[pve-devel] [RFC 15/23] api: mark some paths notoken

[Fabian Grünbichler]

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---

Notes:
    requires versioned dependency on libpve-common-perl

 PVE/API2/AccessControl.pm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index 9d2da8d..2a52105 100644
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -234,6 +234,7 @@ __PACKAGE__->register_method ({
 	user => 'world' 
     },
     protected => 1, # else we can't access shadow files
+    notoken => 1, # we don't want tokens to create tickets
     description => "Create or verify authentication ticket.",
     parameters => {
 	additionalProperties => 0,
@@ -347,6 +348,7 @@ __PACKAGE__->register_method ({
 	    ],
     },
     protected => 1, # else we can't access shadow files
+    notoken => 1, # we don't want tokens to change the regular user password
     description => "Change user password.",
     parameters => {
 	additionalProperties => 0,
@@ -479,6 +481,7 @@ __PACKAGE__->register_method ({
 	    ],
     },
     protected => 1, # else we can't access shadow files
+    notoken => 1, # we don't want tokens to change the regular user's TFA settings
     description => "Change user u2f authentication.",
     parameters => {
 	additionalProperties => 0,
@@ -605,6 +608,7 @@ __PACKAGE__->register_method({
     method => 'POST',
     permissions => { user => 'all' },
     protected => 1, # else we can't access shadow files
+    notoken => 1, # we don't want tokens to access TFA information
     description => 'Finish a u2f challenge.',
     parameters => {
 	additionalProperties => 0,
-- 
2.20.1