[pve-devel] r4998 - pve-access-control/trunk
svn-commits at proxmox.com
svn-commits at proxmox.com
Fri Aug 13 11:05:45 CEST 2010
Author: dietmar
Date: 2010-08-13 09:05:45 +0000 (Fri, 13 Aug 2010)
New Revision: 4998
Modified:
pve-access-control/trunk/ACL.pm
pve-access-control/trunk/AccessControl.pm
pve-access-control/trunk/ChangeLog
pve-access-control/trunk/Group.pm
pve-access-control/trunk/Role.pm
pve-access-control/trunk/User.pm
Log:
Modified: pve-access-control/trunk/ACL.pm
===================================================================
--- pve-access-control/trunk/ACL.pm 2010-08-13 08:46:04 UTC (rev 4997)
+++ pve-access-control/trunk/ACL.pm 2010-08-13 09:05:45 UTC (rev 4998)
@@ -3,6 +3,7 @@
use strict;
use warnings;
use PVE::INotify qw (read_file write_file);
+use PVE::Tools qw(split_list);
use PVE::AccessControl;
use PVE::SafeSyslog;
@@ -65,12 +66,12 @@
die "invalid ACL path '$param->{path}'\n" if !$path;
- foreach my $role (PVE::AccessControl::split_list($param->{roles})) {
+ foreach my $role (split_list($param->{roles})) {
PVE::AccessControl::verify_rolename($role);
die "role '$role' does not exist\n"
if !$cfg->{roles}->{$role};
- foreach my $ug (PVE::AccessControl::split_list($param->{uglist})) {
+ foreach my $ug (split_list($param->{uglist})) {
if ($ug =~ m/^@(\w+)$/) {
my $group = $1;
Modified: pve-access-control/trunk/AccessControl.pm
===================================================================
--- pve-access-control/trunk/AccessControl.pm 2010-08-13 08:46:04 UTC (rev 4997)
+++ pve-access-control/trunk/AccessControl.pm 2010-08-13 09:05:45 UTC (rev 4998)
@@ -8,7 +8,7 @@
use Digest::SHA;
use Authen::PAM qw(:constants);
use Net::LDAP;
-use PVE::Tools qw(run_command lock_file file_get_contents);
+use PVE::Tools qw(run_command lock_file file_get_contents split_list);
use PVE::INotify qw(read_file write_file);
use PVE::JSONSchema;
@@ -499,17 +499,6 @@
}
}
-sub split_list {
- my $listtxt = shift || '';
-
- $listtxt =~ s/[,;]/ /g;
- $listtxt =~ s/^\s+//;
-
- my @data = split (/\s+/, $listtxt);
-
- return @data;
-}
-
sub normalize_path {
my $path = shift;
@@ -524,6 +513,7 @@
return $path;
}
+PVE::JSONSchema::register_format('pve-userid', \&verify_username);
sub verify_username {
my ($username, $noerr) = @_;
@@ -535,11 +525,12 @@
return wantarray ? ($username, $1, $3) : $username;
}
- die "user name '$username' contains invalid characters\n" if !$noerr && !$username;
+ die "user name '$username' contains invalid characters\n" if !$noerr;
return undef;
}
+PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);
sub verify_groupname {
my ($groupname, $noerr) = @_;
@@ -553,6 +544,7 @@
return $groupname;
}
+PVE::JSONSchema::register_format('pve-roleid', \&verify_rolename);
sub verify_rolename {
my ($rolename, $noerr) = @_;
@@ -566,6 +558,19 @@
return $rolename;
}
+PVE::JSONSchema::register_format('pve-priv', \&verify_privname);
+sub verify_privname {
+ my ($priv, $noerr) = @_;
+
+ if (!$valid_privs->{$priv}) {
+ die "invalid priviledge '$priv'\n" if !$noerr;
+
+ return undef;
+ }
+
+ return $priv;
+}
+
sub userconfig_force_defaults {
my ($cfg) = @_;
Modified: pve-access-control/trunk/ChangeLog
===================================================================
--- pve-access-control/trunk/ChangeLog 2010-08-13 08:46:04 UTC (rev 4997)
+++ pve-access-control/trunk/ChangeLog 2010-08-13 09:05:45 UTC (rev 4998)
@@ -1,7 +1,19 @@
2010-08-13 Proxmox Support Team <support at proxmox.com>
+ * User.pm: use new 'format' property in schema
+
+ * ACL.pm: use new 'format' property in schema, remove redundant
+ calls to verify_XXX calls.
+
+ * Role.pm: use new 'format' property in schema, remove redundant
+ calls to verify_XXX calls.
+
+ * Group.pm: use new 'format' property in schema, remove redundant
+ calls to verify_XXX calls.
