public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Lukas Wagner <l.wagner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH pve-manager] api: notification targets: fix permission check for POST/PUT
Date: Fri, 29 Nov 2024 09:59:08 +0100	[thread overview]
Message-ID: <20241129085908.44049-1-l.wagner@proxmox.com> (raw)

This fixes the error:
  unknown permission test at /usr/share/perl5/PVE/RPCEnvironment.pm line 536. (500)
which occured when trying to create or update a notification target.

The cause was a permission 'check' parameter for the API handlers which was nested
one level too deep by accident.

This regression was introduced in a previous commit which raised the
needed permissions for notification target management. It likely went
unnoticed because the permission check is skipped for root@pam, so
the error occurs only if using another user.

Reported in the community forum:
https://forum.proxmox.com/threads/158101

Fixes: a3fe9c54 ("api: notifications: require powerful privileges for target management")
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
---
 PVE/API2/Cluster/Notifications.pm | 96 +++++++++++++------------------
 1 file changed, 40 insertions(+), 56 deletions(-)

diff --git a/PVE/API2/Cluster/Notifications.pm b/PVE/API2/Cluster/Notifications.pm
index 50ee5662..a61ab839 100644
--- a/PVE/API2/Cluster/Notifications.pm
+++ b/PVE/API2/Cluster/Notifications.pm
@@ -500,13 +500,11 @@ __PACKAGE__->register_method ({
     method => 'POST',
     description => 'Create a new sendmail endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -556,13 +554,11 @@ __PACKAGE__->register_method ({
     method => 'PUT',
     description => 'Update existing sendmail endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -780,13 +776,11 @@ __PACKAGE__->register_method ({
     method => 'POST',
     description => 'Create a new gotify endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -832,13 +826,11 @@ __PACKAGE__->register_method ({
     method => 'PUT',
     description => 'Update existing gotify endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -1099,13 +1091,11 @@ __PACKAGE__->register_method ({
     method => 'POST',
     description => 'Create a new smtp endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -1165,13 +1155,11 @@ __PACKAGE__->register_method ({
     method => 'PUT',
     description => 'Update existing smtp endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -1423,13 +1411,11 @@ __PACKAGE__->register_method ({
     method => 'POST',
     description => 'Create a new webhook endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
@@ -1464,13 +1450,11 @@ __PACKAGE__->register_method ({
     method => 'PUT',
     description => 'Update existing webhook endpoint',
     permissions => {
-	check => [
-	    ['and',
-		['perm', '/mapping/notifications', ['Mapping.Modify']],
-		['or',
-		    ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
-		    ['perm', '/', [ 'Sys.AccessNetwork' ]],
-		],
+	check => ['and',
+	    ['perm', '/mapping/notifications', ['Mapping.Modify']],
+	    ['or',
+		['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
+		['perm', '/', [ 'Sys.AccessNetwork' ]],
 	    ],
 	],
     },
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


             reply	other threads:[~2024-11-29  8:59 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-11-29  8:59 Lukas Wagner [this message]
2024-11-29 10:46 ` [pve-devel] applied: " Thomas Lamprecht

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241129085908.44049-1-l.wagner@proxmox.com \
    --to=l.wagner@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal