proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-10-04 22:29:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

api: permissions: allow users to check their own tokens

Browse Source 
even if they lack Sys.Audit on /access - since tokens are self-service,
checking whether the ACLs work as expected should also be doable for every
user.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Tested-by: Daniel Kral <d.kral@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2024-11-05 09:30:39 +01:00 committed by Thomas Lamprecht
parent 6287395114
commit 138ecc60fa
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/PVE/API2/AccessControl.pm
View File

@ -460,7 +460,11 @@ __PACKAGE__->register_method({
method => 'GET', method => 'GET',
description => 'Retrieve effective permissions of given user/token.', description => 'Retrieve effective permissions of given user/token.',
permissions => { permissions => {
description => "Each user/token is allowed to dump their own permissions. A user can dump the permissions of another user if they have 'Sys.Audit' permission on /access.", description => "Each user/token is allowed to dump their own ".
"permissions (or that of owned tokens). A user ".
"can dump the permissions of another user or ".
"their tokens if they have 'Sys.Audit' permission ".
"on /access.",
user => 'all', user => 'all',
}, },
parameters => { parameters => {
@ -491,7 +495,11 @@ __PACKAGE__->register_method({
my $userid = $param->{userid}; my $userid = $param->{userid};
$userid = $authid if !defined($userid); $userid = $authid if !defined($userid);
if ($userid ne $authid) { my ($user, $token) = PVE::AccessControl::split_tokenid($userid, 1);
my $check_self = $userid eq $authid;
my $check_owned_token = defined($user) && $user eq $authid;
if (!($check_self || $check_owned_token)) {
$rpcenv->check($rpcenv->get_user(), '/access', ['Sys.Audit']); $rpcenv->check($rpcenv->get_user(), '/access', ['Sys.Audit']);
} }
my $res; my $res;