+
* AccessControl.pm (modify_acl): strict error checking - use 'die'
instead of 'warn', moved to ACL.pm
+ (verify_username): fix serious bug
2010-08-12 Proxmox Support Team <support at proxmox.com>
Modified: pve-access-control/trunk/Group.pm
===================================================================
--- pve-access-control/trunk/Group.pm 2010-08-13 08:46:04 UTC (rev 4997)
+++ pve-access-control/trunk/Group.pm 2010-08-13 09:05:45 UTC (rev 4998)
@@ -56,7 +56,7 @@
parameters => {
additionalProperties => 0,
properties => {
- groupid => { type => 'string' },
+ groupid => { type => 'string', format => 'pve-groupid' },
},
},
returns => { type => 'null' },
@@ -69,8 +69,6 @@
my $usercfg = read_file("usercfg");
my $group = $param->{groupid};
-
- PVE::AccessControl::verify_groupname($group);
die "group '$group' already exists\n"
if $usercfg->{groups}->{$group};
@@ -96,7 +94,7 @@
parameters => {
additionalProperties => 0,
properties => {
- groupid => { type => 'string' },
+ groupid => { type => 'string', format => 'pve-groupid'},
},
},
returns => {},
@@ -105,8 +103,6 @@
my $group = $param->{groupid};
- PVE::AccessControl::verify_groupname($group);
-
my $usercfg = read_file("usercfg");
my $data = $usercfg->{groups}->{$group};
Modified: pve-access-control/trunk/Role.pm
===================================================================
--- pve-access-control/trunk/Role.pm 2010-08-13 08:46:04 UTC (rev 4997)
+++ pve-access-control/trunk/Role.pm 2010-08-13 09:05:45 UTC (rev 4998)
@@ -56,7 +56,7 @@
parameters => {
additionalProperties => 0,
properties => {
- roleid => { type => 'string' },
+ roleid => { type => 'string', format => 'pve-roleid' },
privs => { type => 'string', optional => 1 },
},
},
@@ -71,8 +71,6 @@
my $role = $param->{roleid};
- PVE::AccessControl::verify_rolename($role);
-
die "role '$role' already exists\n"
if $usercfg->{roles}->{$role};
@@ -99,8 +97,8 @@
parameters => {
additionalProperties => 0,
properties => {
- roleid => { type => 'string' },
- privs => { type => 'string' },
+ roleid => { type => 'string', format => 'pve-roleid' },
+ privs => { type => 'string' , format => 'pve-priv-list' },
append => {
type => 'boolean',
optional => 1,
@@ -117,8 +115,6 @@
my $role = $param->{roleid};
- PVE::AccessControl::verify_rolename($role);
-
my $usercfg = read_file("usercfg");
die "role '$role' does not exist\n"
@@ -147,7 +143,7 @@
parameters => {
additionalProperties => 0,
properties => {
- roleid => { type => 'string' },
+ roleid => { type => 'string' , format => 'pve-roleid' },
},
},
returns => {},
@@ -158,8 +154,6 @@
my $role = $param->{roleid};
- PVE::AccessControl::verify_rolename($role);
-
my $data = $usercfg->{roles}->{$role};
die "role '$role' does not exist\n" if !$data;
@@ -177,7 +171,7 @@
parameters => {
additionalProperties => 0,
properties => {
- roleid => { type => 'string' },
+ roleid => { type => 'string', format => 'pve-roleid' },
}
},
returns => { type => 'null' },
@@ -189,8 +183,6 @@
my $role = $param->{roleid};
- PVE::AccessControl::verify_rolename($role);
-
my $usercfg = read_file("usercfg");
die "role '$role' does not exist\n"
Modified: pve-access-control/trunk/User.pm
===================================================================
--- pve-access-control/trunk/User.pm 2010-08-13 08:46:04 UTC (rev 4997)
+++ pve-access-control/trunk/User.pm 2010-08-13 09:05:45 UTC (rev 4998)
@@ -3,6 +3,7 @@
use strict;
use warnings;
use PVE::INotify qw (read_file write_file);
+use PVE::Tools qw(split_list);
use PVE::AccessControl;
use PVE::SafeSyslog;
@@ -57,7 +58,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string' },
+ userid => { type => 'string' , format => 'pve-userid'},
password => { type => 'string' },
}
},
@@ -80,9 +81,9 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string' },
+ userid => { type => 'string', format => 'pve-userid' },
password => { type => 'string', optional => 1 },
- groups => { type => 'string', optional => 1 },
+ groups => { type => 'string', optional => 1, format => 'pve-groupid-list'},
},
},
returns => { type => 'null' },
@@ -111,7 +112,7 @@
PVE::AccessControl::enable_user($username, $usercfg);
if ($param->{groups}) {
- foreach my $group (PVE::AccessControl::split_list($param->{groups})) {
+ foreach my $group (split_list($param->{groups})) {
if ($usercfg->{groups}->{$group}) {
PVE::AccessControl::add_user_group($username, $usercfg, $group);
} else {
@@ -138,7 +139,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string' },
+ userid => { type => 'string', format => 'pve-userid' },
},
},
returns => {},
@@ -166,9 +167,9 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string' },
+ userid => { type => 'string', format => 'pve-userid' },
password => { type => 'string', optional => 1 },
- groups => { type => 'string', optional => 1 },
+ groups => { type => 'string', optional => 1, format => 'pve-groupid-list' },
append => {
type => 'boolean',
optional => 1,
@@ -214,7 +215,7 @@
if (!$param->{append} && $param->{groups});
if ($param->{groups}) {
- foreach my $group (PVE::AccessControl::split_list($param->{groups})) {
+ foreach my $group (split_list($param->{groups})) {
if ($usercfg->{groups}->{$group}) {
PVE::AccessControl::add_user_group($username, $usercfg, $group);
} else {
@@ -246,7 +247,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string' },
+ userid => { type => 'string', format => 'pve-userid' },
}
},
returns => { type => 'null' },
More information about the pve-devel
mailing list