proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-08-10 10:57:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

api: tfa: don't block tokens from viewing and list TFA entries

Browse Source 
The `allowtoken` property is a total, unconditional block on using
API tokens on an endpoint. We reserve those only for a limited set of
security critical endpoints like changing passwords or second
factors, or creating a (cookie) ticket, which are exempt from this
limitations, so require to have limited access to them too.

Anyhow, listing and getting TFA entries for users, where the API
token has the correct permissions granted, is not critical, as the
API token cannot gain more permissions than they have from that
info, so drop the total block on those GET methods.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2023-06-15 09:23:33 +02:00
parent 329780350c
commit 79c9d3b84b
1 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/PVE/API2/TFA.pm
View File

@ -163,7 +163,6 @@ __PACKAGE__->register_method ({
],
},
protected => 1, # else we can't access shadow files
allowtoken => 0, # we don't want tokens to change the regular user's TFA settings
description => 'List TFA configurations of users.',
parameters => {
additionalProperties => 0,
@ -195,7 +194,6 @@ __PACKAGE__->register_method ({
],
},
protected => 1, # else we can't access shadow files
allowtoken => 0, # we don't want tokens to change the regular user's TFA settings
description => 'Fetch a requested TFA entry if present.',
parameters => {
additionalProperties => 0,
@ -270,7 +268,6 @@ __PACKAGE__->register_method ({
user => 'all',
},
protected => 1, # else we can't access shadow files
allowtoken => 0, # we don't want tokens to change the regular user's TFA settings
description => 'List TFA configurations of users.',
parameters => {
additionalProperties => 0,