From: Lukas Wagner <l.wagner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH v6 pve-manager 24/30] api: notification: make the 'mail-to-root' target visible to any user
Date: Thu, 3 Aug 2023 14:17:13 +0200 [thread overview]
Message-ID: <20230803121719.519207-25-l.wagner@proxmox.com> (raw)
In-Reply-To: <20230803121719.519207-1-l.wagner@proxmox.com>
Since the target does not require Mapping.Use, it should also be
visible and testable by all users.
Short explanation why the 'mail-to-root' is exempt from priv checks:
To ensure backwards compatibility, the 'mail-to-root' target does not
require the `Mapping.Use` privs. This is needed due to the fact that
this target is used as a fallback in case no other target is
configured for an event. For instance, the /node/<name>/apt/update API
call only requires Sys.Modify for the node, but it can also send a
notification. If we were to require Mapping.Use, we could break the
apt/update API compat in the case that a notification shall be sent,
but without any configured notification target (which will then
default to 'mail-to-root').
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
---
Notes:
Changes since v5:
- Fix bug in permission check
PVE/API2/Cluster/Notifications.pm | 31 ++++++++++++++++++++++---------
1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/PVE/API2/Cluster/Notifications.pm b/PVE/API2/Cluster/Notifications.pm
index 9c9e8243..ec666903 100644
--- a/PVE/API2/Cluster/Notifications.pm
+++ b/PVE/API2/Cluster/Notifications.pm
@@ -68,7 +68,7 @@ sub filter_entities_by_privs {
"/mapping/notification/$_->{name}",
$can_see_mapping_privs,
1
- )
+ ) || $_->{name} eq PVE::Notify::default_target();
} @$entities];
return $filtered;
@@ -165,7 +165,8 @@ __PACKAGE__->register_method ({
' (endpoints and groups).',
permissions => {
description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
+ . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'."
+ . " The special 'mail-to-root' target is available to all users.",
user => 'all',
},
protected => 1,
@@ -244,11 +245,10 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Send a test notification to a provided target.',
permissions => {
- check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Use']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
- ],
+ description => "The user requires 'Mapping.Modify', 'Mapping.Use' or"
+ . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'."
+ . " The special 'mail-to-root' target can be accessed by all users.",
+ user => 'all',
},
parameters => {
additionalProperties => 0,
@@ -264,10 +264,23 @@ __PACKAGE__->register_method ({
code => sub {
my ($param) = @_;
my $name = extract_param($param, 'name');
-
- my $config = PVE::Notify::read_config();
+ my $rpcenv = PVE::RPCEnvironment::get();
+ my $authuser = $rpcenv->get_user();
+
+ my $privs = ['Mapping.Modify', 'Mapping.Use', 'Mapping.Audit'];
+
+ if ($name ne PVE::Notify::default_target()) {
+ # Due to backwards compatibility reasons the 'mail-to-root'
+ # target must be accessible for any user
+ $rpcenv->check_any(
+ $authuser,
+ "/mapping/notification/$name",
+ $privs,
+ );
+ }
eval {
+ my $config = PVE::Notify::read_config();
$config->test_target($name);
};
--
2.39.2
next prev parent reply other threads:[~2023-08-03 12:23 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-03 12:16 [pve-devel] [PATCH v6 many 00/30] fix #4156: introduce new notification system Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-ha-manager 01/30] manager: send notifications via new notification module Lukas Wagner
2023-08-03 15:39 ` [pve-devel] applied: " Thomas Lamprecht
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 02/30] d/control: add dependency to `libpve-notify-perl` Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 03/30] vzdump: send notifications via new notification module Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 04/30] test: rename mail_test.pl to vzdump_notification_test.pl Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 05/30] api: apt: send notification via new notification module Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 06/30] api: replication: send notifications " Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 07/30] api: prepare api handler module for notification config Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 08/30] api: notification: add api routes for groups Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 09/30] api: notification: add api routes for sendmail endpoints Lukas Wagner
2023-08-03 12:16 ` [pve-devel] [PATCH v6 pve-manager 10/30] api: notification: add api routes for gotify endpoints Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 11/30] api: notification: add api routes for filters Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 12/30] api: notification: allow fetching notification targets Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 13/30] api: notification: allow to test targets Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 14/30] api: notification: disallow removing targets if they are used Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 15/30] ui: backup: allow to select notification target for jobs Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 16/30] ui: backup: adapt backup job details to new notification params Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 17/30] ui: backup: allow to set notification-target for one-off backups Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 18/30] ui: allow to configure notification event -> target mapping Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 19/30] ui: add notification target configuration panel Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 20/30] ui: perm path: add ACL paths for notifications, usb and pci mappings Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 21/30] ui: perm path: increase width of the perm path selector combobox Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 22/30] ui: dc: remove notify key from datacenter option view Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-manager 23/30] vzdump: use <name> as a convention for virtual endpoints/groups Lukas Wagner
2023-08-03 12:17 ` Lukas Wagner [this message]
2023-08-03 12:17 ` [pve-devel] [PATCH v6 proxmox-widget-toolkit 25/30] notification: add gui for sendmail notification endpoints Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 proxmox-widget-toolkit 26/30] notification: add gui for gotify " Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 proxmox-widget-toolkit 27/30] notification: add gui for notification groups Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 proxmox-widget-toolkit 28/30] notification: allow to select filter for notification targets Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 proxmox-widget-toolkit 29/30] notification: add ui for managing notification filters Lukas Wagner
2023-08-03 12:17 ` [pve-devel] [PATCH v6 pve-docs 30/30] add documentation for the new notification system Lukas Wagner
2023-08-11 11:22 ` [pve-devel] [PATCH v6 many 00/30] fix #4156: introduce " Dominik Csapak
2023-08-16 10:14 ` [pve-devel] applied-series: " Wolfgang Bumiller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230803121719.519207-25-l.wagner@proxmox.com \
--to=l.wagner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox