From 0ac612476acf0c5965c679ec0fe74e12c5006903 Mon Sep 17 00:00:00 2001 From: Thomas Lamprecht Date: Fri, 2 Oct 2020 13:17:12 +0200 Subject: [PATCH] REST server: avoid hard coding world readable API endpoints while we probably do not add much more to them, it still looks ugly. If this was made so that adding a World readable API call is "hard" and not done by accident, it rather should be done as a test on build time. But, IMO, the API permission schema definitions are easy to review, and not often changed/added - so any wrong World readable API call will normally still caught. Signed-off-by: Thomas Lamprecht --- src/server/rest.rs | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/src/server/rest.rs b/src/server/rest.rs index feb0b462..4cfdd6c0 100644 --- a/src/server/rest.rs +++ b/src/server/rest.rs @@ -22,6 +22,7 @@ use proxmox::api::{ ApiHandler, ApiMethod, HttpError, + Permission, RpcEnvironment, RpcEnvironmentType, check_api_permission, @@ -546,13 +547,16 @@ pub async fn handle_request(api: Arc, req: Request) -> Result rpcenv.set_user(Some(userid.to_string())), @@ -565,7 +569,7 @@ pub async fn handle_request(api: Arc, req: Request) -> Result { let err = http_err!(NOT_FOUND, "Path '{}' not found.", path); return Ok((formatter.format_error)(err));