[pmg-devel] [PATCH pmg-api] fix #5367 api: sa-custom-score: add missing permissions to api-calls

[Stoiko Ivanov]

It seems we never added permission properties for the CRUD api calls,
for SpamAssassin custom scores. This results in them being available
only to root at pam.

OTOH the reverting (by deleting the shadow-file), applying (by
moving the shadow-file in place and restarting pmg-smtp-filter) was
available to all admin users, and listing all configured scores was
available to all 'admin' and 'audit' users.

The functionality itself should not be restricted to root at pam only.

Additionally remove a left-over commented 'protected => 1' and and one
that was active but not needed (reading
/etc/mail/spamassassin/pmg-scores.cf is possible for pmgproxy (running
as 'www-data').

Finally fix a mistake in describing the DELETE method.

Tested this with 'abc at pmg' as user - when the permissions were
'Auditor' the writing commands produced and error, with 'Administrator'
everything worked.

Fixes:  9aeedf1b ("add SACustom Package and API Calls for custom SpamAssassin scores")
Signed-off-by: Stoiko Ivanov <s.ivanov at proxmox.com>
---
 src/PMG/API2/SACustom.pm | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/PMG/API2/SACustom.pm b/src/PMG/API2/SACustom.pm
index 80a415f7..52a0fa38 100644
--- a/src/PMG/API2/SACustom.pm
+++ b/src/PMG/API2/SACustom.pm
@@ -54,7 +54,6 @@ __PACKAGE__->register_method({
     path => '',
     method => 'GET',
     description => "List custom scores.",
-    #    protected => 1,
     permissions => { check => ['admin', 'audit'] },
     proxyto => 'master',
     parameters => {
@@ -184,6 +183,7 @@ __PACKAGE__->register_method({
     description => "Create custom SpamAssassin score",
     protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin'] },
     parameters => {
         additionalProperties => 0,
         properties => json_config_properties({
@@ -226,8 +226,8 @@ __PACKAGE__->register_method({
     path => '{name}',
     method => 'GET',
     description => "Get custom SpamAssassin score",
-    protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin', 'audit'] },
     parameters => {
         additionalProperties => 0,
         properties => {
@@ -262,6 +262,7 @@ __PACKAGE__->register_method({
     description => "Edit custom SpamAssassin score",
     protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin'] },
     parameters => {
         additionalProperties => 0,
         properties => json_config_properties({
@@ -303,9 +304,10 @@ __PACKAGE__->register_method({
     name => 'delete_score',
     path => '{name}',
     method => 'DELETE',
-    description => "Edit custom SpamAssassin score",
+    description => "Delete custom SpamAssassin score",
     protected => 1,
     proxyto => 'master',
+    permissions => { check => ['admin'] },
     parameters => {
         additionalProperties => 0,
         properties => {
-- 
2.47.3