https://lore.proxmox.com/pve-devel/DBOGTW5GCZZE.3V2FS3RAXC4FR@noor/T/#t
>
> src/PVE/CLI/pveum.pm | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/src/PVE/CLI/pveum.pm b/src/PVE/CLI/pveum.pm
> index 0645a6d..81c3a70 100755
> --- a/src/PVE/CLI/pveum.pm
> +++ b/src/PVE/CLI/pveum.pm
> @@ -141,13 +141,25 @@ __PACKAGE__->register_method({
>
> my $userid = extract_param($param, "userid");
> my $tfa_id = extract_param($param, "id");
> + my $update_user_config;
>
> PVE::AccessControl::lock_tfa_config(sub {
> my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
> if (defined($tfa_id)) {
> - $tfa_cfg->api_delete_tfa($userid, $tfa_id);
> + my $has_entries_left = $tfa_cfg->api_delete_tfa($userid, $tfa_id);
> + $update_user_config = !$has_entries_left;
> } else {
> $tfa_cfg->remove_user($userid);
> + $update_user_config = 1;
> + }
> +
> + if ($update_user_config) {
> + PVE::AccessControl::lock_user_config(sub {
> + my $user_cfg = cfs_read_file('user.cfg');
> + my $user = $user_cfg->{users}->{$userid};
> + $user->{keys} = undef;
> + cfs_write_file('user.cfg', $user_cfg);
> + });
> }
> cfs_write_file('priv/tfa.cfg', $tfa_cfg);
> });
> --
> 2.39.5
>
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>
>
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
prev parent reply other threads:[~2025-07-30 13:21 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-29 11:02 [pve-devel] " Shan Shaji
2025-07-30 13:22 ` Fabian Grünbichler [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1753881715.2u78t2kbnt.astroid@yuna.none \
--to=f.gruenbichler@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox